96199 2012-09-09 00:32:42 -0700 [GTK][a11y] editing/pasteboard/paste-blockquote-into-bluckquote-4.html crashes 2012-09-11 00:33:12 -0700 1 1 1 Unclassified WebKit WebKitGTK 528+ (Nightly build) Unspecified Unspecified RESOLVED FIXED P2 Normal --- 1 zan webkit-unassigned jdiggs mario webkit.review.bot oldest_to_newest 715439 0 zan 2012-09-09 00:32:42 -0700 editing/pasteboard/paste-blockquote-into-bluckquote-4.html has been crashing lately, both in debug and WK2 builds: http://test-results.appspot.com/dashboards/flakiness_dashboard.html#group=%40ToT%20-%20webkit.org&tests=editing%2Fpasteboard%2Fpaste-blockquote-into-blockquote-4.html The WK2 builder suggests the crashes have started at r127370 (but I'm not sure since the builder doesn't yet provide crash logs): http://trac.webkit.org/changeset/127370 Crash log for DumpRenderTree (pid 13426): ... Program terminated with signal 11, Segmentation fault. #0 0x00007f5a80edb20b in WebCore::AccessibilityObject::accessibilityPlatformIncludesObject (this=0xf543de0) at ../../Source/WebCore/accessibility/gtk/AccessibilityObjectAtk.cpp:92 92 if (child->isLink() || !child->firstAnonymousBlockChild()) ... Thread 1 (Thread 0x7f5a75172900 (LWP 13426)): #0 0x00007f5a80edb20b in WebCore::AccessibilityObject::accessibilityPlatformIncludesObject (this=0xf543de0) at ../../Source/WebCore/accessibility/gtk/AccessibilityObjectAtk.cpp:92 #1 0x00007f5a7fb0ac95 in WebCore::AccessibilityRenderObject::accessibilityIsIgnoredBase (this=0xf543de0) at ../../Source/WebCore/accessibility/AccessibilityRenderObject.cpp:1862 #2 0x00007f5a7fb0ace2 in WebCore::AccessibilityRenderObject::accessibilityIsIgnored (this=0xf543de0) at ../../Source/WebCore/accessibility/AccessibilityRenderObject.cpp:1876 #3 0x00007f5a7faf98f6 in WebCore::AccessibilityObject::parentObjectUnignored (this=0xf54ac70) at ../../Source/WebCore/accessibility/AccessibilityObject.cpp:342 #4 0x00007f5a80edbe7d in WebCore::AXObjectCache::nodeTextChangePlatformNotification (this=0xf53ea40, object=0xf54ac70, textChange=WebCore::AXObjectCache::AXTextInserted, offset=0, text="Two") at ../../Source/WebCore/accessibility/gtk/AXObjectCacheAtk.cpp:172 #5 0x00007f5a7fb21963 in WebCore::AXObjectCache::nodeTextChangeNotification (this=0xf53ea40, node=0xf54ad50, textChange=WebCore::AXObjectCache::AXTextInserted, offset=0, text="Two") at ../../Source/WebCore/accessibility/AXObjectCache.cpp:662 #6 0x00007f5a7fee1999 in WebCore::sendAXTextChangedIgnoringLineBreaks (node=0xf54ad50, textChange=WebCore::AXObjectCache::AXTextInserted) at ../../Source/WebCore/editing/AppendNodeCommand.cpp:54 #7 0x00007f5a7fee1a93 in WebCore::AppendNodeCommand::doApply (this=0xf54aa50) at ../../Source/WebCore/editing/AppendNodeCommand.cpp:66 #8 0x00007f5a7fef4018 in WebCore::CompositeEditCommand::applyCommandToComposite (this=0xf54a7f0, prpCommand=...) at ../../Source/WebCore/editing/CompositeEditCommand.cpp:256 #9 0x00007f5a7fef4e13 in WebCore::CompositeEditCommand::appendNode (this=0xf54a7f0, node=..., parent=...) at ../../Source/WebCore/editing/CompositeEditCommand.cpp:375 #10 0x00007f5a7fef4868 in WebCore::CompositeEditCommand::insertNodeAfter (this=0xf54a7f0, insertChild=..., refChild=...) at ../../Source/WebCore/editing/CompositeEditCommand.cpp:335 #11 0x00007f5a7ff637eb in WebCore::ReplaceSelectionCommand::doApply (this=0xf54a7f0) at ../../Source/WebCore/editing/ReplaceSelectionCommand.cpp:980 #12 0x00007f5a7fef3dcf in WebCore::CompositeEditCommand::apply (this=0xf54a7f0) at ../../Source/WebCore/editing/CompositeEditCommand.cpp:204 #13 0x00007f5a7fef3aba in WebCore::applyCommand (command=...) at ../../Source/WebCore/editing/CompositeEditCommand.cpp:161 #14 0x00007f5a7ff181e2 in WebCore::executeInsertFragment (frame=0x1668c90, fragment=...) at ../../Source/WebCore/editing/EditorCommand.cpp:196 #15 0x00007f5a7ff19890 in WebCore::executeInsertHTML (frame=0x1668c90, value="<blockquote type='cite'>One</blockquote>Two<blockquote type='cite'>Three</blockquote>Four") at ../../Source/WebCore/editing/EditorCommand.cpp:505 #16 0x00007f5a7ff1cd5c in WebCore::Editor::Command::execute (this=0x7fff1c8ca660, parameter="<blockquote type='cite'>One</blockquote>Two<blockquote type='cite'>Three</blockquote>Four", triggeringEvent=0x0) at ../../Source/WebCore/editing/EditorCommand.cpp:1705 #17 0x00007f5a7fdf3c98 in WebCore::Document::execCommand (this=0xf518ac0, commandName="InsertHTML", userInterface=false, value="<blockquote type='cite'>One</blockquote>Two<blockquote type='cite'>Three</blockquote>Four") at ../../Source/WebCore/dom/Document.cpp:4587 #18 0x00007f5a80a66b22 in WebCore::jsDocumentPrototypeFunctionExecCommand (exec=0x7f5a31355090) at DerivedSources/WebCore/JSDocument.cpp:2627 #19 0x00007f5a34f4c265 in ?? () #20 0x00007fff1c8ca810 in ?? () #21 0x00007f5a83858930 in llint_op_call () from /home/slave/webkitgtk/gtk-linux-64-debug/build/WebKitBuild/Debug/.libs/libjavascriptcoregtk-3.0.so.0 #22 0x00007fff1c8ca7a0 in ?? () #23 0x00007fff1c8ca7d0 in ?? () #24 0x0000000000000000 in ?? () 715561 1 jdiggs 2012-09-09 12:59:44 -0700 Any chance this fixes it? http://trac.webkit.org/changeset/127619 715564 2 jdiggs 2012-09-09 13:03:38 -0700 Argh, never mind. I was looking at the wrong changeset. 