9806 2006-07-09 06:34:46 -0700 REGRESSION: Large rowspan causes WebKit to call abort() 2006-07-12 09:04:48 -0700 1 1 1 Unclassified WebKit Tables 420+ Mac OS X 10.4 RESOLVED FIXED HasReduction, InRadar, Regression P1 Normal --- 1 jonathanjohnsson darin ap oldest_to_newest 48907 0 jonathanjohnsson 2006-07-09 06:34:46 -0700 A table with a large rowspan crashes WebKit. The test case is simply <TABLE><TD ROWSPAN=674227123>. This bug was found using the cgi-script at http://lcamtuf.coredump.cx/mangleme/mangle.cgi , found in the sidebar at http://browserfun.blogspot.com/ . Looking through the nightlies, this crash doesn't occur before and including revision 14807. 48908 1 9295 jonathanjohnsson 2006-07-09 06:36:03 -0700 Created attachment 9295 Test case (will crash!) 48909 2 jonathanjohnsson 2006-07-09 06:38:13 -0700 I forgot to say that the crash reporter isn't invoked, so there is no crash log to attach. WebKit simply quits. 48934 3 ap 2006-07-09 11:36:43 -0700 Stack trace (from gdb): #1 0x9012dfb4 in abort () #2 0x01cdbb7c in WTF::VectorBuffer<WebCore::RenderTableSection::RowStruct, 0ul>::allocateBuffer (this=0x18a31c50, newCapacity=674227123) at /Users/ap/WebKit/WebKitBuild/Debug/JavaScriptCore.framework/PrivateHeaders/Vector.h:251 #3 0x01cdbd20 in WTF::Vector<WebCore::RenderTableSection::RowStruct, 0ul>::reserveCapacity (this=0x18a31c4c, newCapacity=674227123) at /Users/ap/WebKit/WebKitBuild/Debug/JavaScriptCore.framework/PrivateHeaders/Vector.h:536 #4 0x01cdbde8 in WTF::Vector<WebCore::RenderTableSection::RowStruct, 0ul>::expandCapacity (this=0x18a31c4c, newMinCapacity=674227123) at /Users/ap/WebKit/WebKitBuild/Debug/JavaScriptCore.framework/PrivateHeaders/Vector.h:493 #5 0x01cdbe90 in WTF::Vector<WebCore::RenderTableSection::RowStruct, 0ul>::resize (this=0x18a31c4c, size=674227123) at /Users/ap/WebKit/WebKitBuild/Debug/JavaScriptCore.framework/PrivateHeaders/Vector.h:522 #6 0x01a07788 in WebCore::RenderTableSection::ensureRows (this=0x18a31bec, numRows=674227123) at /Users/ap/WebKit/WebCore/rendering/RenderTableSection.cpp:150 BTW, we have mangleme and iExploder tests in WebKitTools/Scripts: run-mangleme-tests and run-iexploder-tests, 49147 4 darin 2006-07-10 20:08:39 -0700 I'm sure mangleme can find another problem with rowspans, since all this does is prevent the abort that checks for numeric overflow. 