73116 2011-11-25 00:02:51 -0800 Crash in BidiRunList<Run>::replaceRunWithRuns with an empty bdi element 2011-11-25 12:21:45 -0800 1 1 1 Unclassified WebKit Layout and Rendering 528+ (Nightly build) Unspecified Unspecified RESOLVED FIXED P2 Normal --- 63903 1 rniwa rniwa dominicc eric hyatt leviw mitz playmobil robert webkit.review.bot zimmermann oldest_to_newest 508995 0 rniwa 2011-11-25 00:02:51 -0800 Open: <!DOCTYPE html> <html> <body> <keygen> <bdi></bdi> </body> </html> then we hit: ASSERTION FAILED: newRuns.runCount() /Users/rniwa/webkit/Source/WebCore/platform/text/BidiRunList.h(146) : void WebCore::BidiRunList<Run>::replaceRunWithRuns(Run*, WebCore::BidiRunList<Run>&) [with Run = WebCore::BidiRun] 1 0x1034d0df7 WebCore::BidiRunList<WebCore::BidiRun>::replaceRunWithRuns(WebCore::BidiRun*, WebCore::BidiRunList<WebCore::BidiRun>&) 2 0x1034bfb43 WebCore::constructBidiRuns(WebCore::BidiResolver<WebCore::InlineIterator, WebCore::BidiRun>&, WebCore::BidiRunList<WebCore::BidiRun>&, WebCore::InlineIterator const&, WebCore::VisualDirectionOverride, bool) 3 0x1034c4832 WebCore::RenderBlock::layoutRunsAndFloatsInRange(WebCore::LineLayoutState&, WebCore::BidiResolver<WebCore::InlineIterator, WebCore::BidiRun>&, WebCore::InlineIterator const&, WebCore::BidiStatus const&, unsigned int) 4 0x1034c5459 WebCore::RenderBlock::layoutRunsAndFloats(WebCore::LineLayoutState&, bool) 5 0x1034c5999 WebCore::RenderBlock::layoutInlineChildren(bool, int&, int&) 6 0x10349a3ae WebCore::RenderBlock::layoutBlock(bool, int, WebCore::RenderBlock::BlockLayoutPass) 7 0x10348e45d WebCore::RenderBlock::layout() 8 0x103497e62 WebCore::RenderBlock::layoutBlockChild(WebCore::RenderBox*, WebCore::RenderBlock::MarginInfo&, int&, int&) 9 0x103498e12 WebCore::RenderBlock::layoutBlockChildren(bool, int&) 10 0x10349a3c7 WebCore::RenderBlock::layoutBlock(bool, int, WebCore::RenderBlock::BlockLayoutPass) 11 0x10348e45d WebCore::RenderBlock::layout() 12 0x103497e62 WebCore::RenderBlock::layoutBlockChild(WebCore::RenderBox*, WebCore::RenderBlock::MarginInfo&, int&, int&) 13 0x103498e12 WebCore::RenderBlock::layoutBlockChildren(bool, int&) 14 0x10349a3c7 