Bug 105371

Summary: Crash in TextTrack::trackIndexRelativeToRenderedTracks()
Product: WebKit Reporter: Simon Fraser (smfr) <simon.fraser>
Component: MediaAssignee: Eric Carlson <eric.carlson>
Status: RESOLVED FIXED    
Severity: Normal CC: dino, eric.carlson, feature-media-reviews, graouts, jer.noble, morrita, ojan.autocc, rniwa, simon.fraser, webkit-ews, webkit.review.bot
Priority: P2 Keywords: MakingBotsRed
Version: 528+ (Nightly build)   
Hardware: Unspecified   
OS: Unspecified   
URL: http://build.webkit.org/results/Apple%20MountainLion%20Debug%20WK1%20(Tests)/r138081%20(3961)/media/video-controls-captions-trackmenu-crash-log.txt
Attachments:
Description Flags
Proposed patch
dino: review+, webkit-ews: commit-queue-
Put "#if ENABLE(VIDEO_TRACK)" around new code. none

Simon Fraser (smfr)
Reported 2012-12-18 17:37:16 PST
CRASHING TEST: media/video-controls-captions-trackmenu.html Process: DumpRenderTree [47704] Path: /Volumes/VOLUME/*/DumpRenderTree Identifier: DumpRenderTree Version: 0 Code Type: X86-64 (Native) Parent Process: Python [46425] User ID: 501 Date/Time: 2012-12-18 17:18:36.095 -0800 OS Version: Mac OS X 10.8.2 (12C54) Report Version: 10 Crashed Thread: 0 Dispatch queue: com.apple.main-thread Exception Type: EXC_BAD_ACCESS (SIGSEGV) Exception Codes: KERN_INVALID_ADDRESS at 0x00000000bbadbeef VM Regions Near 0xbbadbeef: --> __TEXT 0000000104bee000-0000000104c8a000 [ 624K] r-x/rwx SM=COW /Volumes/VOLUME/* Application Specific Information: CRASHING TEST: media/video-controls-captions-trackmenu.html Thread 0 Crashed:: Dispatch queue: com.apple.main-thread 0 com.apple.WebCore 0x0000000107e81af5 WebCore::TextTrack::trackIndexRelativeToRenderedTracks() + 85 (TextTrack.cpp:332) 1 com.apple.WebCore 0x0000000107e8317f WebCore::TextTrackCue::calculateComputedLinePosition() + 127 (TextTrackCue.cpp:578) 2 com.apple.WebCore 0x0000000107a82c8e WebCore::RenderTextTrackCue::initializeLayoutParameters(WebCore::InlineFlowBox*&, WebCore::LayoutUnit&, WebCore::LayoutUnit&) + 318 (RenderTextTrackCue.cpp:71) 3 com.apple.WebCore 0x0000000107a82a5e WebCore::RenderTextTrackCue::repositionCueSnapToLinesSet() + 62 (RenderTextTrackCue.cpp:203) 4 com.apple.WebCore 0x0000000107a829ef WebCore::RenderTextTrackCue::layout() + 303 (RenderTextTrackCue.cpp:49) 5 com.apple.WebCore 0x0000000106c23876 WebCore::RenderObject::layoutIfNeeded() + 54 (RenderObject.h:687) 6 com.apple.WebCore 0x00000001077d9411 WebCore::RenderBlock::layoutPositionedObjects(bool) + 673 (RenderBlock.cpp:2653) 7 com.apple.WebCore 0x00000001077d6159 WebCore::RenderBlock::layoutBlock(bool, WebCore::LayoutUnit) + 2537 (RenderBlock.cpp:1568) 8 com.apple.WebCore 0x00000001077d4d0e WebCore::RenderBlock::layout() + 126 (RenderBlock.cpp:1360) 9 com.apple.WebCore 0x000000010796361f WebCore::RenderTextTrackContainerElement::layout() + 31 (RenderMediaControlElements.cpp:94) 10 com.apple.WebCore 0x0000000106c23876 WebCore::RenderObject::layoutIfNeeded() + 54 (RenderObject.h:687) 11 com.apple.WebCore 0x00000001078a92a5 WebCore::RenderDeprecatedFlexibleBox::layoutVerticalBox(bool) + 1941 (RenderDeprecatedFlexibleBox.cpp:713) 12 com.apple.WebCore 0x00000001078a6342 WebCore::RenderDeprecatedFlexibleBox::layoutBlock(bool, WebCore::LayoutUnit) + 1010 (RenderDeprecatedFlexibleBox.cpp:283) 13 com.apple.WebCore 0x00000001077d4d0e WebCore::RenderBlock::layout() + 126 (RenderBlock.cpp:1360) 14 com.apple.WebCore 0x0000000107962ec6 WebCore::RenderMedia::layout() + 1078 (RenderMedia.cpp:83)
Attachments
Proposed patch (8.79 KB, patch)
2012-12-19 12:50 PST, Eric Carlson 		dino: review+
webkit-ews: commit-queue-
DetailsFormatted DiffDiff
Put "#if ENABLE(VIDEO_TRACK)" around new code. (8.83 KB, patch)
2012-12-19 13:23 PST, Eric Carlson 		no flags
DetailsFormatted DiffDiff
Show Obsolete (1) View All Add attachment proposed patch, testcase, etc.
