9833 2006-07-10 07:42:02 -0700 REGRESSION: Reproducible crash: RenderMenuList.cpp:58: failed assertion `!m_first' 2006-07-10 08:48:14 -0700 1 1 1 Unclassified WebKit Forms 420+ Mac OS X 10.4 RESOLVED FIXED Regression P1 Critical --- 1 ddkilzer darin adele darin oldest_to_newest 49098 0 ddkilzer 2006-07-10 07:42:02 -0700 In a debug build of WebKit r15300 (plus Patch v4 from Bug 9179) on Safari 2.0.4 (419.3) on Mac OS X 10.4.7 (8J135/PowerPC), I get a reproducible assertion failure when changing the "Review" popup to "?" on the "Create attachment" web page: /Users/ddkilzer/Projects/Cocoa/WebKit/WebCore/rendering/RenderMenuList.cpp:58: failed assertion `!m_first' Abort trap Steps to reproduce: 1. Start debug build of WebKit+Safari with NativePopUps. 2. Access a "Create attachment" link: http://bugzilla.opendarwin.org/attachment.cgi?bugid=9833&action=enter 3. On the "Flags review" popup, change the value to "?". Expected results: Flags review popup changes to "?". Actual results: Assertion failure an crash (not even a crash log generated). 49099 1 9340 mitz 2006-07-10 07:44:46 -0700 Created attachment 9340 Reduction 49100 2 timothy 2006-07-10 07:45:00 -0700 This does not end up crashing in a release build, so this might not block our submission today. The page works as expected. 49104 3 timothy 2006-07-10 07:49:55 -0700 There is a way to crash this under Release. 0) Release build. 1) Go to the attached reduction. 2) Select "Click Me" 3) Then select the blank item. 4) Close the window and it will crash. Exception: EXC_BAD_ACCESS (0x0001) Codes: KERN_PROTECTION_FAILURE (0x0002) at 0x000000a8 Thread 0 Crashed: 0 com.apple.WebCore 0x01182882 WebCore::RenderContainer::destroyLeftoverChildren() + 22 (RenderContainer.cpp:64) 1 com.apple.WebCore 0x0118926c WebCore::RenderFlow::destroy() + 44 (RenderFlow.cpp:188) 2 com.apple.WebCore 0x01243765 WebCore::Node::detach() + 41 (Node.cpp:721) 3 com.apple.WebCore 0x010f6be1 WebCore::ContainerNode::detach() + 29 (Node.h:92) 4 com.apple.WebCore 0x010f6be1 WebCore::ContainerNode::detach() + 29 (Node.h:92) 5 com.apple.WebCore 0x010f6be1 WebCore::ContainerNode::detach() + 29 (Node.h:92) 6 com.apple.WebCore 0x010ed194 WebCore::Document::detach() + 216 (Document.cpp:987) 7 com.apple.WebCore 0x010d6422 WebCore::FrameMac::setView(WebCore::FrameView*) + 282 (FrameMac.mm:574) 8 com.apple.WebCore 0x010f9b50 -[WebCoreFrameBridge close] + 34 (WebCoreFrameBridge.mm:503) 9 