49148 5 9350 darin 2006-07-10 20:09:04 -0700 Created attachment 9350 patch, including change log and a layout test 49249 6 alice.barraclough 2006-07-11 09:39:18 -0700 <rdar://problem/4622622> 49421 7 9350 mjs 2006-07-12 05:11:27 -0700 Comment on attachment 9350 patch, including change log and a layout test r=me 49434 8 darin 2006-07-12 08:25:14 -0700 Committed revision 15390. 49442 9 ddkilzer 2006-07-12 09:04:48 -0700 Also committed revision 15392 to fix LayoutTest files with property information in them.  (See Bug 9875.) 9295 2006-07-09 06:36:03 -0700 2006-07-09 06:36:03 -0700 Test case (will crash!) testcase_bug_9806.html text/html 29 jonathanjohnsson PFRBQkxFPjxURCBST1dTUEFOPTY3NDIyNzEyMz4= 9350 2006-07-10 20:09:04 -0700 2006-07-12 05:11:27 -0700 patch, including change log and a layout test RowSpanPatch.txt text/plain 3243 darin SW5kZXg6IExheW91dFRlc3RzL0NoYW5nZUxvZwo9PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09Ci0tLSBMYXlvdXRUZXN0cy9D aGFuZ2VMb2cJKHJldmlzaW9uIDE1MzIwKQorKysgTGF5b3V0VGVzdHMvQ2hhbmdlTG9nCSh3b3Jr aW5nIGNvcHkpCkBAIC0xLDMgKzEsMTIgQEAKKzIwMDYtMDctMTAgIERhcmluIEFkbGVyICA8ZGFy aW5AYXBwbGUuY29tPgorCisgICAgICAgIFJldmlld2VkIGJ5IE5PQk9EWSAoT09QUyEpLgorCisg ICAgICAgIC0gYW5vdGhlciBsYXJnZSByb3dzcGFuIHRlc3QgY2FzZQorCisgICAgICAgICogZmFz dC90YWJsZS9sYXJnZS1yb3dzcGFuLWNyYXNoLWV4cGVjdGVkLnR4dDogQWRkZWQuCisgICAgICAg ICogZmFzdC90YWJsZS9sYXJnZS1yb3dzcGFuLWNyYXNoLmh0bWw6IEFkZGVkLgorCiAyMDA2LTA3 LTEwICBBZGVsZSBQZXRlcnNvbiAgPGFkZWxlQGFwcGxlLmNvbT4KIAogICAgICAgICBSZXZpZXdl ZCBieSBCZXRoLgpJbmRleDogTGF5b3V0VGVzdHMvZmFzdC90YWJsZS9sYXJnZS1yb3dzcGFuLWNy YXNoLWV4cGVjdGVkLnR4dAo9PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09Ci0tLSBMYXlvdXRUZXN0cy9mYXN0L3RhYmxlL2xh cmdlLXJvd3NwYW4tY3Jhc2gtZXhwZWN0ZWQudHh0CShyZXZpc2lvbiAwKQorKysgTGF5b3V0VGVz dHMvZmFzdC90YWJsZS9sYXJnZS1yb3dzcGFuLWNyYXNoLWV4cGVjdGVkLnR4dAkocmV2aXNpb24g MCkKQEAgLTAsMCArMSwzIEBACitJZiB0aGUgYnJvd3NlciBkaWRuJ3QgY3Jhc2gsIHRoZSB0ZXN0 IHBhc3NlZC4KKworCgpQcm9wZXJ0eSBjaGFuZ2VzIG9uOiBMYXlvdXRUZXN0cy9mYXN0L3RhYmxl L2xhcmdlLXJvd3NwYW4tY3Jhc2gtZXhwZWN0ZWQudHh0Cl9fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX18KTmFtZTogc3ZuOmVv bC1zdHlsZQogICArIG5hdGl2ZQoKSW5kZXg6IExheW91dFRlc3RzL2Zhc3QvdGFibGUvbGFyZ2Ut cm93c3Bhbi1jcmFzaC5odG1sCj09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT0KLS0tIExheW91dFRlc3RzL2Zhc3QvdGFibGUv bGFyZ2Utcm93c3Bhbi1jcmFzaC5odG1sCShyZXZpc2lvbiAwKQorKysgTGF5b3V0VGVzdHMvZmFz dC90YWJsZS9sYXJnZS1yb3dzcGFuLWNyYXNoLmh0bWwJKHJldmlzaW9uIDApCkBAIC0wLDAgKzEs NiBAQAorPHNjcmlwdD4KK2lmICh3aW5kb3cubGF5b3V0VGVzdENvbnRyb2xsZXIpCisgICAgbGF5 