Simon Fraser (smfr)
Comment 1 2012-12-18 18:04:25 PST
Skipped in Debug in http://trac.webkit.org/changeset/138094
Simon Fraser (smfr)
Comment 2 2012-12-19 11:14:08 PST
This is followed by a crash in Release: http://build.webkit.org/results/Apple%20Lion%20Release%20WK1%20(Tests)/r138178%20(7486)/media/video-controls-captions-trackmenu-crash-log.txt Exception Type: EXC_BAD_ACCESS (SIGSEGV) Exception Codes: KERN_INVALID_ADDRESS at 0x0000000000000258 VM Regions Near 0x258: --> __TEXT 00000001016d8000-0000000101738000 [ 384K] r-x/rwx SM=COW /Volumes/VOLUME/* Application Specific Information: CRASHING TEST: media/video-controls-captions-trackmenu.html objc[93675]: garbage collection is OFF Thread 0 Crashed:: Dispatch queue: com.apple.main-thread 0 com.apple.WebCore 0x00000001024b7a9b WebCore::HTMLMediaElement::textTracks() + 27 (RefPtr.h:66) 1 com.apple.WebCore 0x0000000102d271fd WebCore::TextTrack::trackIndexRelativeToRenderedTracks() + 29 (TextTrack.cpp:335) 2 com.apple.WebCore 0x0000000102d2811d WebCore::TextTrackCue::calculateComputedLinePosition() + 45 (TextTrackCue.cpp:584) 3 com.apple.WebCore 0x0000000102b3b1b2 WebCore::RenderTextTrackCue::initializeLayoutParameters(WebCore::InlineFlowBox*&, WebCore::LayoutUnit&, WebCore::LayoutUnit&) + 130 (RenderTextTrackCue.cpp:74)
Eric Carlson
Comment 3 2012-12-19 12:50:07 PST
Created attachment 180211 [details] Proposed patch
Early Warning System Bot
Comment 4 2012-12-19 13:15:12 PST
Comment on attachment 180211 [details] Proposed patch Attachment 180211 [details] did not pass qt-ews (qt): Output: http://queues.webkit.org/results/15405766
Early Warning System Bot
Comment 5 2012-12-19 13:16:05 PST
Comment on attachment 180211 [details] Proposed patch Attachment 180211 [details] did not pass qt-wk2-ews (qt): Output: http://queues.webkit.org/results/15410752
Eric Carlson
Comment 6 2012-12-19 13:23:48 PST
Created attachment 180216 [details] Put "#if ENABLE(VIDEO_TRACK)" around new code.
WebKit Review Bot
Comment 7 2012-12-19 21:51:43 PST
Comment on attachment 180216 [details] Put "#if ENABLE(VIDEO_TRACK)" around new code. Clearing flags on attachment: 180216 Committed r138224: <http://trac.webkit.org/changeset/138224>
WebKit Review Bot
Comment 8 2012-12-19 21:51:46 PST
All reviewed patches have been landed. Closing bug.
