Bug 106414 – Assert triggered in SelectorChecker::checkOneSelector when scrollbar (e.g. :horizontal) selector is specified

• Component: CSS
• Status: RESOLVED FIXED

[Shinya Kawanaka]

Maybe it will be triggered when we specify any scrollbar related selectors.

SHOULD NEVER BE REACHED
../../third_party/WebKit/Source/WebCore/css/SelectorChecker.cpp(951) : bool WebCore::SelectorChecker::checkOneSelector(const WebCore::SelectorChecker::SelectorCheckingContext&, const SiblingTraversalStrategy&) const [with SiblingTraversalStrategy = WebCore::DOMSiblingTraversalStrategy]
1   0xcf91ba
2   0xcf4026
3   0xbadd7a
4   0xb937c3
5   0xb92b54
6   0xb93456
7   0xb93b93
8   0xb96378
9   0x10c20e7
10  0x1111487
11  0x10c1959
12  0x10c19b2
13  0xea5381
14  0xea55c5
15  0xe40e3f
16  0xe40c61
17  0xe28b5b
18  0xe285ac
19  0xe2916e
20  0x10673b9
21  0x90ddef
22  0x8fa366
23  0x92d5f2
24  0x92d75b
25  0x957eaa
26  0x957f08
27  0x9554b1
28  0x93e7ca
29  0x9395b1
30  0x1a87d4a
31  0x20a557e
Received signal 11
	base::debug::StackTrace::StackTrace() [0x5c76f4]
	base::debug::(anonymous namespace)::StackDumpSignalHandler() [0x5c73f5]
	<unknown> [0x7f1d324d44a0]
	WebCore::SelectorChecker::checkOneSelector<>() [0xcf91c4]
	WebCore::SelectorChecker::checkSelector() [0xcf4026]
	WebCore::StyleResolver::checkSelector() [0xbadd7a]
	WebCore::StyleResolver::collectMatchingRulesForList() [0xb937c3]
	WebCore::StyleResolver::collectMatchingRules() [0xb92b54]
	WebCore::StyleResolver::matchAuthorRules() [0xb93456]
	WebCore::StyleResolver::matchAllRules() [0xb93b93]
	WebCore::StyleResolver::styleForElement() [0xb96378]
	WebCore::Element::styleForRenderer() [0x10c20e7]
	WebCore::NodeRenderingContext::createRendererForElementIfNeeded() [0x1111487]
	WebCore::Element::createRendererIfNeeded() [0x10c1959]
	WebCore::Element::attach() [0x10c19b2]
	WebCore::executeTask() [0xea5381]
	WebCore::HTMLConstructionSite::executeQueuedTasks() [0xea55c5]
	WebCore::HTMLTreeBuilder::constructTreeFromAtomicToken() [0xe40e3f]
	WebCore::HTMLTreeBuilder::constructTreeFromToken() [0xe40c61]
	WebCore::HTMLDocumentParser::pumpTokenizer() [0xe28b5b]
	WebCore::HTMLDocumentParser::pumpTokenizerIfPossible() [0xe285ac]
	WebCore::HTMLDocumentParser::append() [0xe2916e]
	WebCore::DecodedDataDocumentParser::flush() [0x10673b9]
	WebCore::DocumentWriter::end() [0x90ddef]
	WebCore::DocumentLoader::finishedLoading() [0x8fa366]
	WebCore::MainResourceLoader::didFinishLoading() [0x92d5f2]
	WebCore::MainResourceLoader::notifyFinished() [0x92d75b]
	WebCore::CachedResource::checkNotify() [0x957eaa]
	WebCore::CachedResource::data() [0x957f08]
	WebCore::CachedRawResource::data() [0x9554b1]
	WebCore::SubresourceLoader::didFinishLoading() [0x93e7ca]
	WebCore::ResourceLoader::didFinishLoading() [0x9395b1]
	WebCore::ResourceHandleInternal::didFinishLoading() [0x1a87d4a]
	webkit_glue::WebURLLoaderImpl::Context::OnCompletedRequest() [0x20a557e]
	(anonymous namespace)::RequestProxy::NotifyCompletedRequest() [0x28870ca]
	base::internal::RunnableAdapter<>::Run() [0x288e1a8]
	base::internal::InvokeHelper<>::MakeItSo() [0x288da8d]
	base::internal::Invoker<>::Run() [0x288d1da]
	base::Callback<>::Run() [0x5c09ad]
	MessageLoop::RunTask() [0x24e531b]
	MessageLoop::DeferOrRunPendingTask() [0x24e5436]
	MessageLoop::DoWork() [0x24e5ca3]
	base::MessagePumpGlib::HandleDispatch() [0x2518bb9]
	(anonymous namespace)::WorkSourceDispatch() [0x25184e3]
	<unknown> [0x7f1d355cdd53]
	<unknown> [0x7f1d355ce0a0]
	<unknown> [0x7f1d355ce164]
	base::MessagePumpGlib::RunWithDispatcher() [0x2518868]
	base::MessagePumpGlib::Run() [0x2518c96]
	MessageLoop::RunInternal() [0x24e4f1f]
	MessageLoop::RunHandler() [0x24e4dd6]
	base::RunLoop::Run() [0x2504504]
	MessageLoop::Run() [0x24e470a]
	webkit_support::RunMessageLoop() [0x17e7012]
	TestShell::waitTestFinished() [0x44c079]
	TestShell::runFileTest() [0x44367a]
	runTest() [0x41f53c]
	main [0x42016b]
	<unknown> [0x7f1d324bf76d]
	<unknown> [0x41dd49]

[Shinya Kawanaka]

This is a repro case.

<style>
div:horizontal {
    min-width: 20px;
}
</style>

<div>

[Shinya Kawanaka]

Created attachment 181851 [details]
Patch

[Alexey Proskuryakov]

Comment on attachment 181851 [details]
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=181851&action=review

> LayoutTests/fast/css/scrollbar-crash.html:18
> +<p>When scrollbar related pseudo types are specfieid, ASSERT should not be triggered.</p>

Typo: specfieid

[Shinya Kawanaka]

Created attachment 182038 [details]
Patch for landing

[Shinya Kawanaka]

(In reply to comment #3)
> (From update of attachment 181851 [details])
> View in context: https://bugs.webkit.org/attachment.cgi?id=181851&action=review
> 
> > LayoutTests/fast/css/scrollbar-crash.html:18
> > +<p>When scrollbar related pseudo types are specfieid, ASSERT should not be triggered.</p>
> 
> Typo: specfieid

Thanks. Fixed in the latest patch.

[WebKit Review Bot]

Comment on attachment 182038 [details]
Patch for landing

Clearing flags on attachment: 182038

Committed r139267: <http://trac.webkit.org/changeset/139267>

[WebKit Review Bot]

All reviewed patches have been landed.  Closing bug.