715920 3 zan 2012-09-10 04:20:28 -0700 editing/deleting/25322-2.html is crashing in the same place, but with a slightly different backtrace: http://test-results.appspot.com/dashboards/flakiness_dashboard.html#group=%40ToT%20- %20webkit.org&tests=editing%2Fdeleting%2F25322-2.html Crash log for DumpRenderTree (pid 17223): ... Program terminated with signal 11, Segmentation fault. #0 0x00007ffc382780bf in WebCore::AccessibilityObject::accessibilityPlatformIncludesObject (this=0xc66b7a0) at ../../Source/WebCore/accessibility/gtk/AccessibilityObjectAtk.cpp:92 92 if (child->isLink() || !child->firstAnonymousBlockChild()) ... Thread 1 (Thread 0x7ffc2c525900 (LWP 17223)): #0 0x00007ffc382780bf in WebCore::AccessibilityObject::accessibilityPlatformIncludesObject (this=0xc66b7a0) at ../../Source/WebCore/accessibility/gtk/AccessibilityObjectAtk.cpp:92 #1 0x00007ffc36ebdb95 in WebCore::AccessibilityRenderObject::accessibilityIsIgnoredBase (this=0xc66b7a0) at ../../Source/WebCore/accessibility/AccessibilityRenderObject.cpp:1862 #2 0x00007ffc36ebdbe2 in WebCore::AccessibilityRenderObject::accessibilityIsIgnored (this=0xc66b7a0) at ../../Source/WebCore/accessibility/AccessibilityRenderObject.cpp:1876 #3 0x00007ffc38284556 in objectFocusedAndCaretOffsetUnignored (referenceObject=0xc66b7a0, offset=@0x7fff35178f6c: -1) at ../../Source/WebCore/accessibility/gtk/WebKitAccessibleWrapperAtk.cpp:1013 #4 0x00007ffc38284eba in WebCore::FrameSelection::notifyAccessibilityForSelectionChange (this=0x12682c0) at ../../Source/WebCore/editing/gtk/FrameSelectionGtk.cpp:96 #5 0x00007ffc372e0b24 in WebCore::FrameSelection::setSelection (this=0x12682c0, newSelection=..., options=0, align=WebCore::FrameSelection::AlignCursorOnScrollIfNeeded, granularity=WebCore::CharacterGranularity) at ../../Source/WebCore/editing/FrameSelection.cpp:317 #6 0x00007ffc372d8a61 in WebCore::Editor::changeSelectionAfterCommand (this=0x12681f8, newSelection=..., options=0) at ../../Source/WebCore/editing/Editor.cpp:2484 #7 0x00007ffc372d0080 in WebCore::Editor::appliedEditing (this=0x12681f8, cmd=...) at ../../Source/WebCore/editing/Editor.cpp:794 #8 0x00007ffc3732b6be in WebCore::TypingCommand::typingAddedToOpenCommand (this=0xc780d90, commandTypeForAddedTyping=WebCore::TypingCommand::DeleteKey) at ../../Source/WebCore/editing/TypingCommand.cpp:347 #9 0x00007ffc3732c744 in WebCore::TypingCommand::deleteKeyPressed (this=0xc780d90, granularity=WebCore::CharacterGranularity, killRing=false) at ../../Source/WebCore/editing/TypingCommand.cpp:524 #10 0x00007ffc3732b25a in WebCore::TypingCommand::doApply (this=0xc780d90) at ../../Source/WebCore/editing/TypingCommand.cpp:267 #11 0x00007ffc372a1546 in WebCore::CompositeEditCommand::apply (this=0xc780d90) at ../../Source/WebCore/editing/CompositeEditCommand.cpp:204 #12 0x00007ffc3732a3f0 