Ryosuke Niwa
Comment 9 2012-12-20 14:43:08 PST
I’m seeing another crash on /media/track/track-prefer-captions-crash.html: http://build.webkit.org/results/Apple%20MountainLion%20Release%20WK1%20(Tests)/r138293%20(5052)/media/track/track-prefer-captions-crash-log.txt 0 com.apple.WebCore 0x0000000106c50933 WebCore::HTMLMediaElement::removeTrack(WebCore::TextTrack*) + 67 (HTMLMediaElement.cpp:2805) 1 com.apple.WebCore 0x0000000106c50e7d WebCore::HTMLMediaElement::didRemoveTrack(WebCore::HTMLTrackElement*) + 93 (HTMLMediaElement.cpp:4267) 2 com.apple.WebCore 0x0000000106c9a6a5 WebCore::HTMLTrackElement::removedFrom(WebCore::ContainerNode*) + 85 (HTMLTrackElement.cpp:92) 3 com.apple.WebCore 0x00000001068ff346 WebCore::Private::NodeRemovalDispatcher<WebCore::Node, WebCore::ContainerNode, true>::dispatch(WebCore::Node*, WebCore::ContainerNode*) + 70 (Node.h:724) 4 com.apple.WebCore 0x00000001068fecca void WebCore::removeAllChildrenInContainer<WebCore::Node, WebCore::ContainerNode>(WebCore::ContainerNode*) + 378 (TreeShared.h:77) 5 com.apple.WebCore 0x00000001069e854b WebCore::Document::removedLastRef() + 539 (OwnPtr.h:72) 6 com.apple.WebCore 0x0000000106f458cb WebCore::JSNodeOwner::finalize(JSC::Handle<JSC::Unknown>, void*) + 59 (JSNode.h:69) 7 com.apple.JavaScriptCore 0x0000000106255f4c JSC::WeakBlock::sweep() + 108 (WeakImpl.h:84) 8 com.apple.JavaScriptCore 0x00000001062562b8 JSC::WeakSet::sweep() + 40 (DoublyLinkedList.h:118) 9 com.apple.JavaScriptCore 0x000000010618d2d8 JSC::MarkedBlock::sweep(JSC::MarkedBlock::SweepMode) + 24 (MarkedBlock.cpp:112) 10 com.apple.JavaScriptCore 0x0000000106254fa3 JSC::MarkedAllocator::allocateSlowCase(unsigned long) + 99 (MarkedAllocator.cpp:34) 11 com.apple.JavaScriptCore 0x000000010614a52d JSC::FunctionPrototype::create(JSC::ExecState*, JSC::JSGlobalObject*, JSC::Structure*) + 77 (MarkedAllocator.h:78) 12 com.apple.JavaScriptCore 0x0000000106145c21 JSC::JSGlobalObject::reset(JSC::JSValue) + 209 (JSGlobalObject.cpp:202) 13 com.apple.WebCore 0x0000000106e55ae3 WebCore::JSDOMWindowBase::finishCreation(JSC::JSGlobalData&, WebCore::JSDOMWindowShell*) + 35 (JSDOMWindowBase.cpp:69) 14 com.apple.WebCore 0x0000000106e5a53f WebCore::JSDOMWindow::create(JSC::JSGlobalData&, JSC::Structure*, WTF::PassRefPtr<WebCore::DOMWindow>, WebCore::JSDOMWindowShell*) + 175 (JSDOMWindow.h:42) 15 com.apple.WebCore 0x0000000106e5a23c WebCore::JSDOMWindowShell::setWindow(WTF::PassRefPtr<WebCore::DOMWindow>) + 380 (JSDOMWindowShell.cpp:75) 16 com.apple.WebCore 0x0000000107328124 WebCore::ScriptController::clearWindowShell(WebCore::DOMWindow*, bool) + 276 (PassRefPtr.h:68) 17 com.apple.WebCore 0x0000000106b8dfaf WebCore::FrameLoader::clear(WebCore::Document*, bool, bool, bool) + 271 (FrameLoader.cpp:568) 18 com.apple.WebCore 0x0000000106a14f71 WebCore::DocumentWriter::begin(WebCore::KURL const&, bool, WebCore::Document*) + 369 (DocumentWriter.cpp:135) 19 com.apple.WebCore 0x0000000106a04beb WebCore::DocumentLoader::commitData(char const*, unsigned long) + 91 (RefPtr.h:56) 20 com.apple.WebKit 0x000000010656c7b4 -[WebHTMLRepresentation receivedData:withDataSource:] + 100 (WebHTMLRepresentation.mm:186) 21 com.apple.WebKit 0x000000010653f49d -[WebDataSource(WebInternal) _receivedData:] + 77 (WebDataSource.mm:216) 22 com.apple.WebKit 0x00000001065574f7 WebFrameLoaderClient::committedLoad(WebCore::DocumentLoader*, char const*, int) + 103 (WebFrameLoaderClient.mm:841) 23 com.apple.WebCore 0x0000000106a04e30 WebCore::DocumentLoader::commitLoad(char const*, int) + 144 (RefCounted.h:148) 24 com.apple.WebCore 0x00000001070ef173 WebCore::MainResourceLoader::dataReceived(WebCore::CachedResource*, char const*, int) + 787 (MainResourceLoader.cpp:497) 25 com.apple.WebCore 0x00000001068bb5c5 WebCore::CachedRawResource::data(WTF::PassRefPtr<WebCore::ResourceBuffer>, bool) + 309 (CachedRawResource.cpp:70) 26 com.apple.WebCore 0x00000001073ff1fa WebCore::SubresourceLoader::sendDataToResource(char const*, int) + 122 (PassRefPtr.h:68) 27 com.apple.WebCore 0x00000001073ff2dc WebCore::SubresourceLoader::didReceiveData(char const*, int, long long, bool) + 76 (ResourceLoader.h:142) 28 com.apple.WebCore 0x0000000107308c38 WebCore::ResourceLoader::didReceiveData(WebCore::ResourceHandle*, char const*, int, int) + 136 (InspectorInstrumentation.h:260) 29 com.apple.Foundation 0x00007fff87ee6f58 __65-[NSURLConnectionInternal _withConnectionAndDelegate:onlyActive:]_block_invoke_0 + 28 30 com.apple.Foundation 0x00007fff87ee6e9c -[NSURLConnectionInternal _withConnectionAndDelegate:onlyActive:] + 227 31 com.apple.Foundation 0x00007fff87ee6d98 -[NSURLConnectionInternal _withActiveConnectionAndDelegate:] + 63 32 com.apple.Foundation 0x00007fff87ee992b _NSURLConnectionDidReceiveData_LengthReceived + 86 33 com.apple.CFNetwork 0x00007fff8971d7b1 ___delegate_didReceiveDataArray_block_invoke_0 + 132 34 com.apple.CFNetwork 0x00007fff89710753 ___withDelegateAsync_block_invoke_0 + 90 35 com.apple.CFNetwork 0x00007fff8979f2ca __block_global_1 + 28 36 com.apple.CoreFoundation 0x00007fff92f8c724 CFArrayApplyFunction + 68 37 com.apple.CFNetwork 0x00007fff89701a6c RunloopBlockContext::perform() + 126 38 com.apple.CFNetwork 0x00007fff8970194b MultiplexerSource::perform() + 221 39 com.apple.CoreFoundation 0x00007fff92f6e101 __CFRUNLOOP_IS_CALLING_OUT_TO_A_SOURCE0_PERFORM_FUNCTION__ + 17 40 com.apple.CoreFoundation 0x00007fff92f6da25 __CFRunLoopDoSources0 + 245 41 com.apple.CoreFoundation 0x00007fff92f90dc5 __CFRunLoopRun + 789 42 com.apple.CoreFoundation 0x00007fff92f906b2 CFRunLoopRunSpecific + 290 43 com.apple.Foundation 0x00007fff87f6489e -[NSRunLoop(NSRunLoop) runMode:beforeDate:] + 268 44 DumpRenderTree 0x0000000105e714c9 runTest(std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> > const&) + 1624 (DumpRenderTree.mm:1378) 45 DumpRenderTree 0x0000000105e70c54 dumpRenderTree(int, char const**) + 1855 (DumpRenderTree.mm:842) 46 DumpRenderTree 0x0000000105e71832 main + 86 (DumpRenderTree.mm:927) 47 libdyld.dylib 0x00007fff89a677e1 start + 1
Ryosuke Niwa
Comment 10 2012-12-21 00:38:18 PST
