Bug 104735

Summary: ASSERT running platform/mac/plugins/convert-point.html on the WK2 bots
Product: WebKit Reporter: Beth Dakin <bdakin>
Component: Plug-insAssignee: Anders Carlsson <andersca>
Status: RESOLVED WONTFIX    
Severity: Normal CC: andersca, ap, bdakin, tony
Priority: P2    
Version: 528+ (Nightly build)   
Hardware: Unspecified   
OS: Unspecified   
Attachments:
Description Flags
Patch jhoneycutt: review+

Beth Dakin
Reported 2012-12-11 15:55:59 PST
platform/mac/plugins/convert-point.html asserts on the WK2 bots. I can reproduce this reliably on my computer, but only when I run the test in WebKit Test Runner. (It does not repro if you just load the test in the browser.) ASSERT(!object->isSetNeedsLayoutForbidden()); Thread 0 Crashed:: Dispatch queue: com.apple.main-thread 0 com.apple.WebCore 0x0000000108621d50 WebCore::RenderObject::markContainingBlocksForLayout(bool, WebCore::RenderObject*) + 992 (RenderObject.cpp:683) 1 com.apple.WebCore 0x000000010764d9d0 WebCore::RenderObject::setNeedsLayout(bool, WebCore::MarkingBehavior) + 224 (RenderObject.h:1175) 2 com.apple.WebCore 0x000000010761b7a2 WebCore::RenderObject::setNeedsLayoutAndPrefWidthsRecalc() + 34 (RenderObject.h:662) 3 com.apple.WebCore 0x000000010871f5b4 WebCore::RenderText::setText(WTF::PassRefPtr<WTF::StringImpl>, bool) + 260 (RenderText.cpp:1466) 4 com.apple.WebCore 0x000000010871e913 WebCore::RenderText::setTextWithOffset(WTF::PassRefPtr<WTF::StringImpl>, unsigned int, unsigned int, bool) + 1219 (RenderText.cpp:1339) 5 com.apple.WebCore 0x0000000108afbe1e WebCore::Text::updateTextRenderer(unsigned int, unsigned int) + 286 (Text.cpp:314) 6 com.apple.WebCore 0x000000010738533c WebCore::CharacterData::setDataAndUpdate(WTF::String const&, unsigned int, unsigned int, unsigned int) + 252 (CharacterData.cpp:204) 7 com.apple.WebCore 0x000000010738520b WebCore::CharacterData::setData(WTF::String const&, int&) + 187 (CharacterData.cpp:54) 8 com.apple.WebCore 0x00000001082f6325 WebCore::replaceChildrenWithFragment(WebCore::ContainerNode*, WTF::PassRefPtr<WebCore::DocumentFragment>, int&) + 261 (markup.cpp:1120) 9 com.apple.WebCore 0x0000000107a6b41c WebCore::HTMLElement::setInnerHTML(WTF::String const&, int&) + 156 (HTMLElement.cpp:354) 10 com.apple.WebCore 0x0000000107ee456a WebCore::setJSHTMLElementInnerHTML(JSC::ExecState*, JSC::JSObject*, JSC::JSValue) + 106 (JSHTMLElement.cpp:544) 11 com.apple.WebCore 0x0000000107ee65d9 bool JSC::lookupPut<WebCore::JSHTMLElement>(JSC::ExecState*, JSC::PropertyName, JSC::JSValue, JSC::HashTable const*, WebCore::JSHTMLElement*, bool) + 249 (Lookup.h:373) 12 com.apple.WebCore 0x0000000107ee6078 void JSC::lookupPut<WebCore::JSHTMLElement, WebCore::JSElement>(JSC::ExecState*, JSC::PropertyName, JSC::JSValue, JSC::HashTable const*, WebCore::JSHTMLElement*, JSC::PutPropertySlot&) + 120 (Lookup.h:389) 13 com.apple.WebCore 0x0000000107ee32b7 WebCore::JSHTMLElement::put(JSC::JSCell*, JSC::ExecState*, JSC::PropertyName, JSC::JSValue, JSC::PutPropertySlot&) + 279 (JSHTMLElement.cpp:446) 14 com.apple.WebCore 0x0000000107edc98c void JSC::lookupPut<WebCore::JSHTMLDivElement, WebCore::JSHTMLElement>(JSC::ExecState*, JSC::PropertyName, JSC::JSValue, JSC::HashTable const*, WebCore::JSHTMLDivElement*, JSC::PutPropertySlot&) + 172 (Lookup.h:391) 