Bug 100688

Summary:

REGRESSION (r132699): Crashes in WebCore::TextIterator::handleTextNodeFirstLetter

Product:

WebKit

Reporter:

Zan Dobersek <zan>

Component:

WebKitGTK

Assignee:

Dominic Mazzoni <dmazzoni>

Status:

RESOLVED FIXED

Severity:

Normal

CC:

aboxhall, apinheiro, cfleizach, dmazzoni, jdiggs, jussi.kukkonen, mario, mrobinson, rniwa, spena, webkit.review.bot

Priority:

Keywords:

Gtk, LayoutTestFailure

Version:

528+ (Nightly build)

Hardware:

Unspecified

OS:

Unspecified

Attachments:

Description	Flags
Patch	none
Patch	none

Zan Dobersek

Reported 2012-10-29 10:28:18 PDT

The following tests started (occasionally) crashing on the GTK builders after r132699: fast/css-generated-content/first-letter-table-cell-format-block-crash.html fast/text/text-fragment-first-letter-update-crash.html fast/text/custom-font-data-crash2.html fast/css/first-letter-text-fragment-crash.html editing/selection/first-letter-selection-crash.html editing/text-iterator/backward-textiterator-first-letter-crash.html http://trac.webkit.org/changeset/132699 http://test-results.appspot.com/dashboards/flakiness_dashboard.html#group=%40ToT%20-%20webkit.org&tests=fast%2Fcss-generated-content%2Ffirst-letter-table-cell-format-block-crash.html%20fast%2Ftext%2Ftext-fragment-first-letter-update-crash.html%20fast%2Ftext%2Fcustom-font-data-crash2.html%20fast%2Fcss%2Ffirst-letter-text-fragment-crash.html%20editing%2Fselection%2Ffirst-letter-selection-crash.html%20editing%2Ftext-iterator%2Fbackward-textiterator-first-letter-crash.html The tests only crash if the accessibility tests are run before them, probably because of the accessibility object cache being populated. Here's the crash log for fast/text/custom-font-data-crash2.html crash that occurred on the 64-bit Release builder: Crash log for DumpRenderTree (pid 5474): ... [New LWP 6022] [Thread debugging using libthread_db enabled] Core was generated by `/home/slave/webkitgtk/gtk-linux-64-release/build/WebKitBuild/Release/Programs/D'. Program terminated with signal 11, Segmentation fault. #0 0x00007fb3bf1f57a3 in WebCore::TextIterator::handleTextNodeFirstLetter(WebCore::RenderTextFragment*) () from /home/slave/webkitgtk/gtk-linux-64-release/build/WebKitBuild/Release/.libs/libwebkitgtk-3.0.so.0 ... Thread 1 (Thread 0x7fb3c0a03900 (LWP 5474)): #0 0x00007fb3bf1f57a3 in WebCore::TextIterator::handleTextNodeFirstLetter(WebCore::RenderTextFragment*) () from /home/slave/webkitgtk/gtk-linux-64-release/build/WebKitBuild/Release/.libs/libwebkitgtk-3.0.so.0 #1 0x00007fb3bf1f842f in WebCore::TextIterator::handleTextNode() () from /home/slave/webkitgtk/gtk-linux-64-release/build/WebKitBuild/Release/.libs/libwebkitgtk-3.0.so.0 #2 0x00007fb3bf1f8aea in WebCore::TextIterator::advance() () from /home/slave/webkitgtk/gtk-linux-64-release/build/WebKitBuild/Release/.libs/libwebkitgtk-3.0.so.0 #3 0x00007fb3bf1f991d in WebCore::plainTextToMallocAllocatedBuffer(WebCore::Range const*, unsigned int&, bool, WebCore::TextIteratorBehavior) () from /home/slave/webkitgtk/gtk-linux-64-release/build/WebKitBuild/Release/.libs/libwebkitgtk-3.0.so.0 #4 0x00007fb3bf1f9cca in WebCore::plainText(WebCore::Range const*, WebCore::TextIteratorBehavior) () from /home/slave/webkitgtk/gtk-linux-64-release/build/WebKitBuild/Release/.libs/libwebkitgtk-3.0.so.0 #5 0x00007fb3beeefca3 in WebCore::AccessibilityRenderObject::textUnderElement() const () from /home/slave/webkitgtk/gtk-linux-64-release/build/WebKitBuild/Release/.libs/libwebkitgtk-3.0.so.0 #6 0x00007fb3bff0f659 in WebCore::AccessibilityObject::accessibilityPlatformIncludesObject() const () from /home/slave/webkitgtk/gtk-linux-64-release/build/WebKitBuild/Release/.libs/libwebkitgtk-3.0.so.0 #7 0x00007fb3beef3f70 in