Bug 119621

Summary: ASSERTION FAILED: !(m_transitions.size() % 2) in WebCore::WhitespaceCollapsingState::startIgnoringSpaces
Product: WebKit Reporter: Renata Hodovan <rhodovan.u-szeged>
Component: Layout and RenderingAssignee: Nobody <webkit-unassigned>
Status: RESOLVED CONFIGURATION CHANGED    
Severity: Normal CC: bfulgham, leviw, mmaxfield, rniwa, webkit-bug-importer
Priority: P2 Keywords: InRadar
Version: 528+ (Nightly build)   
Hardware: PC   
OS: Linux   
Bug Depends on:    
Bug Blocks: 116980    
Attachments:
Description Flags
Test case none

Renata Hodovan
Reported 2013-08-09 05:13:44 PDT
The following svg tests fails on the above assertion check: <svg xmlns="http://www.w3.org/2000/svg" > <text font-family="MS Mincho" y="60 80 100 120 140 160 180 200"> <tspan>foo</tspan> </text> </svg> The backtrace: Program received signal SIGSEGV, Segmentation fault. b0x00007ffff56f53e4 in WTFCrash () at /home/reni/Data/REPOS/webkit_sec/Source/WTF/wtf/Assertions.cpp:342 342 *(int *)(uintptr_t)0xbbadbeef = 0; (gdb) bt #0 0x00007ffff56f53e4 in WTFCrash () at /home/reni/Data/REPOS/webkit_sec/Source/WTF/wtf/Assertions.cpp:342 #1 0x00007ffff485d428 in WebCore::startIgnoringSpaces (lineMidpointState=..., midpoint=...) at /home/reni/Data/REPOS/webkit_sec/Source/WebCore/rendering/RenderBlockLineLayout.cpp:444 #2 0x00007ffff485d54c in WebCore::ensureCharacterGetsLineBox (lineMidpointState=..., textParagraphSeparator=...) at /home/reni/Data/REPOS/webkit_sec/Source/WebCore/rendering/RenderBlockLineLayout.cpp:467 #3 0x00007ffff486bd06 in WebCore::RenderBlock::LineBreaker::nextSegmentBreak (this=0x7fffffffa2d0, resolver=..., lineInfo=..., renderTextInfo=..., lastFloatFromPreviousLine=0x0, consecutiveHyphenatedLines=0, wordMeasurements=...) at /home/reni/Data/REPOS/webkit_sec/Source/WebCore/rendering/RenderBlockLineLayout.cpp:3392 #4 0x00007ffff4868b66 in WebCore::RenderBlock::LineBreaker::nextLineBreak (this=0x7fffffffa2d0, resolver=..., lineInfo=..., renderTextInfo=..., lastFloatFromPreviousLine=0x0, consecutiveHyphenatedLines=0, wordMeasurements=...) at /home/reni/Data/REPOS/webkit_sec/Source/WebCore/rendering/RenderBlockLineLayout.cpp:2815 #5 0x00007ffff486359c in WebCore::RenderBlock::layoutRunsAndFloatsInRange (this=0x8b1878, layoutState=..., resolver=..., cleanLineStart=..., cleanLineBidiStatus=..., consecutiveHyphenatedLines=0) at /home/reni/Data/REPOS/webkit_sec/Source/WebCore/rendering/RenderBlockLineLayout.cpp:1845 #6 0x00007ffff4862093 in WebCore::RenderBlock::layoutRunsAndFloats (this=0x8b1878, layoutState=..., hasInlineChild=true) at /home/reni/Data/REPOS/webkit_sec/Source/WebCore/rendering/RenderBlockLineLayout.cpp:1614 #7 0x00007ffff48657ec in WebCore::RenderBlock::layoutInlineChildren (this=0x8b1878, relayoutChildren=true, repaintLogicalTop=..., repaintLogicalBottom=...) at /home/reni/Data/REPOS/webkit_sec/Source/WebCore/rendering/RenderBlockLineLayout.cpp:2189 #8 0x00007ffff4bd07b3 in WebCore::RenderBlock::forceLayoutInlineChildren (this=0x8b1878) at /home/reni/Data/REPOS/webkit_sec/Source/WebCore/rendering/RenderBlock.h:591 #9 0x00007ffff4bd2372 in WebCore::RenderSVGText::layout (this=0x8b1878) at /home/reni/Data/REPOS/webkit_sec/Source/WebCore/rendering/svg/RenderSVGText.cpp:417 #10 0x00007ffff4bde14e in WebCore::SVGRenderSupport::layoutChildren (start=0x8b7ac8, selfNeedsLayout=true) at /home/reni/Data/REPOS/webkit_sec/Source/WebCore/rendering/svg/SVGRenderSupport.cpp:275 #11 0x00007ffff4bcd519 in WebCore::RenderSVGRoot::layout (this=0x8b7ac8) at /home/reni/Data/REPOS/webkit_sec/Source/WebCore/rendering/svg/RenderSVGRoot.cpp:243 #12 0x00007ffff47e433d in