15 com.apple.WebCore 0x0000000107edba17 WebCore::JSHTMLDivElement::put(JSC::JSCell*, JSC::ExecState*, JSC::PropertyName, JSC::JSValue, JSC::PutPropertySlot&) + 279 (JSHTMLDivElement.cpp:144) 16 com.apple.JavaScriptCore 0x0000000106348099 JSC::JSValue::put(JSC::ExecState*, JSC::PropertyName, JSC::JSValue, JSC::PutPropertySlot&) + 185 (JSObject.h:1523) 17 com.apple.JavaScriptCore 0x00000001065f4610 llint_slow_path_put_by_id + 416 (LLIntSlowPaths.cpp:981) 18 com.apple.JavaScriptCore 0x00000001065fd5a7 llint_op_put_by_id + 155 19 com.apple.JavaScriptCore 0x00000001063f8494 JSC::JITCode::execute(JSC::JSStack*, JSC::ExecState*, JSC::JSGlobalData*) + 84 (JITCode.h:134) 20 com.apple.JavaScriptCore 0x00000001063f4f3f JSC::Interpreter::execute(JSC::ProgramExecutable*, JSC::ExecState*, JSC::JSObject*) + 4735 (Interpreter.cpp:983) 21 com.apple.JavaScriptCore 0x00000001062be383 JSC::evaluate(JSC::ExecState*, JSC::SourceCode const&, JSC::JSValue, JSC::JSValue*) + 483 (Completion.cpp:75) 22 com.apple.WebKit2 0x0000000104f96f9d WebKit::NPRuntimeObjectMap::evaluate(NPObject*, WTF::String const&, _NPVariant*) + 349 (SourceCode.h:93) 23 com.apple.WebKit2 0x0000000104ff20c3 WebKit::PluginView::evaluate(NPObject*, WTF::String const&, _NPVariant*, bool) + 179 (PluginView.cpp:1285) 24 com.apple.WebKit2 0x0000000104ff214b non-virtual thunk to WebKit::PluginView::evaluate(NPObject*, WTF::String const&, _NPVariant*, bool) + 91 25 com.apple.WebKit2 0x0000000104fe22d9 WebKit::PluginProxy::evaluate(WebKit::NPVariantData const&, WTF::String const&, bool, bool&, WebKit::NPVariantData&) + 249 (PluginProxy.cpp:611) 26 com.apple.WebKit2 0x0000000104feaf26 void CoreIPC::callMemberFunction<WebKit::PluginProxy, void (WebKit::PluginProxy::*)(WebKit::NPVariantData const&, WTF::String const&, bool, bool&, WebKit::NPVariantData&), WebKit::NPVariantData, WTF::String, bool, bool, WebKit::NPVariantData>(CoreIPC::Arguments3<WebKit::NPVariantData, WTF::String, bool> const&, CoreIPC::Arguments2<bool, WebKit::NPVariantData>&, WebKit::PluginProxy*, void (WebKit::PluginProxy::*)(WebKit::NPVariantData const&, WTF::String const&, bool, bool&, WebKit::NPVariantData&)) + 214 (HandleMessage.h:150) 27 com.apple.WebKit2 0x0000000104fea9de void CoreIPC::handleMessage<Messages::PluginProxy::Evaluate, WebKit::PluginProxy, void (WebKit::PluginProxy::*)(WebKit::NPVariantData const&, WTF::String const&, bool, bool&, WebKit::NPVariantData&)>(CoreIPC::MessageDecoder&, CoreIPC::MessageEncoder&, WebKit::PluginProxy*, void (WebKit::PluginProxy::*)(WebKit::NPVariantData const&, WTF::String const&, bool, bool&, WebKit::NPVariantData&)) + 190 (HandleMessage.h:333) 28 com.apple.WebKit2 0x0000000104fe9eb5 WebKit::PluginProxy::didReceiveSyncPluginProxyMessage(CoreIPC::Connection*, CoreIPC::MessageID, CoreIPC::MessageDecoder&, WTF::OwnPtr<CoreIPC::MessageEncoder>&) + 949 (PluginProxyMessageReceiver.cpp:118) 29 com.apple.WebKit2 0x0000000104fc688c WebKit::PluginProcessConnection::didReceiveSyncMessage(CoreIPC::Connection*, CoreIPC::MessageID, CoreIPC::MessageDecoder&, WTF::OwnPtr<CoreIPC::MessageEncoder>&) + 252 (PluginProcessConnection.cpp:121) 30 com.apple.WebKit2 0x0000000104ed1b50 CoreIPC::Connection::dispatchSyncMessage(CoreIPC::MessageID, CoreIPC::MessageDecoder&) + 320 (Connection.cpp:635) 31 