WebCore::AccessibilityRenderObject::accessibilityIsIgnoredBase() const () from /home/slave/webkitgtk/gtk-linux-64-release/build/WebKitBuild/Release/.libs/libwebkitgtk-3.0.so.0 #8 0x00007fb3beef8c96 in WebCore::AccessibilityRenderObject::accessibilityIsIgnored() const () from /home/slave/webkitgtk/gtk-linux-64-release/build/WebKitBuild/Release/.libs/libwebkitgtk-3.0.so.0 #9 0x00007fb3beefe2c3 in WebCore::AXObjectCache::childrenChanged(WebCore::AccessibilityObject*) () from /home/slave/webkitgtk/gtk-linux-64-release/build/WebKitBuild/Release/.libs/libwebkitgtk-3.0.so.0 #10 0x00007fb3bf743c64 in WebCore::RenderObject::willBeDestroyed() () from /home/slave/webkitgtk/gtk-linux-64-release/build/WebKitBuild/Release/.libs/libwebkitgtk-3.0.so.0 #11 0x00007fb3bf78c2a1 in WebCore::RenderText::willBeDestroyed() () from /home/slave/webkitgtk/gtk-linux-64-release/build/WebKitBuild/Release/.libs/libwebkitgtk-3.0.so.0 #12 0x00007fb3bf74278d in WebCore::RenderObject::destroy() () from /home/slave/webkitgtk/gtk-linux-64-release/build/WebKitBuild/Release/.libs/libwebkitgtk-3.0.so.0 #13 0x00007fb3bf7380d4 in WebCore::RenderObjectChildList::destroyLeftoverChildren() () from /home/slave/webkitgtk/gtk-linux-64-release/build/WebKitBuild/Release/.libs/libwebkitgtk-3.0.so.0 #14 0x00007fb3bf670cec in WebCore::RenderBlock::willBeDestroyed() () from /home/slave/webkitgtk/gtk-linux-64-release/build/WebKitBuild/Release/.libs/libwebkitgtk-3.0.so.0 #15 0x00007fb3bf74278d in WebCore::RenderObject::destroy() () from /home/slave/webkitgtk/gtk-linux-64-release/build/WebKitBuild/Release/.libs/libwebkitgtk-3.0.so.0 #16 0x00007fb3bf12eacf in WebCore::Node::detach() () from /home/slave/webkitgtk/gtk-linux-64-release/build/WebKitBuild/Release/.libs/libwebkitgtk-3.0.so.0 #17 0x00007fb3bf0c767e in WebCore::ContainerNode::detach() () from /home/slave/webkitgtk/gtk-linux-64-release/build/WebKitBuild/Release/.libs/libwebkitgtk-3.0.so.0 #18 0x00007fb3bf10fda4 in WebCore::Element::detach() () from /home/slave/webkitgtk/gtk-linux-64-release/build/WebKitBuild/Release/.libs/libwebkitgtk-3.0.so.0 #19 0x00007fb3bf0cb800 in WebCore::ContainerNode::removeChildren() () from /home/slave/webkitgtk/gtk-linux-64-release/build/WebKitBuild/Release/.libs/libwebkitgtk-3.0.so.0 #20 0x00007fb3bf1d34dc in WebCore::replaceChildrenWithFragment(WebCore::ContainerNode*, WTF::PassRefPtr<WebCore::DocumentFragment>, int&) () from /home/slave/webkitgtk/gtk-linux-64-release/build/WebKitBuild/Release/.libs/libwebkitgtk-3.0.so.0 #21 0x00007fb3bf27564a in WebCore::HTMLElement::setInnerHTML(WTF::String const&, int&) () from /home/slave/webkitgtk/gtk-linux-64-release/build/WebKitBuild/Release/.libs/libwebkitgtk-3.0.so.0 #22 0x00007fb3bfb43794 in WebCore::setJSHTMLElementInnerHTML(JSC::ExecState*, JSC::JSObject*, JSC::JSValue) () from /home/slave/webkitgtk/gtk-linux-64-release/build/WebKitBuild/Release/.libs/libwebkitgtk-3.0.so.0 #23 0x00007fb3bfb42f0c in WebCore::JSHTMLElement::put(JSC::JSCell*, JSC::ExecState*, JSC::PropertyName, JSC::JSValue, JSC::PutPropertySlot&) () from /home/slave/webkitgtk/gtk-linux-64-release/build/WebKitBuild/Release/.libs/libwebkitgtk-3.0.so.0 #24 0x00007fb3bfb2a381 in WebCore::JSHTMLBodyElement::put(JSC::JSCell*, JSC::ExecState*, JSC::PropertyName, JSC::JSValue, JSC::PutPropertySlot&) () from /home/slave/webkitgtk/gtk-linux-64-release/build/WebKitBuild/Release/.libs/libwebkitgtk-3.0.so.0 #25 0x00007fb3c079e413 in llint_slow_path_put_by_id () from /home/slave/webkitgtk/gtk-linux-64-release/build/WebKitBuild/Release/.libs/libjavascriptcoregtk-3.0.so.0 #26 0x00007fb3c07a946a in llint_op_put_by_id () from /home/slave/webkitgtk/gtk-linux-64-release/build/WebKitBuild/Release/.libs/libjavascriptcoregtk-3.0.so.0 #27 0x00007fb300000000 in ?? () #28 0x0000000000000000 in ?? ()