com.apple.WebKit 0x00320eb8 -[WebFrameBridge close] + 49 (WebFrameBridge.m:658) 10 com.apple.WebKit 0x0032e05c -[WebFrame(WebPrivate) _detachFromParent] + 359 (WebFrame.m:580) 11 com.apple.WebKit 0x00357214 -[WebView(WebPrivate) _close] + 135 (WebView.m:603) 49112 4 9345 darin 2006-07-10 08:41:15 -0700 Created attachment 9345 patch, including change log and Mitz's reduction as a manual test 49113 5 9345 andersca 2006-07-10 08:45:33 -0700 Comment on attachment 9345 patch, including change log and Mitz's reduction as a manual test r=me 49114 6 darin 2006-07-10 08:48:14 -0700 Committed revision 15303. 9340 2006-07-10 07:44:46 -0700 2006-07-10 07:44:46 -0700 Reduction 9833 reduction.html text/html 98 mitz U2VsZWN0IHRoZSBzZWNvbmQgaXRlbSBvbiB0aGUgcG9wIHVwLgo8c2VsZWN0PjxvcHRpb24+PC9v cHRpb24+PG9wdGlvbj5QaWNrIG1lITwvb3B0aW9uPjwvc2VsZWN0Pgo= 9345 2006-07-10 08:41:15 -0700 2006-07-10 08:45:33 -0700 patch, including change log and Mitz's reduction as a manual test MenuAssertPatch.txt text/plain 4793 darin SW5kZXg6IFdlYkNvcmUvQ2hhbmdlTG9nCj09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT0KLS0tIFdlYkNvcmUvQ2hhbmdlTG9n CShyZXZpc2lvbiAxNTMwMikKKysrIFdlYkNvcmUvQ2hhbmdlTG9nCSh3b3JraW5nIGNvcHkpCkBA IC0xLDMgKzEsMjAgQEAKKzIwMDYtMDctMTAgIERhcmluIEFkbGVyICA8ZGFyaW5AYXBwbGUuY29t PgorCisgICAgICAgIFJldmlld2VkIGJ5IE5PQk9EWSAoT09QUyEpLgorCisgICAgICAgIC0gZml4 IGh0dHA6Ly9idWd6aWxsYS5vcGVuZGFyd2luLm9yZy9zaG93X2J1Zy5jZ2k/aWQ9OTgzMworICAg ICAgICAgIFJFR1JFU1NJT046IFJlcHJvZHVjaWJsZSBjcmFzaDogUmVuZGVyTWVudUxpc3QuY3Bw OjU4OiBmYWlsZWQgYXNzZXJ0aW9uIGAhbV9maXJzdCcKKworICAgICAgICAqIG1hbnVhbC10ZXN0 cy9lbXB0eS10aXRsZS1wb3B1cC5odG1sOiBBZGRlZC4KKworICAgICAgICAqIHJlbmRlcmluZy9S ZW5kZXJNZW51TGlzdC5oOiBBZGQgY3JlYXRlSW5uZXJCbG9jay4KKyAgICAgICAgKiByZW5kZXJp bmcvUmVuZGVyTWVudUxpc3QuY3BwOgorICAgICAgICAoV2ViQ29yZTo6UmVuZGVyTWVudUxpc3Q6 OmNyZWF0ZUlubmVyQmxvY2spOiBGYWN0b3JlZCBvdXQgb2YgYWRkQ2hpbGQuCisgICAgICAgIChX ZWJDb3JlOjpSZW5kZXJNZW51TGlzdDo6YWRkQ2hpbGQpOiBDYWxsIGNyZWF0ZUlubmVyQmxvY2su CisgICAgICAgIChXZWJDb3JlOjpSZW5kZXJNZW51TGlzdDo6c2V0VGV4dCk6IENoYW5nZWQgcGFy YW1ldGVyIHR5cGUuCisgICAgICAgIChXZWJDb3JlOjpSZW5kZXJNZW51TGlzdDo6c2hvd1BvcHVw KTogQ2FsbCBjcmVhdGVJbm5lckJsb2NrIGJlZm9yZSBjYWxsaW5nCisgICAgICAgIHRoZSBwYXJl bnQgY2xhc3MncyBhZGRDaGlsZC4KKwogMjAwNi0wNy0xMCAgUm9iIEJ1aXMgIDxidWlzQGtkZS5v cmc+CiAKICAgICAgICAgUmV2aWV3ZWQgYnkgTWFjaWVqIHZpYSBJUkMuCkBAIC02LDcgKzIzLDcg QEAKICAgICAgICAgYXMgZGVmaW5lZCBpbiB0aGUgc3BlYy4gIGh0dHA6Ly9wYXN0ZS5saXNwLm9y