com.apple.WebKit2 0x0000000104ecf215 CoreIPC::Connection::dispatchMessage(CoreIPC::Connection::Message<CoreIPC::MessageDecoder>&) + 277 (Connection.cpp:682) 32 com.apple.WebKit2 0x0000000104ecf0cf CoreIPC::Connection::SyncMessageState::dispatchMessages() + 255 (Connection.cpp:166) 33 com.apple.WebKit2 0x0000000104ed0d06 CoreIPC::Connection::waitForSyncReply(unsigned long long, double, unsigned int) + 166 (Connection.cpp:431) 34 com.apple.WebKit2 0x0000000104ed0b20 CoreIPC::Connection::sendSyncMessage(CoreIPC::MessageID, unsigned long long, WTF::PassOwnPtr<CoreIPC::MessageEncoder>, double, unsigned int) + 528 (Connection.cpp:405) 35 com.apple.WebKit2 0x0000000104fe3211 bool CoreIPC::Connection::sendSync<Messages::PluginControllerProxy::PaintEntirePlugin>(Messages::PluginControllerProxy::PaintEntirePlugin const&, Messages::PluginControllerProxy::PaintEntirePlugin::Reply const&, unsigned long long, double, unsigned int) + 305 (Connection.h:419) 36 com.apple.WebKit2 0x0000000104fe0585 WebKit::PluginProxy::paint(WebCore::GraphicsContext*, WebCore::IntRect const&) + 181 (PluginProxy.cpp:213) 37 com.apple.WebKit2 0x0000000104fef7a7 WebKit::PluginView::paint(WebCore::GraphicsContext*, WebCore::IntRect const&) + 839 (PluginView.cpp:723) 38 com.apple.WebCore 0x000000010874cc06 WebCore::RenderWidget::paint(WebCore::PaintInfo&, WebCore::LayoutPoint const&) + 2166 (RenderWidget.cpp:293) 39 com.apple.WebCore 0x000000010855ca14 WebCore::RenderEmbeddedObject::paint(WebCore::PaintInfo&, WebCore::LayoutPoint const&) + 340 (RenderEmbeddedObject.cpp:168) 40 com.apple.WebCore 0x0000000107b97faf WebCore::InlineBox::paint(WebCore::PaintInfo&, WebCore::LayoutPoint const&, WebCore::LayoutUnit, WebCore::LayoutUnit) + 575 (InlineBox.cpp:241) 41 com.apple.WebCore 0x0000000107b9f3a3 WebCore::InlineFlowBox::paint(WebCore::PaintInfo&, WebCore::LayoutPoint const&, WebCore::LayoutUnit, WebCore::LayoutUnit) + 1347 (InlineFlowBox.cpp:1119) 42 com.apple.WebCore 0x0000000108784c63 WebCore::RootInlineBox::paint(WebCore::PaintInfo&, WebCore::LayoutPoint const&, WebCore::LayoutUnit, WebCore::LayoutUnit) + 115 (RootInlineBox.cpp:210) 43 com.apple.WebCore 0x00000001085efa2f WebCore::RenderLineBoxList::paint(WebCore::RenderBoxModelObject*, WebCore::PaintInfo&, WebCore::LayoutPoint const&) const + 2319 (RenderLineBoxList.cpp:232) 44 com.apple.WebCore 0x0000000108498a42 WebCore::RenderBlock::paintContents(WebCore::PaintInfo&, WebCore::LayoutPoint const&) + 162 (RenderBlock.cpp:2883) 45 com.apple.WebCore 0x0000000108499612 WebCore::RenderBlock::paintObject(WebCore::PaintInfo&, WebCore::LayoutPoint const&) + 578 (RenderBlock.cpp:3006) 46 com.apple.WebCore 0x0000000108496aed WebCore::RenderBlock::paint(WebCore::PaintInfo&, WebCore::LayoutPoint const&) + 317 (RenderBlock.cpp:2718) 47 com.apple.WebCore 0x0000000108498f38 WebCore::RenderBlock::paintChild(WebCore::RenderBox*, WebCore::PaintInfo&, WebCore::LayoutPoint const&, WebCore::PaintInfo&, bool) + 856 (RenderBlock.cpp:2937) 48 com.apple.WebCore 0x0000000108498bb7 WebCore::RenderBlock::paintChildren(WebCore::PaintInfo&, WebCore::LayoutPoint const&, WebCore::PaintInfo&, bool) + 103 (RenderBlock.cpp:2903) 49 com.apple.WebCore 0x0000000108498b3a WebCore::RenderBlock::paintContents(WebCore::PaintInfo&, WebCore::LayoutPoint const&) + 410 (RenderBlock.cpp:2898) 50 com.apple.WebCore 0x0000000108499612 WebCore::RenderBlock::paintObject(WebCore::PaintInfo&, WebCore::LayoutPoint const&) + 578 (RenderBlock.cpp:3006) 51 com.apple.WebCore 0x0000000108496aed WebCore::RenderBlock::paint(WebCore::PaintInfo&, WebCore::LayoutPoint const&) + 317 (RenderBlock.cpp:2718) 52 com.apple.WebCore 0x0000000108498f38 WebCore::RenderBlock::paintChild(WebCore::RenderBox*, WebCore::PaintInfo&, WebCore::LayoutPoint const&, WebCore::PaintInfo&, bool) + 856 (RenderBlock.cpp:2937) 53 com.apple.WebCore 0x0000000108498bb7 WebCore::RenderBlock::paintChildren(WebCore::PaintInfo&, WebCore::LayoutPoint const&, WebCore::PaintInfo&, bool) + 103 (RenderBlock.cpp:2903) 54 com.apple.WebCore 0x0000000108498b3a WebCore::RenderBlock::paintContents(WebCore::PaintInfo&, WebCore::LayoutPoint const&) + 410 (RenderBlock.cpp:2898) 55 com.apple.WebCore 0x0000000108499612 WebCore::RenderBlock::paintObject(WebCore::PaintInfo&, WebCore::LayoutPoint const&) + 578 (RenderBlock.cpp:3006) 56 com.apple.WebCore 0x0000000108496aed WebCore::RenderBlock::paint(WebCore::PaintInfo&, WebCore::LayoutPoint const&) + 317 (RenderBlock.cpp:2718) 57 com.apple.WebCore 0x00000001085afd78 WebCore::RenderLayer::paintLayerContents(WebCore::GraphicsContext*, WebCore::RenderLayer::LayerPaintingInfo const&, unsigned int) + 4168 (RenderLayer.cpp:3436) 58 com.apple.WebCore 0x00000001085aed1b WebCore::RenderLayer::paintLayerContentsAndReflection(WebCore::GraphicsContext*, WebCore::RenderLayer::LayerPaintingInfo const&, unsigned int) + 283 (RenderLayer.cpp:3240) 59 com.apple.WebCore 0x00000001085ae3e5 WebCore::RenderLayer::paintLayer(WebCore::GraphicsContext*, WebCore::RenderLayer::LayerPaintingInfo const&, unsigned int) + 1701 (RenderLayer.cpp:3222) 60 com.apple.WebCore 0x00000001085b0cd9 WebCore::RenderLayer::paintList(WTF::Vector<WebCore::RenderLayer*, 0ul>*, WebCore::GraphicsContext*, WebCore::RenderLayer::LayerPaintingInfo const&, unsigned int) + 185 (RenderLayer.cpp:3523) 61 com.apple.WebCore 0x00000001085affc5 WebCore::RenderLayer::paintLayerContents(WebCore::GraphicsContext*, WebCore::RenderLayer::LayerPaintingInfo const&, unsigned int) + 4757 (RenderLayer.cpp:3461) 62 com.apple.WebCore 0x00000001085aed1b WebCore::RenderLayer::paintLayerContentsAndReflection(WebCore::GraphicsContext*, WebCore::RenderLayer::LayerPaintingInfo const&, unsigned int) + 283 (RenderLayer.cpp:3240) 63 com.apple.WebCore 0x00000001085ae3e5 WebCore::RenderLayer::paintLayer(WebCore::GraphicsContext*, WebCore::RenderLayer::LayerPaintingInfo const&, unsigned int) + 1701 (RenderLayer.cpp:3222) 64 com.apple.WebCore 0x00000001085adc7e WebCore::RenderLayer::paint(WebCore::GraphicsContext*, WebCore::LayoutRect const&, unsigned int, WebCore::RenderObject*, WebCore::RenderRegion*, unsigned int) + 254 (RenderLayer.cpp:3026) 65 com.apple.WebCore 0x000000010796c096 WebCore::FrameView::paintContents(WebCore::GraphicsContext*, WebCore::IntRect const&) + 1446 (FrameView.cpp:3267) 66 com.apple.WebCore 0x000000010882b562 WebCore::ScrollView::paint(WebCore::GraphicsContext*, WebCore::IntRect const&) + 914 (ScrollView.cpp:1076) 67 com.apple.WebKit2 0x00000001050fdfb4 WebKit::WebPage::drawRect(WebCore::GraphicsContext&, WebCore::IntRect const&) + 292 (WebPage.cpp:1111) 68 com.apple.WebKit2 