Attachments
Patch (1.75 KB, patch) 2013-01-17 15:54 PST, Dominic Mazzoni	no flags	Details Formatted Diff Diff
Patch (1.91 KB, patch) 2013-01-17 16:10 PST, Dominic Mazzoni	no flags	Details Formatted Diff Diff
Show Obsolete (1) View All Add attachment proposed patch, testcase, etc.

Dominic Mazzoni

Comment 1 2012-10-29 14:51:05 PDT

Thanks. I will look at this. FYI, it's quite likely that r132699 didn't cause these crashes, it exposed them. In particular, r132699 causes AccessibilityObjects to be created a little bit more often than before - and that is resulting in us testing codepaths that weren't well-tested before. It's worth fixing these bugs directly, rather than trying to revert r132699 or find a way to modify it to not trigger these crashes.

Jussi Kukkonen (jku)

Comment 2 2012-12-03 09:01:50 PST

These aren't as flaky on EFL, but I just saw the same backtrace for editing/selection/first-letter-selection-crash.html on EFL WK2 Debug bot.

Zan Dobersek

Comment 3 2013-01-17 03:52:07 PST

Here's the crash log for these crashes, scraped from the debug builder: Crash log for DumpRenderTree (pid 28412): ... [Thread debugging using libthread_db enabled] Using host libthread_db library "/lib/x86_64-linux-gnu/libthread_db.so.1". Core was generated by `/home/slave/webkitgtk/gtk-linux-64-debug/build/WebKitBuild/Debug/Programs/DumpR'. Program terminated with signal 11, Segmentation fault. #0 0x00007fcd5068a0b5 in WebCore::RenderObject::firstChild (this=0xf7db428) at ../../Source/WebCore/rendering/RenderObject.h:178 178 if (const RenderObjectChildList* children = virtualChildren()) ... Thread 1 (Thread 0x7fcd45bfe900 (LWP 28412)): #0 0x00007fcd5068a0b5 in WebCore::RenderObject::firstChild (this=0xf7db428) at ../../Source/WebCore/rendering/RenderObject.h:178 #1 0x00007fcd50b4f061 in WebCore::firstRenderTextInFirstLetter (firstLetter=0xf7db428) at ../../Source/WebCore/editing/TextIterator.cpp:648 #2 0x00007fcd50b4f128 in WebCore::TextIterator::handleTextNodeFirstLetter (this=0x7fffef44c840, renderer=0xf7db4b8) at ../../Source/WebCore/editing/TextIterator.cpp:661 #3 0x00007fcd50b4e85b in WebCore::TextIterator::handleTextNode (this=0x7fffef44c840) at ../../Source/WebCore/editing/TextIterator.cpp:531 #4 0x00007fcd50b4dfd0 in WebCore::TextIterator::advance (this=0x7fffef44c840) at ../../Source/WebCore/editing/TextIterator.cpp:407 #5 0x00007fcd50b4dd19 in WebCore::TextIterator::TextIterator (this=0x7fffef44c840, r=0xf78c880, behavior=28) at ../../Source/WebCore/editing/TextIterator.cpp:342 #6 0x00007fcd50b54843 in WebCore::plainText (r=0xf78c880, defaultBehavior=24, isDisplayString=false) at ../../Source/WebCore/editing/TextIterator.cpp:2569 #7 0x00007fcd5068faa1 in WebCore::AccessibilityRenderObject::textUnderElement (this=0xe43c080) at ../../Source/WebCore/accessibility/AccessibilityRenderObject.cpp:653 #8 0x00007fcd519a1486 in WebCore::AccessibilityObject::accessibilityPlatformIncludesObject (this=0xe43c080) at ../../Source/WebCore/accessibility/atk/AccessibilityObjectAtk.cpp:87 #9 0x00007fcd506915d0 in WebCore::AccessibilityRenderObject::accessibilityIsIgnoredBase (this=0xe43c080) at ../../Source/WebCore/accessibility/AccessibilityRenderObject.cpp:1118 #10 0x00007fcd50691618 in WebCore::AccessibilityRenderObject::accessibilityIsIgnored (this=0xe43c080) at ../../Source/WebCore/accessibility/AccessibilityRenderObject.cpp:1132 #11 0x00007fcd506a921a in WebCore::AXObjectCache::childrenChanged (this=0x9e7bd70, obj=0xe43c080) at ../../Source/WebCore/accessibility/AXObjectCache.cpp:591 #12 0x00007fcd506a919d in WebCore::AXObjectCache::childrenChanged (this=0x9e7bd70, renderer=0xf779b48) at ../../Source/WebCore/accessibility/AXObjectCache.cpp:581 #13 0x00007fcd511d0d9c in WebCore::RenderObject::willBeDestroyed (this=0xf7db4b8) at ../../Source/WebCore/rendering/RenderObject.cpp:2374 #14 0x00007fcd51228b7b in WebCore::RenderText::willBeDestroyed (this=0xf7db4b8) at ../../Source/WebCore/rendering/RenderText.cpp:248 #15 0x00007fcd51233d2f in WebCore::RenderTextFragment::willBeDestroyed (this=0xf7db4b8) at ../../Source/WebCore/rendering/RenderTextFragment.cpp:75 #16 0x00007fcd511d1641 in WebCore::RenderObject::destroy (this=0xf7db4b8) at ../../Source/WebCore/rendering/RenderObject.cpp:2536 #17 0x00007fcd511d161a in WebCore::RenderObject::destroyAndCleanupAnonymousWrappers (this=0xf7db4b8) at ../../Source/WebCore/rendering/RenderObject.cpp:2529 #18 0x00007fcd50a5124e in WebCore::Node::detach (this=0xf807920) at ../../Source/WebCore/dom/Node.cpp:1108 #19 0x00007fcd5097de3a in WebCore::ContainerNode::removeBetween (this=0xa2f5970, previousChild=0xe34f550, nextChild=0x0, oldChild=0xf807920) at ../../Source/WebCore/dom/ContainerNode.cpp:528 #20 0x00007fcd5097dcb7 in WebCore::ContainerNode::removeChild (this=0xa2f5970, oldChild=0xf807920, ec=@0x7fffef44ce44: 0) at ../../Source/WebCore/dom/ContainerNode.cpp:510 #21 0x00007fcd50a4f856 in WebCore::Node::remove (this=0xf807920, ec=@0x7fffef44ce44: 0) at ../../Source/WebCore/dom/Node.cpp:583 #22 0x00007fcd50b382ee in WebCore::RemoveNodeCommand::doApply (this=0xe440430) at ../../Source/WebCore/editing/RemoveNodeCommand.cpp:55 #23 0x00007fcd50acecc2 in WebCore::CompositeEditCommand::applyCommandToComposite (this=0xe3f5340, prpCommand=...) at ../../Source/WebCore/editing/CompositeEditCommand.cpp:257 #24 0x00007fcd50acfcb9 in WebCore::CompositeEditCommand::removeNode (this=0xe3f5340, node=..., shouldAssumeContentIsAlwaysEditable=WebCore::DoNotAssumeContentIsAlwaysEditable) at ../../Source/WebCore/editing/CompositeEditCommand.cpp:395 #25 0x00007fcd50ac65eb in WebCore::ApplyStyleCommand::surroundNodeRangeWithElement (this=0xe3f5340, passedStartNode=..., endNode=..., elementToInsert=...) at ../../Source/WebCore/editing/ApplyStyleCommand.cpp:1337 #26 0x00007fcd50ac7622 in WebCore::ApplyStyleCommand::applyInlineStyleChange (this=0xe3f5340, passedStart=..., passedEnd=..., styleChange=..., addStyledElement=WebCore::ApplyStyleCommand::AddStyledElement) at ../../Source/WebCore/editing/ApplyStyleCommand.cpp:1448 #27 0x00007fcd50ac2ee0 in WebCore::ApplyStyleCommand::applyInlineStyleToNodeRange (this=0xe3f5340, style=0xe433450, startNode=..., pastEndNode=...) at ../../Source/WebCore/editing/ApplyStyleCommand.cpp:816 #28 0x00007fcd50ac248c in WebCore::ApplyStyleCommand::fixRangeAndApplyInlineStyle (this=0xe3f5340, style=0xe433450, start=..., end=...) at ../../Source/WebCore/editing/ApplyStyleCommand.cpp:702 #29 0x00007fcd50ac205d in WebCore::ApplyStyleCommand::applyInlineStyle (this=0xe3f5340, style=0xe433450) at ../../Source/WebCore/editing/ApplyStyleCommand.cpp:665 #30 0x00007fcd50abf15d in WebCore::ApplyStyleCommand::doApply (this=0xe3f5340) at ../../Source/WebCore/editing/ApplyStyleCommand.cpp:223 #31 0x00007fcd50acea78 in WebCore::CompositeEditCommand::apply (this=0xe3f5340) at ../../Source/WebCore/editing/CompositeEditCommand.cpp:205 #32 0x00007fcd50ace778 in WebCore::applyCommand (command=...) at ../../Source/WebCore/editing/CompositeEditCommand.cpp:162 #33 0x00007fcd50afd15f in WebCore::Editor::applyStyle (this=0x15cf568, style=0xf806ff0, editingAction=WebCore::EditActionUnspecified) at ../../Source/WebCore/editing/Editor.cpp:695 #34 0x00007fcd50af2968 in WebCore::applyCommandToFrame (frame=0x15cf000, source=WebCore::CommandFromDOM, action=WebCore::EditActionSetColor, style=0xf806ff0) at ../../Source/WebCore/editing/EditorCommand.cpp:111 #35 0x00007fcd50af2a40 in WebCore::executeApplyStyle (frame=0x15cf000, source=WebCore::CommandFromDOM, action=WebCore::EditActionSetColor, propertyID=WebCore::CSSPropertyColor, propertyValue="red") at ../../Source/WebCore/editing/EditorCommand.cpp:122 #36 0x00007fcd50af42f8 in WebCore::executeForeColor (frame=0x15cf000, source=WebCore::CommandFromDOM, value="red") at ../../Source/WebCore/editing/EditorCommand.cpp:439 #37 0x00007fcd50af7d62 in WebCore::Editor::Command::execute (this=0x7fffef44dc20, parameter="red", triggeringEvent=0x0) at ../../Source/WebCore/editing/EditorCommand.cpp:1704 #38 0x00007fcd5099bc7e in WebCore::Document::execCommand (this=0xf7c8c40, commandName="ForeColor", userInterface=false, value="red") at ../../Source/WebCore/dom/Document.cpp:4183 #39 0x00007fcd51462920 in WebCore::jsDocumentPrototypeFunctionExecCommand (exec=0x7fcd001180b0) at DerivedSources/WebCore/JSDocument.cpp:2603 #40 0x00007fcd034fa0e5 in ?? () #41 0x00007fffef44ddd0 in ?? () #42 0x00007fcd54916ac7 in llint_op_call () from /home/slave/webkitgtk/gtk-linux-64-debug/build/WebKitBuild/Debug/.libs/libjavascriptcoregtk-3.0.so.0 #43 0x00007fcd00118058 in ?? () #44 0x00000000015f0980 in ?? () #45 0x00007fffef44dd90 in ?? () #46 0x00007fcd548bbdc7 in JSC::JSStack::installTrapsAfterFrame (this=0x0, frame=0x0) at ../../Source/JavaScriptCore/interpreter/JSStackInlines.h:213 #47 0x00007fcd548bab34 in JSC::JITCode::execute (this=0x7fccf82dd620, stack=0x15f0980, callFrame=0x7fcd00118058, globalData=0x1c4e210) at ../../Source/JavaScriptCore/jit/JITCode.h:134 #48 0x00007fcd548b7c6e in