Bug 105042 – REGRESSION (r137487): Crashes in editing/execCommand/indent-paragraphs.html on GTK, EFL

• Component: WebKitGTK
• Status: RESOLVED FIXED

[Zan Dobersek]

editing/execCommand/indent-paragraphs.html layout test started crashing after r137487 landed.
http://trac.webkit.org/changeset/137487
http://test-results.appspot.com/dashboards/flakiness_dashboard.html#group=%40ToT%20-%20webkit.org&tests=editing%2FexecCommand%2Findent-paragraphs.html

Here's the crash log:
Crash log for DumpRenderTree (pid 5916):

...
[Thread debugging using libthread_db enabled]
Using host libthread_db library "/lib/x86_64-linux-gnu/libthread_db.so.1".
Core was generated by `/home/slave/webkitgtk/gtk-linux-64-debug/build/WebKitBuild/Debug/Programs/DumpR'.
Program terminated with signal 11, Segmentation fault.
#0  0x00007f8ed5a604a4 in soup_session_request_uri () from /home/slave/webkitgtk/gtk-linux-64-debug/build/WebKitBuild/Dependencies/Root/lib64/libsoup-2.4.so.1

...

Thread 1 (Thread 0x7f8ec68cd900 (LWP 5916)):
#0  0x00007f8ed5a604a4 in soup_session_request_uri () from /home/slave/webkitgtk/gtk-linux-64-debug/build/WebKitBuild/Dependencies/Root/lib64/libsoup-2.4.so.1
#1  0x00007f8ed5a552c7 in soup_requester_request_uri () from /home/slave/webkitgtk/gtk-linux-64-debug/build/WebKitBuild/Dependencies/Root/lib64/libsoup-2.4.so.1
#2  0x00007f8ed2293f87 in WebCore::createSoupRequestAndMessageForHandle (handle=0xb34ff30, isHTTPFamilyRequest=true) at ../../Source/WebCore/platform/network/soup/ResourceHandleSoup.cpp:895
#3  0x00007f8ed2294205 in WebCore::ResourceHandle::start (this=0xb34ff30, context=0x12ea170) at ../../Source/WebCore/platform/network/soup/ResourceHandleSoup.cpp:935
#4  0x00007f8ed2282b77 in WebCore::ResourceHandle::create (context=0x12ea170, request=..., client=0x5343690, defersLoading=false, shouldContentSniff=true) at ../../Source/WebCore/platform/network/ResourceHandle.cpp:81
#5  0x00007f8ed196caa4 in WebCore::ResourceLoader::start (this=0x5343690) at ../../Source/WebCore/loader/ResourceLoader.cpp:170
#6  0x00007f8ed1970034 in WebCore::ResourceLoadScheduler::servePendingRequests (this=0x12d7540, host=0xb34fd90, minimumPriority=WebCore::ResourceLoadPriorityLow) at ../../Source/WebCore/loader/ResourceLoadScheduler.cpp:247
#7  0x00007f8ed196fa3e in WebCore::ResourceLoadScheduler::scheduleLoad (this=0x12d7540, resourceLoader=0x5343690, priority=WebCore::ResourceLoadPriorityLow) at ../../Source/WebCore/loader/ResourceLoadScheduler.cpp:162
#8  0x00007f8ed196f775 in WebCore::ResourceLoadScheduler::scheduleSubresourceLoad (this=0x12d7540, frame=0x12b4400, resource=0xb21d5d0, request=..., priority=WebCore::ResourceLoadPriorityLow, options=...) at ../../Source/WebCore/loader/ResourceLoadScheduler.cpp:123
#9  0x00007f8ed18ece32 in WebCore::CachedResource::load (this=0xb21d5d0, cachedResourceLoader=0xb2c3ce0, options=...) at ../../Source/WebCore/loader/cache/CachedResource.cpp:315
