Bug 106711

Summary:

Flaky crash in AXObjectCache::notificationPostTimerFired running svg/as-image/img-relative-height.html

Product:

WebKit

Reporter:

Stephanie Lewis <slewis>

Component:

Accessibility

Assignee:

Nobody <webkit-unassigned>

Status:

RESOLVED DUPLICATE

Severity:

Normal

CC:

cfleizach, rniwa, slewis

Priority:

Version:

528+ (Nightly build)

Hardware:

Mac

OS:

Unspecified

Attachments:

Description	Flags
crash log	none

Stephanie Lewis

Reported 2013-01-11 15:38:46 PST

Occurs most often on Mountain Lion Debug WK1. Due to flakiness I'm not sure if it affects other platforms, or when it started. Occurs running svg/as-image/img-relative-height.html. Exception Type: EXC_BAD_ACCESS (SIGSEGV) Exception Codes: KERN_INVALID_ADDRESS at 0x0000000000000018 VM Regions Near 0x18: --> __TEXT 0000000105e71000-0000000105ed0000 [ 380K] r-x/rwx SM=COW /Volumes/VOLUME/* Application Specific Information: CRASHING TEST: svg/as-image/img-relative-height.html Thread 0 Crashed:: Dispatch queue: com.apple.main-thread 0 com.apple.WebCore 0x0000000106858f77 WebCore::AXObjectCache::notificationPostTimerFired(WebCore::Timer<WebCore::AXObjectCache>*) + 71 (AXObjectCache.cpp:615) 1 com.apple.WebCore 0x00000001075421df WebCore::ThreadTimers::sharedTimerFiredInternal() + 159 (ThreadTimers.cpp:119) 2 com.apple.WebCore 0x00000001073cbc23 WebCore::timerFired(__CFRunLoopTimer*, void*) + 51 (SharedTimerMac.mm:167) 3 com.apple.CoreFoundation 0x00007fff9396bda4 __CFRUNLOOP_IS_CALLING_OUT_TO_A_TIMER_CALLBACK_FUNCTION__ + 20 4 com.apple.CoreFoundation 0x00007fff9396b8bd __CFRunLoopDoTimer + 557 5 com.apple.CoreFoundation 0x00007fff93951099 __CFRunLoopRun + 1513 6 com.apple.CoreFoundation 0x00007fff939506b2 CFRunLoopRunSpecific + 290 7 com.apple.Foundation 0x00007fff8892489e -[NSRunLoop(NSRunLoop) runMode:beforeDate:] + 268 8 DumpRenderTree 0x0000000105e7eb10 runTest(std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> > const&) + 1639 (DumpRenderTree.mm:1383) 9 DumpRenderTree 0x0000000105e7e28c dumpRenderTree(int, char const**) + 1855 (DumpRenderTree.mm:847) 10 DumpRenderTree 0x0000000105e7ee79 main + 86 (DumpRenderTree.mm:932) 11 libdyld.dylib 0x00007fff8a4277e1 start + 1

Attachments
crash log (52.09 KB, text/plain) 2013-01-11 15:39 PST, Stephanie Lewis	no flags	Details
View All Add attachment proposed patch, testcase, etc.

Stephanie Lewis

Comment 1 2013-01-11 15:39:02 PST

Created attachment 182435 [details] crash log

Stephanie Lewis

Comment 2 2013-01-11 16:04:45 PST

just crashed on Lion Release WK1.

Alexey Proskuryakov

Comment 3 2013-01-11 16:32:08 PST

In bug 105601, another test is crashing with the same stack trace. But since it's a timer, this could also be a single test causing crashes in subsequent ones.

chris fleizach

Comment 4 2013-01-11 16:36:46 PST

yea definitely a dup *** This bug has been marked as a duplicate of bug 105601 ***

Ryosuke Niwa

Comment 5 2013-01-11 16:38:36 PST

*** This bug has been marked as a duplicate of bug 106106 ***

Note You need to log in before you can comment on or make changes to this bug.