JSC::Interpreter::execute (this=0x15f0970, program=0x7fccf82dd600, callFrame=0x7fcd0006e388, thisObj=0x7fcd000affc0) at ../../Source/JavaScriptCore/interpreter/Interpreter.cpp:983 #49 0x00007fcd549a9600 in JSC::evaluate (exec=0x7fcd0006e388, source=..., thisValue=..., returnedException=0x7fffef44f3e0) at ../../Source/JavaScriptCore/runtime/Completion.cpp:75 #50 0x00007fcd5071be23 in WebCore::JSMainThreadExecState::evaluate (exec=0x7fcd0006e388, source=..., thisValue=..., exception=0x7fffef44f3e0) at ../../Source/WebCore/bindings/js/JSMainThreadExecState.h:77 #51 0x00007fcd5074a884 in WebCore::ScriptController::evaluateInWorld (this=0x15cf4e8, sourceCode=..., world=0x1c82ec0) at ../../Source/WebCore/bindings/js/ScriptController.cpp:141 #52 0x00007fcd5074a99a in WebCore::ScriptController::evaluate (this=0x15cf4e8, sourceCode=...) at ../../Source/WebCore/bindings/js/ScriptController.cpp:158 #53 0x00007fcd50a856dd in WebCore::ScriptElement::executeScript (this=0xf807a80, sourceCode=...) at ../../Source/WebCore/dom/ScriptElement.cpp:304 #54 0x00007fcd50a84ec6 in WebCore::ScriptElement::prepareScript (this=0xf807a80, scriptStartPosition=..., supportLegacyTypes=WebCore::ScriptElement::DisallowLegacyTypeInTypeAttribute) at ../../Source/WebCore/dom/ScriptElement.cpp:242 #55 0x00007fcd50ca8c7a in WebCore::HTMLScriptRunner::runScript (this=0xf7ab600, script=0xf807a10, scriptStartPosition=...) at ../../Source/WebCore/html/parser/HTMLScriptRunner.cpp:290 #56 0x00007fcd50ca82b5 in WebCore::HTMLScriptRunner::execute (this=0xf7ab600, scriptElement=..., scriptStartPosition=...) at ../../Source/WebCore/html/parser/HTMLScriptRunner.cpp:170 #57 0x00007fcd50c98d97 in WebCore::HTMLDocumentParser::runScriptsForPausedTreeBuilder (this=0xf75bff0) at ../../Source/WebCore/html/parser/HTMLDocumentParser.cpp:207 #58 0x00007fcd50c98e49 in WebCore::HTMLDocumentParser::canTakeNextToken (this=0xf75bff0, mode=WebCore::HTMLDocumentParser::AllowYield, session=...) at ../../Source/WebCore/html/parser/HTMLDocumentParser.cpp:224 #59 0x00007fcd50c9925c in WebCore::HTMLDocumentParser::pumpTokenizer (this=0xf75bff0, mode=WebCore::HTMLDocumentParser::AllowYield) at ../../Source/WebCore/html/parser/HTMLDocumentParser.cpp:261 #60 0x00007fcd50c98c44 in WebCore::HTMLDocumentParser::pumpTokenizerIfPossible (this=0xf75bff0, mode=WebCore::HTMLDocumentParser::AllowYield) at ../../Source/WebCore/html/parser/HTMLDocumentParser.cpp:180 #61 0x00007fcd50c99818 in WebCore::HTMLDocumentParser::append (this=0xf75bff0, source=...) at ../../Source/WebCore/html/parser/HTMLDocumentParser.cpp:368 #62 0x00007fcd50986e35 in WebCore::DecodedDataDocumentParser::flush (this=0xf75bff0, writer=0xf7982a8) at ../../Source/WebCore/dom/DecodedDataDocumentParser.cpp:60 #63 0x00007fcd50e9dd91 in WebCore::DocumentWriter::end (this=0xf7982a8) at ../../Source/WebCore/loader/DocumentWriter.cpp:241 #64 0x00007fcd50e8e68c in WebCore::DocumentLoader::finishedLoading (this=0xf798200) at ../../Source/WebCore/loader/DocumentLoader.cpp:295 #65 0x00007fcd50ee0afc in WebCore::MainResourceLoader::didFinishLoading (this=0xf7bf970, finishTime=0) at ../../Source/WebCore/loader/MainResourceLoader.cpp:563 #66 0x00007fcd50ee0c77 in WebCore::MainResourceLoader::notifyFinished (this=0xf7bf970, resource=0xf7e07e0) at ../../Source/WebCore/loader/MainResourceLoader.cpp:573 #67 0x00007fcd50e6d7fe in WebCore::CachedResource::checkNotify (this=0xf7e07e0) at ../../Source/WebCore/loader/cache/CachedResource.cpp:336 #68 0x00007fcd50e6d858 in WebCore::CachedResource::data (this=0xf7e07e0, allDataReceived=true) at ../../Source/WebCore/loader/cache/CachedResource.cpp:345 #69 0x00007fcd50e6ae8c in WebCore::CachedRawResource::data (this=0xf7e07e0, data=..., allDataReceived=true) at ../../Source/WebCore/loader/cache/CachedRawResource.cpp:72 #70 0x00007fcd50ef7e12 in WebCore::SubresourceLoader::didFinishLoading (this=0xf747cc0, finishTime=0) at ../../Source/WebCore/loader/SubresourceLoader.cpp:276 #71 0x00007fcd50eed7b9 in WebCore::ResourceLoader::didFinishLoading (this=0xf747cc0, finishTime=0) at ../../Source/WebCore/loader/ResourceLoader.cpp:457 #72 0x00007fcd518297ab in WebCore::readCallback (asyncResult=0xc08e350, data=0x9512b90) at ../../Source/WebCore/platform/network/soup/ResourceHandleSoup.cpp:1346 #73 0x00007fcd4f331e5f in async_ready_callback_wrapper () from /home/slave/webkitgtk/gtk-linux-64-debug/build/WebKitBuild/Dependencies/Root/lib64/libgio-2.0.so.0 #74 0x00007fcd4f34c7ea in g_simple_async_result_complete () from /home/slave/webkitgtk/gtk-linux-64-debug/build/WebKitBuild/Dependencies/Root/lib64/libgio-2.0.so.0 #75 0x00007fcd4f34c9b2 in complete_in_idle_cb_for_thread () from /home/slave/webkitgtk/gtk-linux-64-debug/build/WebKitBuild/Dependencies/Root/lib64/libgio-2.0.so.0 #76 0x00007fcd4f179fd1 in g_idle_dispatch () from /home/slave/webkitgtk/gtk-linux-64-debug/build/WebKitBuild/Dependencies/Root/lib64/libglib-2.0.so.0 #77 0x00007fcd4f177903 in g_main_dispatch () from /home/slave/webkitgtk/gtk-linux-64-debug/build/WebKitBuild/Dependencies/Root/lib64/libglib-2.0.so.0 #78 0x00007fcd4f1784b3 in g_main_context_dispatch () from /home/slave/webkitgtk/gtk-linux-64-debug/build/WebKitBuild/Dependencies/Root/lib64/libglib-2.0.so.0 #79 0x00007fcd4f1786a3 in g_main_context_iterate () from /home/slave/webkitgtk/gtk-linux-64-debug/build/WebKitBuild/Dependencies/Root/lib64/libglib-2.0.so.0 #80 0x00007fcd4f178ad3 in g_main_loop_run () from /home/slave/webkitgtk/gtk-linux-64-debug/build/WebKitBuild/Dependencies/Root/lib64/libglib-2.0.so.0 #81 0x00007fcd4fcc0e22 in gtk_main () from /home/slave/webkitgtk/gtk-linux-64-debug/build/WebKitBuild/Dependencies/Root/lib64/libgtk-3.so.0 #82 0x00000000004953bf in runTest (inputLine=...) at ../../Tools/DumpRenderTree/gtk/DumpRenderTree.cpp:761 #83 0x0000000000494afd in runTestingServerLoop () at ../../Tools/DumpRenderTree/gtk/DumpRenderTree.cpp:551 #84 0x0000000000497da3 in main (argc=2, argv=0x7fffef450aa8) at ../../Tools/DumpRenderTree/gtk/DumpRenderTree.cpp:1503