#10 0x00007f8ed18e749e in WebCore::CachedImage::load (this=0xb21d5d0, cachedResourceLoader=0xb2c3ce0, options=...) at ../../Source/WebCore/loader/cache/CachedImage.cpp:82
#11 0x00007f8ed18fa6b2 in WebCore::CachedResourceLoader::requestResource (this=0xb2c3ce0, type=WebCore::CachedResource::ImageResource, request=...) at ../../Source/WebCore/loader/cache/CachedResourceLoader.cpp:466
#12 0x00007f8ed18f9451 in WebCore::CachedResourceLoader::requestImage (this=0xb2c3ce0, request=...) at ../../Source/WebCore/loader/cache/CachedResourceLoader.cpp:172
#13 0x00007f8ed195c709 in WebCore::ImageLoader::updateFromElement (this=0xb3f7578) at ../../Source/WebCore/loader/ImageLoader.cpp:206
#14 0x00007f8ed195cb9f in WebCore::ImageLoader::updateFromElementIgnoringPreviousError (this=0xb3f7578) at ../../Source/WebCore/loader/ImageLoader.cpp:268
#15 0x00007f8ed16ac3a5 in WebCore::HTMLImageElement::parseAttribute (this=0xb3f7500, name="src", value="http://") at ../../Source/WebCore/html/HTMLImageElement.cpp:169
#16 0x00007f8ed148f62c in WebCore::Element::attributeChanged (this=0xb3f7500, name="src", newValue="http://") at ../../Source/WebCore/dom/Element.cpp:776
#17 0x00007f8ed152d49d in WebCore::StyledElement::attributeChanged (this=0xb3f7500, name="src", newValue="http://") at ../../Source/WebCore/dom/StyledElement.cpp:168
#18 0x00007f8ed14902e0 in WebCore::Element::parserSetAttributes (this=0xb3f7500, attributeVector=WTF::Vector of length 1, capacity 1 = {...}, scriptingPermission=WebCore::AllowScriptingContent) at ../../Source/WebCore/dom/Element.cpp:999
#19 0x00007f8ed171e05c in WebCore::HTMLConstructionSite::createHTMLElement (this=0x5352298, token=0xb3b0f50) at ../../Source/WebCore/html/parser/HTMLConstructionSite.cpp:422
#20 0x00007f8ed171d5d9 in WebCore::HTMLConstructionSite::insertSelfClosingHTMLElement (this=0x5352298, token=0xb3b0f50) at ../../Source/WebCore/html/parser/HTMLConstructionSite.cpp:311
#21 0x00007f8ed1743acd in WebCore::HTMLTreeBuilder::processStartTagForInBody (this=0x5352270, token=0xb3b0f50) at ../../Source/WebCore/html/parser/HTMLTreeBuilder.cpp:839
#22 0x00007f8ed174549e in WebCore::HTMLTreeBuilder::processStartTag (this=0x5352270, token=0xb3b0f50) at ../../Source/WebCore/html/parser/HTMLTreeBuilder.cpp:1165
#23 0x00007f8ed1741859 in WebCore::HTMLTreeBuilder::processToken (this=0x5352270, token=0xb3b0f50) at ../../Source/WebCore/html/parser/HTMLTreeBuilder.cpp:418
#24 0x00007f8ed1741696 in WebCore::HTMLTreeBuilder::constructTreeFromAtomicToken (this=0x5352270, token=0xb3b0f50) at ../../Source/WebCore/html/parser/HTMLTreeBuilder.cpp:392
#25 0x00007f8ed17415ad in WebCore::HTMLTreeBuilder::constructTreeFromToken (this=0x5352270, rawToken=...) at ../../Source/WebCore/html/parser/HTMLTreeBuilder.cpp:373
#26 0x00007f8ed1721d2f in WebCore::HTMLDocumentParser::pumpTokenizer (this=0xb36d8a0, mode=WebCore::HTMLDocumentParser::AllowYield) at ../../Source/WebCore/html/parser/HTMLDocumentParser.cpp:269