0x0000000104ef2ca1 WebKit::DrawingAreaImpl::display(WebKit::UpdateInfo&) + 1585 (DrawingAreaImpl.cpp:721) 69 com.apple.WebKit2 0x0000000104ef181f WebKit::DrawingAreaImpl::display() + 415 (DrawingAreaImpl.cpp:624) 70 com.apple.WebKit2 0x0000000104ef03f5 WebKit::DrawingAreaImpl::displayTimerFired() + 21 (DrawingAreaImpl.cpp:602) 71 com.apple.WebKit2 0x0000000104ef50bb WebCore::RunLoop::Timer<WebKit::DrawingAreaImpl>::fired() + 107 (RunLoop.h:123) 72 com.apple.WebCore 0x00000001087a0e06 WebCore::RunLoop::TimerBase::timerFired(__CFRunLoopTimer*, void*) + 86 (RunLoopCF.cpp:138) 73 com.apple.CoreFoundation 0x00007fff82e40da4 __CFRUNLOOP_IS_CALLING_OUT_TO_A_TIMER_CALLBACK_FUNCTION__ + 20 74 com.apple.CoreFoundation 0x00007fff82e408bd __CFRunLoopDoTimer + 557 75 com.apple.CoreFoundation 0x00007fff82e26099 __CFRunLoopRun + 1513 76 com.apple.CoreFoundation 0x00007fff82e256b2 CFRunLoopRunSpecific + 290 77 com.apple.HIToolbox 0x00007fff86a900a4 RunCurrentEventLoopInMode + 209 78 com.apple.HIToolbox 0x00007fff86a8fe42 ReceiveNextEventCommon + 356 79 com.apple.HIToolbox 0x00007fff86a8fcd3 BlockUntilNextEventMatchingListInMode + 62 80 com.apple.AppKit 0x00007fff8b6db613 _DPSNextEvent + 685 81 com.apple.AppKit 0x00007fff8b6daed2 -[NSApplication nextEventMatchingMask:untilDate:inMode:dequeue:] + 128 82 com.apple.AppKit 0x00007fff8b6d2283 -[NSApplication run] + 517 83 com.apple.WebCore 0x00000001087a174c WebCore::RunLoop::run() + 92 (RunLoopMac.mm:37) 84 com.apple.WebKit2 0x00000001051f0d53 WebKit::WebProcessMain(WebKit::CommandLine const&) + 4451 (WebProcessMainMac.mm:187) 85 com.apple.WebKit2 0x00000001050deaea WebKitMain(WebKit::CommandLine const&) + 202 (WebKitMain.cpp:58) 86 com.apple.WebKit2 0x00000001050de9f9 WebKitMain + 153 (WebKitMain.cpp:88) 87 com.apple.WebProcess 0x0000000104e66da2 main + 274 (MainMacProcess.cpp:68) 88 libdyld.dylib 0x00007fff882417e1 start + 1
Attachments
Patch (3.02 KB, patch)
2012-12-11 17:00 PST, Anders Carlsson 		jhoneycutt: review+
DetailsFormatted DiffDiff
View All Add attachment proposed patch, testcase, etc.
Tony Chang
Comment 1 2012-12-11 16:23:35 PST
It looks like during paint, we're running javascript (something to do with the sync plugin call?). That seems like the real bug, not the addition of the assert. Is repaint really supposed to be able to trigger javascript?
Anders Carlsson
Comment 2 2012-12-11 16:33:15 PST
(In reply to comment #1) > Is repaint really supposed to be able to trigger javascript? Nope, and we have code in place that tries to avoid it.
Beth Dakin
Comment 3 2012-12-11 16:41:24 PST
I skipped the test for now with http://trac.webkit.org/changeset/137385
Anders Carlsson
Comment 4 2012-12-11 16:52:37 PST
OK, the plug-in test is doing a bunch of work in NPP_SetWindow. Plug-ins shouldn't do that, and I don't know of any real-world plug-ins that do this. We should just fix the test to run in NPP_New instead of NPP_SetWindow.
Anders Carlsson
Comment 5 2012-12-11 17:00:02 PST
Created attachment 178923 [details] Patch
Alexey Proskuryakov
Comment 6 2022-07-01 11:36:02 PDT
Mass closing plug-in bugs, as plug-in support has been removed from WebKit. Please comment and/or reopen if this still affects WebKit in some way.
Note You need to log in before you can comment on or make changes to this bug.