in WebCore::TypingCommand::deleteKeyPressed (document=0xc5a31e0, options=0, granularity=WebCore::CharacterGranularity) at ../../Source/WebCore/editing/TypingCommand.cpp:125 #13 0x00007ffc372c6355 in WebCore::executeDelete (frame=0x1267c90, source=WebCore::CommandFromDOM) at ../../Source/WebCore/editing/EditorCommand.cpp:334 #14 0x00007ffc372ca3c4 in WebCore::Editor::Command::execute (this=0x7fff351798a0, parameter="(null)", triggeringEvent=0x0) at ../../Source/WebCore/editing/EditorCommand.cpp:1705 #15 0x00007ffc371a3da6 in WebCore::Document::execCommand (this=0xc5a31e0, commandName="Delete", userInterface=false, value="(null)") at ../../Source/WebCore/dom/Document.cpp:4587 #16 0x00007ffc37e0da9e in WebCore::jsDocumentPrototypeFunctionExecCommand (exec=0x7ffbe8708080) at DerivedSources/WebCore/JSDocument.cpp:2627 #17 0x00007ffbec2ff265 in ?? () #18 0x00007fff35179a50 in ?? () #19 0x00007ffc3abef49c in llint_op_call () from /home/slave/webkitgtk/gtk-linux-64-debug/build/WebKitBuild/Debug/.libs/libjavascriptcoregtk-3.0.so.0 #20 0x00007fff351799e0 in ?? () #21 0x00007fff35179a10 in ?? () #22 0x00007ffbe86de500 in ?? () #23 0x00007ffc3aaf15a1 in JSC::Register::Register (this=0x0) at ../../Source/JavaScriptCore/interpreter/Register.h:105 #24 0x00007ffc3ab9bef4 in JSC::JITCode::execute (this=0x7ffbe861df08, registerFile=0x128baa8, callFrame=0x7ffbe8708038, globalData=0x1230800) at ../../Source/JavaScriptCore/jit/JITCode.h:134 #25 0x00007ffc3ab98a53 in JSC::Interpreter::executeCall (this=0x128ba90, callFrame=0x7ffbe869ee90, function=0x7ffbe86de500, callType=JSC::CallTypeJS, callData=..., thisValue=..., args=...) at ../../Source/JavaScriptCore/interpreter/Interpreter.cpp:1070 #26 0x00007ffc3ac66ccd in JSC::call (exec=0x7ffbe869ee90, functionObject=..., callType=JSC::CallTypeJS, callData=..., thisValue=..., args=...) at ../../Source/JavaScriptCore/runtime/CallData.cpp:39 #27 0x00007ffc36f00d33 in WebCore::JSMainThreadExecState::call (exec=0x7ffbe869ee90, functionObject=..., callType=JSC::CallTypeJS, callData=..., thisValue=..., args=...) at ../../Source/WebCore/bindings/js/JSMainThreadExecState.h:56 #28 0x00007ffc36f6e5be in WebCore::ScheduledAction::executeFunctionInContext (this=0xc861630, globalObject=0x7ffbe869ec80, thisValue=..., context=0xc5a3308) at ../../Source/WebCore/bindings/js/ScheduledAction.cpp:115 #29 0x00007ffc36f6e7aa in WebCore::ScheduledAction::execute (this=0xc861630, document=0xc5a31e0) at ../../Source/WebCore/bindings/js/ScheduledAction.cpp:137 #30 0x00007ffc36f6e32e in WebCore::ScheduledAction::execute (this=0xc861630, context=0xc5a3308) at ../../Source/WebCore/bindings/js/ScheduledAction.cpp:83 #31 0x00007ffc376b0de6 