81002 2012-03-13 09:08:48 -0700 ASSERTION FAILED: m_purgePreventCount in FontCache::getCachedFontData running svg/custom/animate-disallowed-use-element.svg 2012-04-02 14:24:10 -0700 1 1 1 Unclassified WebKit SVG 528+ (Nightly build) Unspecified Unspecified RESOLVED FIXED InRadar, MakingBotsRed P2 Normal --- 1 zimmermann webkit-unassigned mitz simon.fraser thorton webkit-bug-importer zimmermann oldest_to_newest 577406 0 zimmermann 2012-03-13 09:08:48 -0700 I sometimes see this assertion when using nrwt --tolerance 0 -p svg. Probably a FontCachePurgePreventer call missing somewhere. should be easy to fix. ASSERTION FAILED: m_purgePreventCount /Users/nzimmermann/Coding/WebKit/Source/WebCore/platform/graphics/FontCache.cpp(280) : WebCore::SimpleFontData *WebCore::FontCache::getCachedFontData(const WebCore::FontPlatformData *, WebCore::FontCache::ShouldRetain) 1 0x10ec70004 WebCore::FontCache::getCachedFontData(WebCore::FontPlatformData const*, WebCore::FontCache::ShouldRetain) 2 0x10ec80611 WebCore::FontCache::getFontDataForCharacters(WebCore::Font const&, unsigned short const*, int) 3 0x10ec86c3d WebCore::Font::glyphDataAndPageForCharacter(int, bool, WebCore::FontDataVariant) const 4 0x10f9a9dc9 WebCore::SVGTextRunRenderingContext::glyphDataForCharacter(WebCore::Font const&, WebCore::TextRun const&, WebCore::WidthIterator&, int, bool, int, unsigned int&) 5 0x10fe3efe6 WebCore::WidthIterator::glyphDataForCharacter(int, bool, int, unsigned int&) 6 0x10fe3f309 WebCore::WidthIterator::advance(int, WebCore::GlyphBuffer*) 7 0x10f9aaf11 WebCore::SVGTextMetricsBuilder::advanceSimpleText() 8 0x10f9aac9c WebCore::SVGTextMetricsBuilder::advance() 9 0x10f9ab4d7 WebCore::SVGTextMetricsBuilder::measureTextRenderer(WebCore::RenderSVGInlineText*, WebCore::MeasureTextData*) 10 0x10f9ab908 WebCore::SVGTextMetricsBuilder::walkTree(WebCore::RenderObject*, WebCore::RenderSVGInlineText*, WebCore::MeasureTextData*) 11 0x10f9ab952 WebCore::SVGTextMetricsBuilder::walkTree(WebCore::RenderObject*, WebCore::RenderSVGInlineText*, WebCore::MeasureTextData*) 12 0x10f9a476e WebCore::SVGTextMetricsBuilder::measureTextRenderer(WebCore::RenderSVGInlineText*) 13 0x10f99162f WebCore::SVGTextLayoutAttributesBuilder::rebuildMetricsForTextRenderer(WebCore::RenderSVGInlineText*) 14 0x10f97a87b WebCore::RenderSVGText::rebuildLayoutAttributes(WTF::Vector<WebCore::SVGTextLayoutAttributes*, 0ul>&) 15 0x10f97a5ee WebCore::RenderSVGInlineText::willBeDestroyed() 16 0x10f94150d WebCore::RenderObject::destroy() 17 0x10f9413fd WebCore::RenderObject::destroyAndCleanupAnonymousWrappers() 18 0x10f6f4d14 WebCore::Node::detach() 19 0x10e79a3e7 WebCore::ContainerNode::detachChildren() 20 0x10e797e09 WebCore::ContainerNode::detach() 21 0x10ebe46f2 WebCore::Element::detach() 22 0x10e79a3e7 WebCore::ContainerNode::detachChildren() 23 0x10e797e09 WebCore::ContainerNode::detach() 24 0x10ebe46f2 WebCore::Element::detach() 25 0x10e79a3e7 WebCore::ContainerNode::detachChildren() 26 0x10e797e09 WebCore::ContainerNode::detach() 27 0x10ebe46f2 WebCore::Element::detach() 28 0x10e79a3e7 WebCore::ContainerNode::detachChildren() 29 0x10e797e09 WebCore::ContainerNode::detach() 30 0x10ebe46f2 WebCore::Element::detach() 31 0x10e79a3e7 WebCore::ContainerNode::detachChildren() Segmentation fault: 11 No leak checking done: At least one WebView is still open. 593025 1 zimmermann 2012-04-01 05:47:03 -0700 *** Bug 82815 has been marked as a duplicate of this bug. *** 593026 2 zimmermann 2012-04-01 05:50:06 -0700 I'll try to find a way to make this reproducible. 