#27 0x00007f8ed1721780 in WebCore::HTMLDocumentParser::pumpTokenizerIfPossible (this=0xb36d8a0, mode=WebCore::HTMLDocumentParser::AllowYield) at ../../Source/WebCore/html/parser/HTMLDocumentParser.cpp:173
#28 0x00007f8ed17228f1 in WebCore::HTMLDocumentParser::resumeParsingAfterScriptExecution (this=0xb36d8a0) at ../../Source/WebCore/html/parser/HTMLDocumentParser.cpp:476
#29 0x00007f8ed1722b9f in WebCore::HTMLDocumentParser::notifyFinished (this=0xb36d8a0, cachedResource=0xb3a3550) at ../../Source/WebCore/html/parser/HTMLDocumentParser.cpp:516
#30 0x00007f8ed18ecf32 in WebCore::CachedResource::checkNotify (this=0xb3a3550) at ../../Source/WebCore/loader/cache/CachedResource.cpp:335
#31 0x00007f8ed19050a9 in WebCore::CachedScript::data (this=0xb3a3550, data=..., allDataReceived=true) at ../../Source/WebCore/loader/cache/CachedScript.cpp:90
#32 0x00007f8ed19785b0 in WebCore::SubresourceLoader::didFinishLoading (this=0xb0cac50, finishTime=0) at ../../Source/WebCore/loader/SubresourceLoader.cpp:275
#33 0x00007f8ed196da51 in WebCore::ResourceLoader::didFinishLoading (this=0xb0cac50, finishTime=0) at ../../Source/WebCore/loader/ResourceLoader.cpp:456
#34 0x00007f8ed22959f3 in WebCore::readCallback (asyncResult=0x7f8e8056e120, data=0xb394610) at ../../Source/WebCore/platform/network/soup/ResourceHandleSoup.cpp:1261
#35 0x00007f8ecfdc5e5f in async_ready_callback_wrapper () from /home/slave/webkitgtk/gtk-linux-64-debug/build/WebKitBuild/Dependencies/Root/lib64/libgio-2.0.so.0
#36 0x00007f8ecfde07ea in g_simple_async_result_complete () from /home/slave/webkitgtk/gtk-linux-64-debug/build/WebKitBuild/Dependencies/Root/lib64/libgio-2.0.so.0
#37 0x00007f8ecfde09b2 in complete_in_idle_cb_for_thread () from /home/slave/webkitgtk/gtk-linux-64-debug/build/WebKitBuild/Dependencies/Root/lib64/libgio-2.0.so.0
#38 0x00007f8ecfc0dfd1 in g_idle_dispatch () from /home/slave/webkitgtk/gtk-linux-64-debug/build/WebKitBuild/Dependencies/Root/lib64/libglib-2.0.so.0
#39 0x00007f8ecfc0b903 in g_main_dispatch () from /home/slave/webkitgtk/gtk-linux-64-debug/build/WebKitBuild/Dependencies/Root/lib64/libglib-2.0.so.0
#40 0x00007f8ecfc0c4b3 in g_main_context_dispatch () from /home/slave/webkitgtk/gtk-linux-64-debug/build/WebKitBuild/Dependencies/Root/lib64/libglib-2.0.so.0
#41 0x00007f8ecfc0c6a3 in g_main_context_iterate () from /home/slave/webkitgtk/gtk-linux-64-debug/build/WebKitBuild/Dependencies/Root/lib64/libglib-2.0.so.0
#42 0x00007f8ecfc0cad3 in g_main_loop_run () from /home/slave/webkitgtk/gtk-linux-64-debug/build/WebKitBuild/Dependencies/Root/lib64/libglib-2.0.so.0
#43 0x00007f8ed0754e22 in gtk_main () from /home/slave/webkitgtk/gtk-linux-64-debug/build/WebKitBuild/Dependencies/Root/lib64/libgtk-3.so.0
#44 0x0000000000486dbd in runTest (inputLine=...) at ../../Tools/DumpRenderTree/gtk/DumpRenderTree.cpp:760
#45 0x00000000004864fb in runTestingServerLoop () at ../../Tools/DumpRenderTree/gtk/DumpRenderTree.cpp:550
#46 0x00000000004897a9 in main (argc=2, argv=0x7fff5832c1c8) at ../../Tools/DumpRenderTree/gtk/DumpRenderTree.cpp:1500