in WebCore::DOMTimer::fired (this=0xc861670) at ../../Source/WebCore/page/DOMTimer.cpp:149 #32 0x00007ffc37872890 in WebCore::ThreadTimers::sharedTimerFiredInternal (this=0x127e6b0) at ../../Source/WebCore/platform/ThreadTimers.cpp:115 #33 0x00007ffc37872797 in WebCore::ThreadTimers::sharedTimerFired () at ../../Source/WebCore/platform/ThreadTimers.cpp:93 #34 0x00007ffc382c3c8e in WebCore::timeout_cb () at ../../Source/WebCore/platform/gtk/SharedTimerGtk.cpp:49 #35 0x00007ffc35b9fa42 in g_timeout_dispatch () from /home/slave/webkitgtk/gtk-linux-64-debug/build/WebKitBuild/Dependencies/Root/lib64/libglib-2.0.so.0 #36 0x00007ffc35b9dc91 in g_main_dispatch () from /home/slave/webkitgtk/gtk-linux-64-debug/build/WebKitBuild/Dependencies/Root/lib64/libglib-2.0.so.0 #37 0x00007ffc35b9e956 in g_main_context_dispatch () from /home/slave/webkitgtk/gtk-linux-64-debug/build/WebKitBuild/Dependencies/Root/lib64/libglib-2.0.so.0 #38 0x00007ffc35b9eb39 in g_main_context_iterate () from /home/slave/webkitgtk/gtk-linux-64-debug/build/WebKitBuild/Dependencies/Root/lib64/libglib-2.0.so.0 #39 0x00007ffc35b9ef69 in g_main_loop_run () from /home/slave/webkitgtk/gtk-linux-64-debug/build/WebKitBuild/Dependencies/Root/lib64/libglib-2.0.so.0 #40 0x00007ffc3648d7de in gtk_main () from /home/slave/webkitgtk/gtk-linux-64-debug/build/WebKitBuild/Dependencies/Root/lib64/libgtk-3.so.0 #41 0x0000000000477440 in runTest (inputLine=...) at ../../Tools/DumpRenderTree/gtk/DumpRenderTree.cpp:753 #42 0x0000000000476b14 in runTestingServerLoop () at ../../Tools/DumpRenderTree/gtk/DumpRenderTree.cpp:540 #43 0x0000000000479ace in main (argc=2, argv=0x7fff3517ab58) at ../../Tools/DumpRenderTree/gtk/DumpRenderTree.cpp:1445 715922 4 jdiggs 2012-09-10 04:29:16 -0700 This is on my to-do list for today. Sorry about that! 716059 5 163126 jdiggs 2012-09-10 07:26:04 -0700 Created attachment 163126 Patch 716060 6 jdiggs 2012-09-10 07:29:18 -0700 Zan, I cannot repro the first crash in either debug and WK2. But I can reliably repro the second. The attached patch fixes that crash. Zan, if you have a chance to verify this also fixes the first it would be awesome. Sorry and thanks! 716215 7 163126 webkit.review.bot 2012-09-10 10:12:33 -0700 Comment on attachment 163126 Patch Clearing flags on attachment: 163126 Committed r128074: <http://trac.webkit.org/changeset/128074> 716216 8 webkit.review.bot 2012-09-10 10:12:36 -0700 All reviewed patches have been landed. Closing bug. 716906 9 zan 2012-09-11 00:33:12 -0700 (In reply to comment #6) > Zan, I cannot repro the first crash in either debug and WK2. But I can reliably repro the second. The attached patch fixes that crash. Zan, if you have a chance to verify this also fixes the first it would be awesome. > > Sorry and thanks! The bots are free of crashes in these two tests after the patch landed, so I think everything is well. Thanks for fixing! 