Bug 113312 – REGRESSION(r146879): Multiple layout test crashes in WebCore::RenderListItem::updateListMarkerNumbers (Requested by yurys on #webkit).

• Component: New Bugs
• Status: RESOLVED FIXED

[WebKit Review Bot]

http://trac.webkit.org/changeset/146879 broke the build:
Multiple layout test crashes in WebCore::RenderListItem::updateListMarkerNumbers (Requested by yurys on #webkit).

This is an automatic bug report generated by the sheriff-bot. If this bug
report was created because of a flaky test, please file a bug for the flaky
test (if we don't already have one on file) and dup this bug against that bug
so that we can track how often these flaky tests case pain.

"Only you can prevent forest fires." -- Smokey the Bear

[WebKit Review Bot]

Created attachment 195090 [details]
ROLLOUT of r146879

Any committer can land this patch automatically by marking it commit-queue+.  The commit-queue will build and test the patch before landing to ensure that the rollout will be successful.  This process takes approximately 15 minutes.

If you would like to land the rollout faster, you can use the following command:

  webkit-patch land-attachment ATTACHMENT_ID

where ATTACHMENT_ID is the ID of this attachment.

[Yury Semikhatsky]

The change caused multiple layout tests to crash:
http://test-results.appspot.com/dashboards/flakiness_dashboard.html#group=%40ToT%20-%20chromium.org&showExpectations=true&tests=editing%2Fpasteboard%2Fdrag-list-item.html%2Cediting%2Fpasteboard%2Fpaste-list-002.html%2Cfast%2Fcss%2Fpseudo-required-optional-003.html%2Cfast%2Fcss%2Fpseudo-required-optional-004.html%2Cfast%2Fcss%2Fpseudo-required-optional-006.html%2Cfast%2Fcss%2Freadonly-pseudoclass-opera-003.html%2Cfast%2Fcss%2Freadonly-pseudoclass-opera-005.html%2Cfast%2Fdom%2Fassign-to-window-status.html%2Cfast%2Fforms%2FValidityState-001.html%2Cfast%2Fforms%2FValidityState-valueMissing-005.html%2Cfast%2Fforms%2FValidityState-valueMissing-009.html%2Cfast%2Fforms%2Fautofocus-attribute.html%2Cfast%2Fjs%2Fbitwise-and-on-undefined.html%2Cinspector%2Fdebugger%2Fdom-breakpoints.html