Here's an interesting stack trace. Thread 0 Crashed:: Dispatch queue: com.apple.main-thread 0 com.apple.WebCore 0x000000010ce8f631 WebCore::TreeShared<WebCore::Node, WebCore::ContainerNode>::ref() + 161 (TreeShared.h:64) 1 com.apple.WebCore 0x000000010e02f8cc WebCore::Node::refEventTarget() + 28 (Node.cpp:848) 2 com.apple.WebCore 0x000000010d2da016 WebCore::EventTarget::ref() + 22 (EventTarget.h:105) 3 com.apple.WebCore 0x000000010d2d9ff2 void WTF::refIfNotNull<WebCore::EventTarget>(WebCore::EventTarget*) + 50 (PassRefPtr.h:48) 4 com.apple.WebCore 0x000000010d2d9fb4 WTF::PassRefPtr<WebCore::EventTarget>::PassRefPtr(WebCore::EventTarget*) + 36 (PassRefPtr.h:61) 5 com.apple.WebCore 0x000000010d2b733d WTF::PassRefPtr<WebCore::EventTarget>::PassRefPtr(WebCore::EventTarget*) + 29 (PassRefPtr.h:61) 6 com.apple.WebCore 0x000000010d74b56d WebCore::HTMLMediaElement::scheduleEvent(WTF::AtomicString const&) + 109 (HTMLMediaElement.cpp:639) 7 com.apple.WebCore 0x000000010d74fb5b WebCore::HTMLMediaElement::scheduleTimeupdateEvent(bool) + 171 (HTMLMediaElement.cpp:2718) 8 com.apple.WebCore 0x000000010d74cb53 WebCore::HTMLMediaElement::updateActiveTextTrackCues(float) + 1075 (HTMLMediaElement.cpp:1146) 9 com.apple.WebCore 0x000000010d750a63 WebCore::HTMLMediaElement::endIgnoringTrackDisplayUpdateRequests() + 163 (HTMLMediaElement.cpp:1385) 10 com.apple.WebCore 0x000000010d76d6ed WebCore::TrackDisplayUpdateScope::~TrackDisplayUpdateScope() + 109 (HTMLMediaElement.cpp:217) 11 com.apple.WebCore 0x000000010d75b6c5 WebCore::TrackDisplayUpdateScope::~TrackDisplayUpdateScope() + 21 (HTMLMediaElement.cpp:217) 12 com.apple.WebCore 0x000000010d754dd1 WebCore::HTMLMediaElement::removeTrack(WebCore::TextTrack*) + 129 (HTMLMediaElement.cpp:2809) 13 com.apple.WebCore 0x000000010d755417 WebCore::HTMLMediaElement::didRemoveTrack(WebCore::HTMLTrackElement*) + 423 (HTMLMediaElement.cpp:2928) 14 com.apple.WebCore 0x000000010d7b85d9 WebCore::HTMLTrackElement::removedFrom(WebCore::ContainerNode*) + 105 (HTMLTrackElement.cpp:88) 15 com.apple.WebCore 0x000000010d0917b2 WebCore::ChildNodeRemovalNotifier::notifyNodeRemovedFromDocument(WebCore::Node*) + 130 (ContainerNodeAlgorithms.h:239) 16 com.apple.WebCore 0x000000010d08ef9b WebCore::ChildNodeRemovalNotifier::notify(WebCore::Node*) + 59 (ContainerNodeAlgorithms.h:256) 17 com.apple.WebCore 0x000000010d091214 WebCore::Private::NodeRemovalDispatcher<WebCore::Node, WebCore::ContainerNode, true>::dispatch(WebCore::Node*, WebCore::ContainerNode*) + 116 (ContainerNodeAlgorithms.h:143) 18 com.apple.WebCore 0x000000010d09115b void WebCore::Private::addChildNodesToDeletionQueue<WebCore::Node, WebCore::ContainerNode>(WebCore::Node*&, WebCore::Node*&, WebCore::ContainerNode*) + 331 (ContainerNodeAlgorithms.h:183) 19 com.apple.WebCore 0x000000010d08e9fa void WebCore::removeAllChildrenInContainer<WebCore::Node, WebCore::ContainerNode>(WebCore::ContainerNode*) + 250 (ContainerNodeAlgorithms.h:104) 20 com.apple.WebCore 0x000000010d089b15 WebCore::ContainerNode::removeAllChildren() + 21 (ContainerNode.cpp:95) 21 com.apple.WebCore 0x000000010d29d070 WebCore::Document::removedLastRef() + 448 (Document.cpp:710) The problem is that we can't dispatch an event inside removedFrom(). When removedFrom is called, m_deletionHasBegun had already set to true and nobody can ref that node. We need to find some other way of fixing this bug.
Ryosuke Niwa
Comment 11 2012-12-21 00:49:24 PST
If we really do have a requirement to fire an event at this timing, then we need to invent a new class like ChildFrameDisconnector (see http://trac.webkit.org/changeset/116629) and use that instead.
Note You need to log in before you can comment on or make changes to this bug.