593055 3 simon.fraser 2012-04-01 11:04:38 -0700 This is causing crashes on the debug bots. I question why all the work is being done under willBeDestroyed() though. Looks like useless work 593056 4 zimmermann 2012-04-01 11:17:58 -0700 (In reply to comment #3) > This is causing crashes on the debug bots. > > I question why all the work is being done under willBeDestroyed() though. Looks like useless work In case you missed my comment from the other bug report 82815, the work done there is absolutely needed when removing eg. tspan children dynamically from a text subtree - it's an optimization actually, to avoid rebuilding the whole text tree upon the next layout, if only a child got removed. Part of that logic lives in willBeDestroyed(). I think Tim knows what this is about as well. 593755 5 thorton 2012-04-02 13:29:38 -0700 smfr, from the dupe: > I think there's a documentBeingDestroyed that you could consult. 593802 6 webkit-bug-importer 2012-04-02 13:55:35 -0700 <rdar://problem/11168969> 593821 7 135182 thorton 2012-04-02 14:06:25 -0700 Created attachment 135182 patch 593840 8 thorton 2012-04-02 14:24:10 -0700 Landed in http://trac.webkit.org/changeset/112942 135182 2012-04-02 14:06:25 -0700 2012-04-02 14:13:27 -0700 patch 81002.diff text/plain 1657 thorton ZGlmZiAtLWdpdCBhL1NvdXJjZS9XZWJDb3JlL0NoYW5nZUxvZyBiL1NvdXJjZS9XZWJDb3JlL0No YW5nZUxvZwppbmRleCBiNDNlY2Q3YS4uMzIzMzBlNSAxMDA2NDQKLS0tIGEvU291cmNlL1dlYkNv cmUvQ2hhbmdlTG9nCisrKyBiL1NvdXJjZS9XZWJDb3JlL0NoYW5nZUxvZwpAQCAtMSwzICsxLDE5 IEBACisyMDEyLTA0LTAyICBUaW0gSG9ydG9uICA8dGltb3RoeV9ob3J0b25AYXBwbGUuY29tPgor CisgICAgICAgIEFTU0VSVElPTiBGQUlMRUQ6IG1fcHVyZ2VQcmV2ZW50Q291bnQgaW4gRm9udENh Y2hlOjpnZXRDYWNoZWRGb250RGF0YSBydW5uaW5nIHN2Zy9jdXN0b20vYW5pbWF0ZS1kaXNhbGxv d2VkLXVzZS1lbGVtZW50LnN2ZworICAgICAgICBodHRwczovL2J1Z3Mud2Via2l0Lm9yZy9zaG93 X2J1Zy5jZ2k/aWQ9ODEwMDIKKyAgICAgICAgPHJkYXI6Ly9wcm9ibGVtLzExMTY4OTY5PgorCisg ICAgICAgIFJldmlld2VkIGJ5IE5PQk9EWSAoT09QUyEpLgorCisgICAgICAgIERvbid0IHNwZW5k IHRpbWUgcmVidWlsZGluZyBTVkcgdGV4dCBsYXlvdXQgYXR0cmlidXRlcyBpZiB0aGUgZG9jdW1l bnQgaXMgYmVpbmcgdG9ybiBkb3duLCBhcworICAgICAgICB0aGV5IHdvbid0IGJlIHVzZWQsIGFu ZCBjYW4gY2F1c2UgYXNzZXJ0aW9uIGZhaWx1cmVzIGluIHRoZSBmb250IGNhY2hlLgorCisgICAg ICAgIE5vIG5ldyB0ZXN0cywgYXMgaXQgZml4ZXMgYW4gaW50ZXJtaXR0ZW50IGFzc2VydGlvbiBm YWlsdXJlIGR1cmluZyBkb2N1bWVudCBkZXN0cnVjdGlvbi4KKworICAgICAgICAqIHJlbmRlcmlu Zy9zdmcvUmVuZGVyU1ZHSW5saW5lVGV4dC5jcHA6CisgICAgICAgIChXZWJDb3JlOjpSZW5kZXJT VkdJbmxpbmVUZXh0Ojp3aWxsQmVEZXN0cm95ZWQpOgorCiAyMDEyLTA0LTAyICBCcmFkeSBFaWRz b24gIDxiZWlkc29uQGFwcGxlLmNvbT4KIAogICAgICAgICA8cmRhcjovL3Byb2JsZW0vMTEwMjAx NTU+IGFuZCBodHRwczovL2J1Z3Mud2Via2l0Lm9yZy9zaG93X2J1Zy5jZ2k/aWQ9ODI5MTAKZGlm ZiAtLWdpdCBhL1NvdXJjZS9XZWJDb3JlL3JlbmRlcmluZy9zdmcvUmVuZGVyU1ZHSW5saW5lVGV4 dC5jcHAgYi9Tb3VyY2UvV2ViQ29yZS9yZW5kZXJpbmcvc3ZnL1JlbmRlclNWR0lubGluZVRleHQu Y3BwCmluZGV4IGE1NWIwZjAuLjAyOTBiYTggMTAwNjQ0Ci0tLSBhL1NvdXJjZS9XZWJDb3JlL3Jl bmRlcmluZy9zdmcvUmVuZGVyU1ZHSW5saW5lVGV4dC5jcHAKKysrIGIvU291cmNlL1dlYkNvcmUv cmVuZGVyaW5nL3N2Zy9SZW5kZXJTVkdJbmxpbmVUZXh0LmNwcApAQCAtODcsNyArODcsOCBAQCB2 b2lkIFJlbmRlclNWR0lubGluZVRleHQ6OndpbGxCZURlc3Ryb3llZCgpCiAgICAgaWYgKGFmZmVj dGVkQXR0cmlidXRlcy5pc0VtcHR5KCkpCiAgICAgICAgIHJldHVybjsKIAotICAgIHRleHRSZW5k ZXJlci0+cmVidWlsZExheW91dEF0dHJpYnV0ZXMoYWZmZWN0ZWRBdHRyaWJ1dGVzKTsKKyAgICBp ZiAoIWRvY3VtZW50QmVpbmdEZXN0cm95ZWQoKSkKKyAgICAgICAgdGV4dFJlbmRlcmVyLT5yZWJ1 aWxkTGF5b3V0QXR0cmlidXRlcyhhZmZlY3RlZEF0dHJpYnV0ZXMpOwogfQogCiB2b2lkIFJlbmRl clNWR0lubGluZVRleHQ6OnNldFRleHRJbnRlcm5hbChQYXNzUmVmUHRyPFN0cmluZ0ltcGw+IHRl eHQpCg==