Zy9kaXNwbGF5LzIyMzQyCiAKICAgICAgICAgKiBrc3ZnMi9zdmcvU1ZHRWxsaXBzZUVsZW1lbnQu Y3BwOgotICAgICAgICAoV2ViQ29yZTo6U1ZHRWxsaXBzZUVsZW1lbnQ6OnJ4KTogIENoYW5nZWQg TE1fSEVJR0hUIHRvIExNX1dJRFRILgorICAgICAgICAoV2ViQ29yZTo6U1ZHRWxsaXBzZUVsZW1l bnQ6OnJ4KTogQ2hhbmdlZCBMTV9IRUlHSFQgdG8gTE1fV0lEVEguCiAgICAgICAgICoga3N2ZzIv c3ZnL1NWR0xpbmVFbGVtZW50LmNwcDoKICAgICAgICAgKFNWR0xpbmVFbGVtZW50Ojp4Mik6IERp dHRvLgogCkluZGV4OiBXZWJDb3JlL21hbnVhbC10ZXN0cy9lbXB0eS10aXRsZS1wb3B1cC5odG1s Cj09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT0KLS0tIFdlYkNvcmUvbWFudWFsLXRlc3RzL2VtcHR5LXRpdGxlLXBvcHVwLmh0 bWwJKHJldmlzaW9uIDApCisrKyBXZWJDb3JlL21hbnVhbC10ZXN0cy9lbXB0eS10aXRsZS1wb3B1 cC5odG1sCShyZXZpc2lvbiAwKQpAQCAtMCwwICsxLDMgQEAKKzxwPlRoaXMgZGVtb25zdHJhdGVz IDxhIGhyZWY9Imh0dHA6Ly9idWd6aWxsYS5vcGVuZGFyd2luLm9yZy9zaG93X2J1Zy5jZ2k/aWQ9 OTgzMyI+YnVnIDk4MzM8L2E+LjwvcD4KKzxwPlNlbGVjdCB0aGUgc2Vjb25kIGl0ZW0gb24gdGhl IHBvcCB1cC4KKzxzZWxlY3Q+PG9wdGlvbj48L29wdGlvbj48b3B0aW9uPlBpY2sgbWUhPC9vcHRp b24+PC9zZWxlY3Q+PC9wPgoKUHJvcGVydHkgY2hhbmdlcyBvbjogV2ViQ29yZS9tYW51YWwtdGVz dHMvZW1wdHktdGl0bGUtcG9wdXAuaHRtbApfX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fCk5hbWU6IHN2bjptaW1lLXR5cGUK ICAgKyB0ZXh0L2h0bWwKTmFtZTogc3ZuOmVvbC1zdHlsZQogICArIG5hdGl2ZQoKSW5kZXg6IFdl YkNvcmUvcmVuZGVyaW5nL1JlbmRlck1lbnVMaXN0LmNwcAo9PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09Ci0tLSBXZWJDb3Jl L3JlbmRlcmluZy9SZW5kZXJNZW51TGlzdC5jcHAJKHJldmlzaW9uIDE1MzAyKQorKysgV2ViQ29y ZS9yZW5kZXJpbmcvUmVuZGVyTWVudUxpc3QuY3BwCSh3b3JraW5nIGNvcHkpCkBAIC0zMywxMCAr MzMsMTEgQEAKICNpbmNsdWRlICJSZW5kZXJUaGVtZS5oIgogI2luY2x1ZGUgPG1hdGguaD4KIAor dXNpbmcgbmFtZXNwYWNlIHN0ZDsKKwogbmFtZXNwYWNlIFdlYkNvcmUgewogCiB1c2luZyBuYW1l c3BhY2UgSFRNTE5hbWVzOwotdXNpbmcgbmFtZXNwYWNlIHN0ZDsKIAogUmVuZGVyTWVudUxpc3Q6 OlJlbmRlck1lbnVMaXN0KEhUTUxTZWxlY3RFbGVtZW50KiBlbGVtZW50KQogICAgIDogUmVuZGVy RmxleGlibGVCb3goZWxlbWVudCkKQEAgLTUxLDE1ICs1MiwyNCBAQCBSZW5kZXJNZW51TGlzdDo6 UmVuZGVyTWVudUxpc3QoSFRNTFNlbGVjCiB7CiB9CiAKLXZvaWQgUmVuZGVyTWVudUxpc3Q6OmFk ZENoaWxkKFJlbmRlck9iamVjdCogbmV3Q2hpbGQsIFJlbmRlck9iamVjdCogYmVmb3JlQ2hpbGQp Cit2b2lkIFJlbmRlck1lbnVMaXN0OjpjcmVhdGVJbm5lckJsb2NrKCkKIHsKLSAgICBpZiAoIW1f aW5uZXIpIHsKLSAgICAgICAgLy8gQ3JlYXRlIGFuIGFub255bW91cyBibG9jay4KLSAgICAgICAg YXNzZXJ0KCFtX2ZpcnN0KTsKLSAgICAgICAgbV9pbm5lciA9IGNyZWF0ZUFub255bW91c0Jsb2Nr KCk7Ci0gICAgICAgIG1faW5uZXItPnN0eWxlKCktPnNldEJveEZsZXgoMS4wZik7Ci0gICAgICAg IFJlbmRlckZsZXhpYmxlQm94OjphZGRDaGlsZChtX2lubmVyKTsKKyAgICBpZiAobV9pbm5lcikg