WebCore::RenderBlock::layoutBlock(bool, int, WebCore::RenderBlock::BlockLayoutPass) 15 0x10348e45d WebCore::RenderBlock::layout() 16 0x10363b4a0 WebCore::RenderView::layout() 17 0x102d4b6e2 WebCore::FrameView::layout(bool) 18 0x102b52ff3 WebCore::Document::implicitClose() 19 0x102d28549 WebCore::FrameLoader::checkCallImplicitClose() 20 0x102d2bde8 WebCore::FrameLoader::checkCompleted() 21 0x102d2c664 WebCore::FrameLoader::finishedParsing() 22 0x102b54b6c WebCore::Document::finishedParsing() 23 0x102e6afaa WebCore::HTMLTreeBuilder::finished() 24 0x102de9798 WebCore::HTMLDocumentParser::end() 25 0x102de988d WebCore::HTMLDocumentParser::attemptToRunDeferredScriptsAndEnd() 26 0x102deb399 WebCore::HTMLDocumentParser::prepareToStopParsing() 27 0x102de9454 WebCore::HTMLDocumentParser::attemptToEnd() 28 0x102de96ec WebCore::HTMLDocumentParser::finish() 29 0x102b923fe WebCore::DocumentWriter::endIfNotLoadingMainResource() 30 0x102b92445 WebCore::DocumentWriter::end() 31 0x102b7bd1b WebCore::DocumentLoader::finishedLoading() 508997 1 116572 rniwa 2011-11-25 00:03:06 -0800 Created attachment 116572 demo 508998 2 rniwa 2011-11-25 00:04:19 -0800 Also see the bug 71737. 509024 3 rniwa 2011-11-25 00:56:30 -0800 Apparently this is nothing to do with keygen. We just need some text rendered on the page and an empty bdi element. 509040 4 rniwa 2011-11-25 01:48:56 -0800 Just realized that this actually crashes WebKit :( 509043 5 116583 rniwa 2011-11-25 01:59:00 -0800 Created attachment 116583 fixes the failure 509218 6 116583 eric 2011-11-25 11:09:44 -0800 Comment on attachment 116583 fixes the failure Thanks! 509243 7 116583 webkit.review.bot 2011-11-25 12:21:23 -0800 Comment on attachment 116583 fixes the failure Clearing flags on attachment: 116583 Committed r101180: <http://trac.webkit.org/changeset/101180> 509244 8 webkit.review.bot 2011-11-25 12:21:29 -0800 All reviewed patches have been landed. Closing bug. 509246 9 rniwa 2011-11-25 12:21:45 -0800 *** Bug 71737 has been marked as a duplicate of this bug. *** 116572 2011-11-25 00:03:06 -0800 2011-11-25 00:03:06 -0800 demo output-crash.html text/html 67 rniwa PCFET0NUWVBFIGh0bWw+CjxodG1sPgo8Ym9keT4KPGtleWdlbj4KPGJkaT48L2JkaT4KPC9ib2R5 