b3V0VGVzdENvbnRyb2xsZXIuZHVtcEFzVGV4dCgpOworPC9zY3JpcHQ+Cis8dGFibGU+PHRkIHJv d3NwYW49Njc0MjI3MTIzPjwvdGQ+PC90YWJsZT4KKzxwPklmIHRoZSBicm93c2VyIGRpZG4ndCBj cmFzaCwgdGhlIHRlc3QgcGFzc2VkLjwvcD4KClByb3BlcnR5IGNoYW5nZXMgb246IExheW91dFRl c3RzL2Zhc3QvdGFibGUvbGFyZ2Utcm93c3Bhbi1jcmFzaC5odG1sCl9fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX18KTmFtZTog c3ZuOm1pbWUtdHlwZQogICArIHRleHQvaHRtbApOYW1lOiBzdm46ZW9sLXN0eWxlCiAgICsgbmF0 aXZlCgpJbmRleDogV2ViQ29yZS9DaGFuZ2VMb2cKPT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PQotLS0gV2ViQ29yZS9DaGFu Z2VMb2cJKHJldmlzaW9uIDE1MzIwKQorKysgV2ViQ29yZS9DaGFuZ2VMb2cJKHdvcmtpbmcgY29w eSkKQEAgLTEsMyArMSwxOCBAQAorMjAwNi0wNy0xMCAgRGFyaW4gQWRsZXIgIDxkYXJpbkBhcHBs ZS5jb20+CisKKyAgICAgICAgUmV2aWV3ZWQgYnkgTk9CT0RZIChPT1BTISkuCisKKyAgICAgICAg LSBmaXggaHR0cDovL2J1Z3ppbGxhLm9wZW5kYXJ3aW4ub3JnL3Nob3dfYnVnLmNnaT9pZD05ODA2 CisgICAgICAgICAgUkVHUkVTU0lPTjogTGFyZ2Ugcm93c3BhbiBjYXVzZXMgV2ViS2l0IHRvIGNh bGwgYWJvcnQoKQorCisgICAgICAgIFRlc3Q6IGZhc3QvdGFibGUvbGFyZ2Utcm93c3Bhbi1jcmFz aC5odG1sCisKKyAgICAgICAgKiByZW5kZXJpbmcvUmVuZGVyVGFibGVTZWN0aW9uLmNwcDoKKyAg ICAgICAgKFdlYkNvcmU6OlJlbmRlclRhYmxlU2VjdGlvbjo6ZW5zdXJlUm93cyk6CisgICAgICAg IFVzZSBzaXplb2YoUm93U3RydWN0KSBpbnN0ZWFkIG9mIHNpemVvZihpbnQpLgorICAgICAgICBD bGVhcmx5IHdlJ2xsIG5lZWQgc29tZXRoaW5nIGJldHRlciB0byBzb2x2ZSB0aGlzIGNvbXBsZXRl bHkuCisgICAgICAgIEkgZXhwZWN0IGFub3RoZXIgc21hbGxlciwgYnV0IHN0aWxsIGh1Z2UsIHZh bHVlIHdpbGwgc3RpbGwgY2F1c2UgYSBwcm9ibGVtLgorCiAyMDA2LTA3LTEwICBEYXZpZCBIYXJy aXNvbiAgPGhhcnJpc29uQGFwcGxlLmNvbT4KIAogICAgICAgICBSZXZpZXdlZCBieSBEYXZlIEh5 YXR0LgpJbmRleDogV2ViQ29yZS9yZW5kZXJpbmcvUmVuZGVyVGFibGVTZWN0aW9uLmNwcAo9PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09Ci0tLSBXZWJDb3JlL3JlbmRlcmluZy9SZW5kZXJUYWJsZVNlY3Rpb24uY3BwCShyZXZp c2lvbiAxNTMwMikKKysrIFdlYkNvcmUvcmVuZGVyaW5nL1JlbmRlclRhYmxlU2VjdGlvbi5jcHAJ KHdvcmtpbmcgY29weSkKQEAgLTE0NSw3ICsxNDUsNyBAQCBib29sIFJlbmRlclRhYmxlU2VjdGlv bjo6ZW5zdXJlUm93cyhpbnQgCiAgICAgaW50IG5Sb3dzID0gZ3JpZFJvd3M7CiAgICAgaWYgKG51 bVJvd3MgPiBuUm93cykgewogICAgICAgICBpZiAobnVtUm93cyA+IHN0YXRpY19jYXN0PGludD4o Z3JpZC5zaXplKCkpKSB7Ci0gICAgICAgICAgICBpZiAobnVtUm93cyA+IHN0YXRpY19jYXN0PGlu dD4obnVtZXJpY19saW1pdHM8c2l6ZV90Pjo6bWF4KCkgLyBzaXplb2YoaW50KSkpCisgICAgICAg ICAgICBpZiAobnVtUm93cyA+IHN0YXRpY19jYXN0PGludD4obnVtZXJpY19saW1pdHM8c2l6ZV90 Pjo6bWF4KCkgLyBzaXplb2YoUm93U3RydWN0KSkpCiAgICAgICAgICAgICAgICAgcmV0dXJuIGZh bHNlOwogICAgICAgICAgICAgZ3JpZC5yZXNpemUobnVtUm93cyk7CiAgICAgICAgIH0K