with exception like the following:
crash log for DumpRenderTree (pid 8124):
STDOUT: <empty>
STDERR: ASSERTION FAILED: listNode
STDERR: ../../third_party/WebKit/Source/WebCore/rendering/RenderListItem.cpp(474) : void WebCore::RenderListItem::updateListMarkerNumbers()
STDERR: 1   0x7f92002e2f81
STDERR: 2   0x7f92002e13b4
STDERR: 3   0x7f92003147b5
STDERR: 4   0x7f9200305963
STDERR: 5   0x7f920018496a
STDERR: 6   0x7f920026c40b
STDERR: 7   0x7f9200310080
STDERR: 8   0x7f92002d99e5
STDERR: 9   0x7f9200218181
STDERR: 10  0x7f92001f641c
STDERR: 11  0x7f9200181074
STDERR: 12  0x7f92002e1368
STDERR: 13  0x7f920031085d
STDERR: 14  0x7f9200310836
STDERR: 15  0x7f92004d6a6c
STDERR: 16  0x7f92003f5c24
STDERR: 17  0x7f920048b9fe
STDERR: 18  0x7f92003f5091
STDERR: 19  0x7f9201004222
STDERR: 20  0x7f9201386800
STDERR: 21  0x7f9201936c0d
STDERR: 22  0x7f9201936c8e
STDERR: 23  0x7f9206459657
STDERR: 24  0x7f920645d902
STDERR: 25  0x7f920645b4c7
STDERR: 26  0x7f9206459212
STDERR: 27  0x7f92063d82d6
STDERR: 28  0x7f92063dac58
STDERR: 29  0x10a65fd062ee
STDERR: Received signal 11 SEGV_MAPERR 0000bbadbeef
STDERR:  [0x7f9204c427f8] base::debug::StackTrace::StackTrace()
STDERR:  [0x7f9204c420ff] base::debug::(anonymous namespace)::StackDumpSignalHandler()
STDERR:  [0x7f91fcfcccb0] <unknown>
STDERR:  [0x7f92002e2f8b] WebCore::RenderListItem::updateListMarkerNumbers()
STDERR:  [0x7f92002e13b4] WebCore::RenderListItem::willBeRemovedFromTree()
STDERR:  [0x7f92003147b5] WebCore::RenderObjectChildList::removeChildNode()
STDERR:  [0x7f9200305963] WebCore::RenderObject::removeChild()
STDERR:  [0x7f920018496a] WebCore::RenderBlock::removeChild()
STDERR:  [0x7f920026c40b] WebCore::RenderObject::remove()
STDERR:  [0x7f9200310080] WebCore::RenderObject::willBeDestroyed()
STDERR:  [0x7f92002d99e5] WebCore::RenderLayerModelObject::willBeDestroyed()
STDERR:  [0x7f9200218181] WebCore::RenderBoxModelObject::willBeDestroyed()
STDERR:  [0x7f92001f641c] WebCore::RenderBox::willBeDestroyed()
STDERR:  [0x7f9200181074] WebCore::RenderBlock::willBeDestroyed()
STDERR:  [0x7f92002e1368] WebCore::RenderListItem::willBeDestroyed()
STDERR:  [0x7f920031085d] WebCore::RenderObject::destroy()
STDERR:  [0x7f9200310836] WebCore::RenderObject::destroyAndCleanupAnonymousWrappers()
STDERR:  [0x7f92004d6a6c] WebCore::Node::detach()
STDERR:  [0x7f92003f5c24] WebCore::ContainerNode::detach()
STDERR:  [0x7f920048b9fe] WebCore::Element::detach()
STDERR:  [0x7f92003f5091] WebCore::ContainerNode::removeChildren()
STDERR:  [0x7f9201004222] WebCore::replaceChildrenWithFragment()
STDERR:  [0x7f9201386800] WebCore::HTMLElement::setInnerHTML()
STDERR:  [0x7f9201936c0d] WebCore::HTMLElementV8Internal::innerHTMLAttrSetter()
STDERR:  [0x7f9201936c8e] WebCore::HTMLElementV8Internal::innerHTMLAttrSetterCallback()
STDERR:  [0x7f9206459657] v8::internal::JSObject::SetPropertyWithCallback()
STDERR:  [0x7f920645d902] v8::internal::JSObject::SetPropertyForResult()
STDERR:  [0x7f920645b4c7] v8::internal::JSReceiver::SetProperty()
STDERR:  [0x7f9206459212] v8::internal::JSReceiver::SetProperty()
STDERR:  [0x7f92063d82d6] v8::internal::StoreIC::Store()
STDERR:  [0x7f92063dac58] v8::internal::StoreIC_Miss()
STDERR:  [0x10a65fd062ee] <unknown>
STDERR:   r8: 00007f91f3ce9980  r9: 00007f92074a30d0 r10: 0000000000000001 r11: 0000000000000000
STDERR:  r12: 000038c3e181ca49 r13: 000038c3e19f3f41 r14: 0000000000000003 r15: 00007fff8c842270
STDERR:   di: 0000000000000000  si: 00000000efcdab90  bp: 00007fff8c841520  bx: 0000000000000000
STDERR:   dx: 00007f91fcfb8aa0  ax: 00000000bbadbeef  cx: 00007f91fcce491d  sp: 00007fff8c8414f0
STDERR:   ip: 00007f92002e2f8b efl: 0000000000010246 cgf: 0000000000000033 erf: 0000000000000006
STDERR:  trp: 000000000000000e msk: 0000000000000000 cr2: 00000000bbadbeef

[WebKit Review Bot]

Comment on attachment 195090 [details]
ROLLOUT of r146879

Clearing flags on attachment: 195090

Committed r146883: <http://trac.webkit.org/changeset/146883>

[WebKit Review Bot]

All reviewed patches have been landed.  Closing bug.

[Ryosuke Niwa]

You guys should improve the stack trace produced by Chromium bots... That stack trace is annoyingly unhelpful (e.g. it doesn't tell us line number or offset)