Pgo8L2h0bWw+Cg== 116583 2011-11-25 01:59:00 -0800 2011-11-25 12:21:23 -0800 fixes the failure bug-73116-20111125015859.patch text/plain 3227 rniwa SW5kZXg6IFNvdXJjZS9XZWJDb3JlL0NoYW5nZUxvZwo9PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09Ci0tLSBTb3VyY2UvV2Vi Q29yZS9DaGFuZ2VMb2cJKHJldmlzaW9uIDEwMTE1OCkKKysrIFNvdXJjZS9XZWJDb3JlL0NoYW5n ZUxvZwkod29ya2luZyBjb3B5KQpAQCAtMSwzICsxLDIwIEBACisyMDExLTExLTI1ICBSeW9zdWtl IE5pd2EgIDxybml3YUB3ZWJraXQub3JnPgorCisgICAgICAgIENyYXNoIGluIEJpZGlSdW5MaXN0 PFJ1bj46OnJlcGxhY2VSdW5XaXRoUnVucyB3aXRoIGFuIGVtcHR5IGJkaSBlbGVtZW50CisgICAg ICAgIGh0dHBzOi8vYnVncy53ZWJraXQub3JnL3Nob3dfYnVnLmNnaT9pZD03MzExNgorCisgICAg ICAgIFJldmlld2VkIGJ5IE5PQk9EWSAoT09QUyEpLgorCisgICAgICAgIFRoZSBhc3NlcnRpb24g ZmFpbHVyZSB3YXMgY2F1c2VkIGJlY2F1c2UgaXNvbGF0ZWRSZXNvbHZlciBpcyBpbml0aWFsaXpl ZCB3aXRoCisgICAgICAgIG51bGwgc3RhcnQgb2JqZWN0IGR1ZSB0byB0aGUgaXNvbGF0ZWQgcnVu IGJlaW5nIGVtcHR5LgorCisgICAgICAgIEZpeGVkIHRoZSBmYWlsdXJlIGJ5IHNraXBwaW5nIGVt cHR5IGlzb2xhdGVkIHJ1bnMuCisKKyAgICAgICAgVGVzdDogZmFzdC90ZXh0L2VtcHR5LWJkaS1j cmFzaC5odG1sCisKKyAgICAgICAgKiByZW5kZXJpbmcvUmVuZGVyQmxvY2tMaW5lTGF5b3V0LmNw cDoKKyAgICAgICAgKFdlYkNvcmU6OmNvbnN0cnVjdEJpZGlSdW5zKToKKwogMjAxMS0xMS0yNSAg S2VudGFybyBIYXJhICA8aGFyYWtlbkBjaHJvbWl1bS5vcmc+CiAKICAgICAgICAgUmVtb3ZlIFdl YkNvcmUuZ3lwL3NjcmlwdHMvcnVsZV9iaW5kaW5nLnB5CkluZGV4OiBTb3VyY2UvV2ViQ29yZS9y ZW5kZXJpbmcvUmVuZGVyQmxvY2tMaW5lTGF5b3V0LmNwcAo9PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09Ci0tLSBTb3VyY2Uv V2ViQ29yZS9yZW5kZXJpbmcvUmVuZGVyQmxvY2tMaW5lTGF5b3V0LmNwcAkocmV2aXNpb24gMTAx MTUzKQorKysgU291cmNlL1dlYkNvcmUvcmVuZGVyaW5nL1JlbmRlckJsb2NrTGluZUxheW91dC5j cHAJKHdvcmtpbmcgY29weSkKQEAgLTk2NCw2ICs5NjQsOCBAQCBzdGF0aWMgaW5saW5lIHZvaWQg Y29uc3RydWN0QmlkaVJ1bnMoSW5sCiAgICAgICAgIC8vIEZJWE1FOiBUaGUgZmFjdCB0aGF0IHdl IGhhdmUgdG8gY29uc3RydWN0IGFuIEl0ZXJhdG9yIGhlcmUKICAgICAgICAgLy8gY3VycmVudGx5 IHByZXZlbnRzIHRoaXMgY29kZSBmcm9tIG1vdmluZyBpbnRvIEJpZGlSZXNvbHZlci4KICAgICAg ICAgUmVuZGVyT2JqZWN0KiBzdGFydE9iaiA9IGJpZGlGaXJzdFNraXBwaW5nRW1wdHlJbmxpbmVz KGlzb2xhdGVkU3BhbiwgJmlzb2xhdGVkUmVzb2x2ZXIpOworICAgICAgICBpZiAoIXN0YXJ0T2Jq KQorICAgICAgICAgICAgY29udGludWU7CiAgICAgICAgIGlzb2xhdGVkUmVzb2x2ZXIuc2V0UG9z