Dominic Mazzoni

Comment 4 2013-01-17 15:54:02 PST

Created attachment 183303 [details] Patch

Dominic Mazzoni

Comment 5 2013-01-17 15:56:24 PST

Here's my proposed fix, with the following reasoning: * This will fix the crash and doesn't break any existing tests. * accessibilityIsIgnored is a very hot function, it's called whenever an object is created, deleted, or modified. textUnderElement can be ridiculously expensive, especially when called on an element with a lot of descendants. So, ideally we want to avoid calling textUnderElement so often anyway. * This will probably change the ignored status of a few objects in corner cases. If these are wrong, we should write tests for them and try to come up with better heuristics. It's probably better to err on the side of including more nodes in the tree.

Joanmarie Diggs

Comment 6 2013-01-17 16:07:34 PST

(In reply to comment #5) > Here's my proposed fix, with the following reasoning: > > * This will fix the crash and doesn't break any existing tests. > > * accessibilityIsIgnored is a very hot function, it's called whenever an object is created, deleted, or modified. textUnderElement can be ridiculously expensive, especially when called on an element with a lot of descendants. So, ideally we want to avoid calling textUnderElement so often anyway. Would you add a comment into the code to that effect? It was really hard to get rid of bogus elements and if we see a regression later on, it would be nice to know that we shouldn't call textUnderElement. > It's probably better to err on the side of including more nodes in the tree. That depends on if it results in accessible caret events going missing. ;) Having said that, I'll cross that bridge when I get to it. Thanks for hunting this one down.

Dominic Mazzoni

Comment 7 2013-01-17 16:10:30 PST

Created attachment 183305 [details] Patch

Dominic Mazzoni

Comment 8 2013-01-17 16:11:38 PST

(In reply to comment #6) > Would you add a comment into the code to that effect? It was really hard to get rid of bogus elements and if we see a regression later on, it would be nice to know that we shouldn't call textUnderElement. Sure, done. > > It's probably better to err on the side of including more nodes in the tree. > > That depends on if it results in accessible caret events going missing. ;) Having said that, I'll cross that bridge when I get to it. Thanks for hunting this one down. Ah, I see. If having an *extra* element in the tree causes a caret event to get lost in the future, let's debug it and see if there is another possible solution.

Joanmarie Diggs

Comment 9 2013-01-18 09:06:20 PST

Since this patch seems to accomplish the same thing and passes all the regression tests, I'm fine with this. And we really need to eliminate these crashers....

WebKit Review Bot

Comment 10 2013-01-18 09:49:50 PST

Comment on attachment 183305 [details] Patch Clearing flags on attachment: 183305 Committed r140166: <http://trac.webkit.org/changeset/140166>

WebKit Review Bot

Comment 11 2013-01-18 09:49:55 PST

All reviewed patches have been landed. Closing bug.

Simon Pena

Comment 12 2013-07-31 07:30:26 PDT

I am unskipping these tests now as they are no longer flaky: http://webkit-test-results.appspot.com/dashboards/flakiness_dashboard.html#showAllRuns=true&tests=fast%2Fcss-generated-content%2Ffirst-letter-table-cell-format-block-crash.html%20fast%2Ftext%2Ftext-fragment-first-letter-update-crash.html%20fast%2Ftext%2Fcustom-font-data-crash2.html%20fast%2Fcss%2Ffirst-letter-text-fragment-crash.html%20editing%2Fselection%2Ffirst-letter-selection-crash.html%20editing%2Ftext-iterator%2Fbackward-textiterator-first-letter-crash.html

Note You need to log in before you can comment on or make changes to this bug.