eworICAgICAgICBBU1NFUlQoZmlyc3RDaGlsZCgpID09IG1faW5uZXIpOworICAgICAgICBBU1NF UlQoIW1faW5uZXItPm5leHRTaWJsaW5nKCkpOworICAgICAgICByZXR1cm47CiAgICAgfQorCisg ICAgLy8gQ3JlYXRlIGFuIGFub255bW91cyBibG9jay4KKyAgICBBU1NFUlQoIWZpcnN0Q2hpbGQo KSk7CisgICAgbV9pbm5lciA9IGNyZWF0ZUFub255bW91c0Jsb2NrKCk7CisgICAgbV9pbm5lci0+ c3R5bGUoKS0+c2V0Qm94RmxleCgxLjBmKTsKKyAgICBSZW5kZXJGbGV4aWJsZUJveDo6YWRkQ2hp bGQobV9pbm5lcik7Cit9CisKK3ZvaWQgUmVuZGVyTWVudUxpc3Q6OmFkZENoaWxkKFJlbmRlck9i amVjdCogbmV3Q2hpbGQsIFJlbmRlck9iamVjdCogYmVmb3JlQ2hpbGQpCit7CisgICAgY3JlYXRl SW5uZXJCbG9jaygpOwogICAgIG1faW5uZXItPmFkZENoaWxkKG5ld0NoaWxkLCBiZWZvcmVDaGls ZCk7CiB9CiAKQEAgLTEyMCw3ICsxMzAsNyBAQCB2b2lkIFJlbmRlck1lbnVMaXN0Ojp1cGRhdGVG cm9tRWxlbWVudCgpCiAgICAgfQogfQogCi12b2lkIFJlbmRlck1lbnVMaXN0OjpzZXRUZXh0KFN0 cmluZyBzKQordm9pZCBSZW5kZXJNZW51TGlzdDo6c2V0VGV4dChjb25zdCBTdHJpbmcmIHMpCiB7 CiAgICAgaWYgKHMuaXNFbXB0eSgpKSB7CiAgICAgICAgIGlmIChtX2J1dHRvblRleHQpIHsKQEAg LTE5NCw3ICsyMDQsOCBAQCB2b2lkIFJlbmRlck1lbnVMaXN0OjpjYWxjTWluTWF4V2lkdGgoKQog dm9pZCBSZW5kZXJNZW51TGlzdDo6c2hvd1BvcHVwKCkKIHsKICAgICBpZiAoIW1fcG9wdXBNZW51 KSB7Ci0gICAgICAgIFJlbmRlclN0eWxlICpuZXdTdHlsZSA9IG5ldyAocmVuZGVyQXJlbmEoKSkg UmVuZGVyU3R5bGUoKTsKKyAgICAgICAgY3JlYXRlSW5uZXJCbG9jaygpOworICAgICAgICBSZW5k ZXJTdHlsZSogbmV3U3R5bGUgPSBuZXcgKHJlbmRlckFyZW5hKCkpIFJlbmRlclN0eWxlKCk7CiAg ICAgICAgIG5ld1N0eWxlLT5pbmhlcml0RnJvbShzdHlsZSgpKTsKICAgICAgICAgbV9wb3B1cE1l bnUgPSB0aGVtZSgpLT5jcmVhdGVQb3B1cE1lbnUocmVuZGVyQXJlbmEoKSwgZG9jdW1lbnQoKSk7 CiAgICAgICAgIG1fcG9wdXBNZW51LT5zZXRTdHlsZShuZXdTdHlsZSk7CkBAIC0yMTAsMTAgKzIy MSw4IEBAIHZvaWQgUmVuZGVyTWVudUxpc3Q6OmxheW91dCgpCiAgICAgUmVuZGVyRmxleGlibGVC b3g6OmxheW91dCgpOwogfQogCi0KIHZvaWQgUmVuZGVyTWVudUxpc3Q6OnVwZGF0ZVNlbGVjdGlv bigpCiB7Ci0KIH0KIAogdm9pZCBSZW5kZXJNZW51TGlzdDo6dmFsdWVDaGFuZ2VkKHVuc2lnbmVk IGluZGV4KQpJbmRleDogV2ViQ29yZS9yZW5kZXJpbmcvUmVuZGVyTWVudUxpc3QuaAo9PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09Ci0tLSBXZWJDb3JlL3JlbmRlcmluZy9SZW5kZXJNZW51TGlzdC5oCShyZXZpc2lvbiAxNTMw MikKKysrIFdlYkNvcmUvcmVuZGVyaW5nL1JlbmRlck1lbnVMaXN0LmgJKHdvcmtpbmcgY29weSkK QEAgLTYyLDggKzYyLDkgQEAgcHVibGljOgogICAgIHZvaWQgdmFsdWVDaGFuZ2VkKHVuc2lnbmVk IGluZGV4KTsKICAgICBib29sIGhhc1BvcHVwTWVudSgpIHsgcmV0dXJuIG1fcG9wdXBNZW51OyB9 CiAKLXByb3RlY3RlZDoKLSAgICB2b2lkIHNldFRleHQoU3RyaW5nKTsKK3ByaXZhdGU6CisgICAg dm9pZCBjcmVhdGVJbm5lckJsb2NrKCk7CisgICAgdm9pZCBzZXRUZXh0KGNvbnN0IFN0cmluZyYp OwogCiAgICAgUmVuZGVyVGV4dCogbV9idXR0b25UZXh0OwogICAgIFJlbmRlckJsb2NrKiBtX2lu bmVyOwo=