aXRpb24oSW5saW5lSXRlcmF0b3IoaXNvbGF0ZWRTcGFuLCBzdGFydE9iaiwgMCkpOwogCiAgICAg ICAgIC8vIEZJWE1FOiBpc29sYXRlZEVuZCBzaG91bGQgcHJvYmFibHkgZXF1YWwgZW5kIG9yIHRo ZSBsYXN0IGNoYXIgaW4gaXNvbGF0ZWRTcGFuLgpJbmRleDogTGF5b3V0VGVzdHMvQ2hhbmdlTG9n Cj09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT0KLS0tIExheW91dFRlc3RzL0NoYW5nZUxvZwkocmV2aXNpb24gMTAxMTU4KQor KysgTGF5b3V0VGVzdHMvQ2hhbmdlTG9nCSh3b3JraW5nIGNvcHkpCkBAIC0xLDMgKzEsMTUgQEAK KzIwMTEtMTEtMjUgIFJ5b3N1a2UgTml3YSAgPHJuaXdhQHdlYmtpdC5vcmc+CisKKyAgICAgICAg Q3Jhc2ggaW4gQmlkaVJ1bkxpc3Q8UnVuPjo6cmVwbGFjZVJ1bldpdGhSdW5zIHdpdGggYW4gZW1w dHkgYmRpIGVsZW1lbnQKKyAgICAgICAgaHR0cHM6Ly9idWdzLndlYmtpdC5vcmcvc2hvd19idWcu Y2dpP2lkPTczMTE2CisKKyAgICAgICAgUmV2aWV3ZWQgYnkgTk9CT0RZIChPT1BTISkuCisKKyAg ICAgICAgQWRkZWQgYSByZWdyZXNzaW9uIHRlc3QuCisKKyAgICAgICAgKiBmYXN0L3RleHQvZW1w dHktYmRpLWNyYXNoLWV4cGVjdGVkLnR4dDogQWRkZWQuCisgICAgICAgICogZmFzdC90ZXh0L2Vt cHR5LWJkaS1jcmFzaC5odG1sOiBBZGRlZC4KKwogMjAxMS0xMS0yNSAgUGF2ZWwgRmVsZG1hbiAg PHBmZWxkbWFuQGdvb2dsZS5jb20+CiAKICAgICAgICAgV2ViIEluc3BlY3RvcjogcmVzb3VyY2Ut dHJlZS1lcnJvcnMtcmVsb2FkLmh0bWwgaXMgZmxha3kuCkluZGV4OiBMYXlvdXRUZXN0cy9mYXN0 L3RleHQvZW1wdHktYmRpLWNyYXNoLWV4cGVjdGVkLnR4dAo9PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09Ci0tLSBMYXlvdXRU ZXN0cy9mYXN0L3RleHQvZW1wdHktYmRpLWNyYXNoLWV4cGVjdGVkLnR4dAkocmV2aXNpb24gMCkK KysrIExheW91dFRlc3RzL2Zhc3QvdGV4dC9lbXB0eS1iZGktY3Jhc2gtZXhwZWN0ZWQudHh0CShy ZXZpc2lvbiAwKQpAQCAtMCwwICsxIEBACitUaGlzIHRlc3QgZW5zdXJlcyBXZWJLaXQgZG9lcyBu b3QgY3Jhc2ggd2hlbiBlbmNvdW50ZXJpbmcgYW4gZW1wdHkgYmRpIGVsZW1lbnQuCkluZGV4OiBM YXlvdXRUZXN0cy9mYXN0L3RleHQvZW1wdHktYmRpLWNyYXNoLmh0bWwKPT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PQotLS0g TGF5b3V0VGVzdHMvZmFzdC90ZXh0L2VtcHR5LWJkaS1jcmFzaC5odG1sCShyZXZpc2lvbiAwKQor KysgTGF5b3V0VGVzdHMvZmFzdC90ZXh0L2VtcHR5LWJkaS1jcmFzaC5odG1sCShyZXZpc2lvbiAw KQpAQCAtMCwwICsxLDEzIEBACis8IURPQ1RZUEUgaHRtbD4KKzxodG1sPgorPGJvZHk+CitUaGlz IHRlc3QgZW5zdXJlcyBXZWJLaXQgZG9lcyBub3QgY3Jhc2ggd2hlbiBlbmNvdW50ZXJpbmcgYW4g ZW1wdHkgYmRpIGVsZW1lbnQuCis8YmRpPjwvYmRpPgorPHNjcmlwdD4KKworaWYgKHdpbmRvdy5s YXlvdXRUZXN0Q29udHJvbGxlcikKKyAgICBsYXlvdXRUZXN0Q29udHJvbGxlci5kdW1wQXNUZXh0 KCk7CisKKzwvc2NyaXB0PgorPC9ib2R5PgorPC9odG1sPgo=