[Martin Robinson]

The crash is in libsoup. Not sure if we are doing something wrong to cause this. Here's a slightly more accurate part of the stack trace:

soup_session_request_uri (session=0x61c120, uri=uri@entry=0x0, error=error@entry=0x7fffffffc600) at soup-session.c:3792
3792		request_type = (GType)GPOINTER_TO_SIZE (g_hash_table_lookup (priv->request_types, uri->scheme));
(gdb) where
#0  soup_session_request_uri (session=0x61c120, uri=uri@entry=0x0, error=error@entry=0x7fffffffc600) at soup-session.c:3792
#1  0x00007ffff5598aca in soup_requester_request_uri (requester=0x634330, uri=0x0, error=0x7fffffffc600) at soup-requester.c:134
#2  0x00007ffff6ed8aeb in WebCore::ResourceHandle::start(WebCore::NetworkingContext*) () from /home/martin/WebKit/WebKitBuild/Release/.libs/libwebkitgtk-3.0.so.0
#3  0x00007ffff6eca101 in WebCore::ResourceHandle::create(WebCore::NetworkingContext*, WebCore::ResourceRequest const&, WebCore::ResourceHandleClient*, bool, bool) ()
   from /home/martin/WebKit/WebKitBuild/Release/.libs/libwebkitgtk-3.0.so.0

[Martin Robinson]

(In reply to comment #1)
> The crash is in libsoup. Not sure if we are doing something wrong to cause this. Here's a slightly more accurate part of the stack trace:
> 
> soup_session_request_uri (session=0x61c120, uri=uri@entry=0x0, error=error@entry=0x7fffffffc600) at soup-session.c:3792

I guess the fact that the URI is null is quite suspicious. :)

[Kangil Han]

(In reply to comment #2)
> (In reply to comment #1)
> > The crash is in libsoup. Not sure if we are doing something wrong to cause this. Here's a slightly more accurate part of the stack trace:
> > 
> > soup_session_request_uri (session=0x61c120, uri=uri@entry=0x0, error=error@entry=0x7fffffffc600) at soup-session.c:3792
> 
> I guess the fact that the URI is null is quite suspicious. :)

FWIW, please refer to BUG 104978.

[Martin Robinson]

Created attachment 179580 [details]
Patch

[Thiago Marcos P. Santos]

Comment on attachment 179580 [details]
Patch

LGTM.

[Chris Dumez]

Temporarily skipped the test on EFL as well to make the tree green until this patch lands: http://trac.webkit.org/changeset/137875

[Zan Dobersek]

(In reply to comment #4)
> Created an attachment (id=179580) [details]
> Patch

Let's get this reviewed and landed.

[WebKit Review Bot]

Comment on attachment 179580 [details]
Patch

Rejecting attachment 179580 [details] from commit-queue.

Failed to run "['/mnt/git/webkit-commit-queue/Tools/Scripts/webkit-patch', '--status-host=queues.webkit.org', '-..." exit_code: 2 cwd: /mnt/git/webkit-commit-queue

Last 500 characters of output:
work/soup/ResourceHandleSoup.cpp
Hunk #1 succeeded at 985 with fuzz 1 (offset 93 lines).
patching file LayoutTests/ChangeLog
Hunk #1 succeeded at 1 with fuzz 3.
patching file LayoutTests/platform/gtk/TestExpectations
Hunk #1 FAILED at 508.
1 out of 1 hunk FAILED -- saving rejects to file LayoutTests/platform/gtk/TestExpectations.rej

Failed to run "[u'/mnt/git/webkit-commit-queue/Tools/Scripts/svn-apply', '--force', '--reviewer', 'Gustavo Noron..." exit_code: 1 cwd: /mnt/git/webkit-commit-queue

Full output: http://queues.webkit.org/results/15906966

[Martin Robinson]

Committed r140006: <http://trac.webkit.org/changeset/140006>