Bug 108619

Summary: Assertion in RenderGeometryMap::mapToContainer with LayoutUnit overflow
Product: WebKit Reporter: Renata Hodovan <rhodovan.u-szeged>
Component: Layout and RenderingAssignee: zalan <zalan>
Status: RESOLVED FIXED    
Severity: Normal CC: commit-queue, eae, esprehn+autocc, glenn, jberlin, kondapallykalyan, leviw, simon.fraser, zalan
Priority: P2 Keywords: InRadar
Version: 528+ (Nightly build)   
Hardware: Unspecified   
OS: Unspecified   
Bug Depends on:    
Bug Blocks: 116980    
Attachments:
Description Flags
Repro
none
Patch
none
Patch none

Description Renata Hodovan 2013-02-01 05:23:52 PST
During CSS fuzzing I've got the following assertion faulire:

Program received signal SIGSEGV, Segmentation fault.
0x00007ffff5632d50 in WebCore::RenderGeometryMap::mapToContainer (this=0x7fffffffc7a0, rect=..., container=0x0)
    at /home/reni/repos/webkit2/Source/WebCore/rendering/RenderGeometryMap.cpp:142
142	    ASSERT(enclosingIntRect(rendererMappedResult) == enclosingIntRect(FloatQuad(result).boundingBox()));


The test:

<html id="test-element">
<head>
<style>
    #test-element {font-size: 354em;}
</style>

<body>

<div id="test-element" style="margin: 131em;"></div>
<div id=word style="-webkit-box-shadow: 2px -2px;position: absolute; margin:131em;"></div>

</body>
</html>


I've seen bugs (Qt: #89466, WIN: #88128) with similar issues but they are working for me right now.
Comment 1 Simon Fraser (smfr) 2013-02-01 09:13:37 PST
font-size: 354em;
This looks like layoutunit overflow.
Comment 2 Emil A Eklund 2013-02-01 10:32:46 PST
Simon is right, that is almost certainly due to overflow. Try to run with SATURATED_LAYOUT_ARITHMETIC enabled and see if it still happens.
Comment 3 Renata Hodovan 2014-09-08 04:18:54 PDT
Created attachment 237777 [details]
Repro

The original test case does not reproduce the issue anymore. However the attached one still does.
Comment 4 Renata Hodovan 2014-09-08 05:46:55 PDT
*** Bug 119627 has been marked as a duplicate of this bug. ***
Comment 5 Simon Fraser (smfr) 2014-11-09 20:08:40 PST
After the geometry map assertion, this asserts at:
ASSERTION FAILED: y2 >= y1
/Volumes/DataSSD/Development/apple/webkit/OpenSource/Source/WebCore/rendering/RenderObject.cpp(923) : void WebCore::RenderObject::drawLineForBoxSide(WebCore::GraphicsContext *, float, float, float, float, WebCore::BoxSide, WebCore::Color, WebCore::EBorderStyle, float, float, bool) const
1   0x1033c9870 WTFCrash
2   0x10615dc97 WebCore::RenderObject::drawLineForBoxSide(WebCore::GraphicsContext*, float, float, float, float, WebCore::BoxSide, WebCore::Color, WebCore::EBorderStyle, float, float, bool) const
3   0x10615d89f WebCore::RenderObject::drawLineForBoxSide(WebCore::GraphicsContext*, float, float, float, float, WebCore::BoxSide, WebCore::Color, WebCore::EBorderStyle, float, float, bool) const
4   0x10615fb5f WebCore::RenderObject::paintOutline(WebCore::PaintInfo&, WebCore::LayoutRect const&)
5   0x1061731be WebCore::RenderReplaced::paint(WebCore::PaintInfo&, WebCore::LayoutPoint const&)
6   0x106086afa WebCore::RenderImage::paint(WebCore::PaintInfo&, WebCore::LayoutPoint const&)
7   0x105f5dc20 WebCore::RenderBlock::paintChild(WebCore::RenderBox&, WebCore::PaintInfo&, WebCore::LayoutPoint const&, WebCore::PaintInfo&, bool)
8   0x105f5d857 WebCore::RenderBlock::paintChildren(WebCore::PaintInfo&, WebCore::LayoutPoint const&, WebCore::PaintInfo&, bool)

(lldb) p y1
(float) $1 = 5
(lldb) p y2
(float) $2 = -33554432
Comment 6 zalan 2015-01-05 20:39:47 PST
With certain (big enough)values, the following code fails   

FloatRect rect(big number, big number, big number, big number);
FloatQuad quad(rect);
assert(rect.size() == quad.size())

because FloatQuad stores top left bottom right values internally -> float approx. value -> rect.m_size != quad.FloatRect(left, top, right - left, bottom - top).m_size
Comment 7 zalan 2015-01-06 14:55:48 PST
rdar://problem/19391214
Comment 8 zalan 2015-01-06 15:34:10 PST
Created attachment 244102 [details]
Patch
Comment 9 Simon Fraser (smfr) 2015-01-06 15:46:22 PST
Comment on attachment 244102 [details]
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=244102&action=review

> LayoutTests/fast/block/geometry-map-assertion-with-tall-content.html:10
> +<![CDATA[ 
> +* {}
> +* {
> +    display:table-caption;
> +    outline-style:ridge;
> +    overflow-x:auto;    
> +}

This could be less crazy
Comment 10 zalan 2015-01-06 15:58:05 PST
Created attachment 244105 [details]
Patch
Comment 11 WebKit Commit Bot 2015-01-06 17:22:12 PST
Comment on attachment 244105 [details]
Patch

Clearing flags on attachment: 244105

Committed r178009: <http://trac.webkit.org/changeset/178009>
Comment 12 WebKit Commit Bot 2015-01-06 17:22:25 PST
All reviewed patches have been landed.  Closing bug.