163126 2012-09-10 07:26:04 -0700 2012-09-10 10:12:33 -0700 Patch bug-96199-20120910102540.patch text/plain 1733 jdiggs U3VidmVyc2lvbiBSZXZpc2lvbjogMTI3OTkwCmRpZmYgLS1naXQgYS9Tb3VyY2UvV2ViQ29yZS9D aGFuZ2VMb2cgYi9Tb3VyY2UvV2ViQ29yZS9DaGFuZ2VMb2cKaW5kZXggNWZmNzdkODNkMzdjZDNm ZmM1MjI1MjY3MmZlZjg2ZTNlZjYzOTZhYi4uYmQxYjk1NzBjNDk2OTIzNzYyZWEwZWRjNWNlYTIw NWVmMTgyYTJkYyAxMDA2NDQKLS0tIGEvU291cmNlL1dlYkNvcmUvQ2hhbmdlTG9nCisrKyBiL1Nv dXJjZS9XZWJDb3JlL0NoYW5nZUxvZwpAQCAtMSwzICsxLDE5IEBACisyMDEyLTA5LTEwICBKb2Fu bWFyaWUgRGlnZ3MgIDxqZGlnZ3NAaWdhbGlhLmNvbT4KKworICAgICAgICBbR1RLXVthMTF5XSBl ZGl0aW5nL3Bhc3RlYm9hcmQvcGFzdGUtYmxvY2txdW90ZS1pbnRvLWJsb2NrcXVvdGUtNC5odG1s IGNyYXNoZXMKKyAgICAgICAgaHR0cHM6Ly9idWdzLndlYmtpdC5vcmcvc2hvd19idWcuY2dpP2lk PTk2MTk5CisKKyAgICAgICAgUmV2aWV3ZWQgYnkgTk9CT0RZIChPT1BTISkuCisKKyAgICAgICAg QWRkZWQgc2FuaXR5IGNoZWNrIHRvIGNvcnJlY3QgZXJyb25lb3VzIGFzc3VtcHRpb24gdGhhdCB0 aGVyZSB3aWxsCisgICAgICAgIGFsd2F5cyBiZSBhIGNoaWxkIG9iamVjdC4KKworICAgICAgICBO byBuZXcgdGVzdHMgYXMgdGhlIGJ1ZyBjcmFzaGVzIHR3byBleGlzdGluZyBMYXlvdXQgVGVzdHMg d2hpY2ggc2hvdWxkCisgICAgICAgIG5vIGxvbmdlciBjcmFzaCBhcyBhIHJlc3VsdCBvZiB0aGlz IGZpeC4KKworICAgICAgICAqIGFjY2Vzc2liaWxpdHkvZ3RrL0FjY2Vzc2liaWxpdHlPYmplY3RB dGsuY3BwOgorICAgICAgICAoV2ViQ29yZTo6QWNjZXNzaWJpbGl0eU9iamVjdDo6YWNjZXNzaWJp bGl0eVBsYXRmb3JtSW5jbHVkZXNPYmplY3QpOgorCiAyMDEyLTA5LTA5ICBHeXV5b3VuZyBLaW0g IDxneXV5b3VuZy5raW1Ac2Ftc3VuZy5jb20+CiAKICAgICAgICAgW0VGTF0gRml4IGJ1aWxkIGJy ZWFrIHdoZW4gTUVESUFfU1RSRUFNIGlzIGVuYWJsZWQuCmRpZmYgLS1naXQgYS9Tb3VyY2UvV2Vi Q29yZS9hY2Nlc3NpYmlsaXR5L2d0ay9BY2Nlc3NpYmlsaXR5T2JqZWN0QXRrLmNwcCBiL1NvdXJj ZS9XZWJDb3JlL2FjY2Vzc2liaWxpdHkvZ3RrL0FjY2Vzc2liaWxpdHlPYmplY3RBdGsuY3BwCmlu ZGV4IDRjZjY5NzliYmQwMGYzMWZkYTRjYTIxZGRkZmU1YTRkMjc3NjVmZjguLjQyY2YwMmVkNTMy YmU4ZmQ5YzlkNDNjNzUxM2JlNjE5NjE4YzcwZDkgMTAwNjQ0Ci0tLSBhL1NvdXJjZS9XZWJDb3Jl L2FjY2Vzc2liaWxpdHkvZ3RrL0FjY2Vzc2liaWxpdHlPYmplY3RBdGsuY3BwCisrKyBiL1NvdXJj ZS9XZWJDb3JlL2FjY2Vzc2liaWxpdHkvZ3RrL0FjY2Vzc2liaWxpdHlPYmplY3RBdGsuY3BwCkBA IC04OSw3ICs4OSw3IEBAIEFjY2Vzc2liaWxpdHlPYmplY3RJbmNsdXNpb24gQWNjZXNzaWJpbGl0 eU9iamVjdDo6YWNjZXNzaWJpbGl0eVBsYXRmb3JtSW5jbHVkZXNPCiAgICAgICAgICAgICByZXR1 cm4gRGVmYXVsdEJlaGF2aW9yOwogCiAgICAgICAgIGNoaWxkID0gY2hpbGQtPmZpcnN0Q2hpbGQo KTsKLSAgICAgICAgaWYgKGNoaWxkLT5pc0xpbmsoKSB8fCAhY2hpbGQtPmZpcnN0QW5vbnltb3Vz QmxvY2tDaGlsZCgpKQorICAgICAgICBpZiAoY2hpbGQgJiYgKGNoaWxkLT5pc0xpbmsoKSB8fCAh Y2hpbGQtPmZpcnN0QW5vbnltb3VzQmxvY2tDaGlsZCgpKSkKICAgICAgICAgICAgIHJldHVybiBJ bmNsdWRlT2JqZWN0OwogICAgIH0KIAo=