WebCore::RenderObject::layoutIfNeeded (this=0x8b7ac8) at /home/reni/Data/REPOS/webkit_sec/Source/WebCore/rendering/RenderObject.h:704 #13 0x00007ffff48657aa in WebCore::RenderBlock::layoutInlineChildren (this=0x8945b8, relayoutChildren=true, repaintLogicalTop=..., repaintLogicalBottom=...) at /home/reni/Data/REPOS/webkit_sec/Source/WebCore/rendering/RenderBlockLineLayout.cpp:2187 #14 0x00007ffff4819ad2 in WebCore::RenderBlock::layoutBlock (this=0x8945b8, relayoutChildren=true, pageLogicalHeight=...) at /home/reni/Data/REPOS/webkit_sec/Source/WebCore/rendering/RenderBlock.cpp:1656 #15 0x00007ffff4818f05 in WebCore::RenderBlock::layout (this=0x8945b8) at /home/reni/Data/REPOS/webkit_sec/Source/WebCore/rendering/RenderBlock.cpp:1428 #16 0x00007ffff481e334 in WebCore::RenderBlock::layoutBlockChild (this=0x7b2dd8, child=0x8945b8, marginInfo=..., previousFloatLogicalBottom=..., maxFloatLogicalBottom=...) at /home/reni/Data/REPOS/webkit_sec/Source/WebCore/rendering/RenderBlock.cpp:2669 #17 0x00007ffff481df2d in WebCore::RenderBlock::layoutBlockChildren (this=0x7b2dd8, relayoutChildren=true, maxFloatLogicalBottom=...) at /home/reni/Data/REPOS/webkit_sec/Source/WebCore/rendering/RenderBlock.cpp:2604 #18 0x00007ffff4819af3 in WebCore::RenderBlock::layoutBlock (this=0x7b2dd8, relayoutChildren=true, pageLogicalHeight=...) at /home/reni/Data/REPOS/webkit_sec/Source/WebCore/rendering/RenderBlock.cpp:1658 #19 0x00007ffff4818f05 in WebCore::RenderBlock::layout (this=0x7b2dd8) at /home/reni/Data/REPOS/webkit_sec/Source/WebCore/rendering/RenderBlock.cpp:1428 #20 0x00007ffff481e334 in WebCore::RenderBlock::layoutBlockChild (this=0x76d4d8, child=0x7b2dd8, marginInfo=..., previousFloatLogicalBottom=..., maxFloatLogicalBottom=...) at /home/reni/Data/REPOS/webkit_sec/Source/WebCore/rendering/RenderBlock.cpp:2669 #21 0x00007ffff481df2d in WebCore::RenderBlock::layoutBlockChildren (this=0x76d4d8, relayoutChildren=true, maxFloatLogicalBottom=...) at /home/reni/Data/REPOS/webkit_sec/Source/WebCore/rendering/RenderBlock.cpp:2604 #22 0x00007ffff4819af3 in WebCore::RenderBlock::layoutBlock (this=0x76d4d8, relayoutChildren=true, pageLogicalHeight=...) at /home/reni/Data/REPOS/webkit_sec/Source/WebCore/rendering/RenderBlock.cpp:1658 #23 0x00007ffff4818f05 in WebCore::RenderBlock::layout (this=0x76d4d8) at /home/reni/Data/REPOS/webkit_sec/Source/WebCore/rendering/RenderBlock.cpp:1428 #24 0x00007ffff49cdf15 in WebCore::RenderView::layoutContent (this=0x76d4d8, state=...) at /home/reni/Data/REPOS/webkit_sec/Source/WebCore/rendering/RenderView.cpp:142 #25 0x00007ffff49cecd2 in WebCore::RenderView::layout (this=0x76d4d8) at /home/reni/Data/REPOS/webkit_sec/Source/WebCore/rendering/RenderView.cpp:327 #26 0x00007ffff467a63a in WebCore::FrameView::layout (this=0x774700, allowSubtree=true) at /home/reni/Data/REPOS/webkit_sec/Source/WebCore/page/FrameView.cpp:1327 #27 0x00007ffff41b2e8f in WebCore::Document::implicitClose (this=0x87bb10) at /home/reni/Data/REPOS/webkit_sec/Source/WebCore/dom/Document.cpp:2452 #28 0x00007ffff45b349f in WebCore::FrameLoader::checkCallImplicitClose (this=0x7b0a48) ---Type <return> to continue, or q <return> to quit--- at /home/reni/Data/REPOS/webkit_sec/Source/WebCore/loader/FrameLoader.cpp:844 #29 0x00007ffff45b3210 in WebCore::FrameLoader::checkCompleted (this=0x7b0a48) at /home/reni/Data/REPOS/webkit_sec/Source/WebCore/loader/FrameLoader.cpp:787 #30 0x00007ffff45b2f45 in WebCore::FrameLoader::finishedParsing (this=0x7b0a48) at /home/reni/Data/REPOS/webkit_sec/Source/WebCore/loader/FrameLoader.cpp:720 #31 0x00007ffff41b9e35 in WebCore::Document::finishedParsing (this=0x87bb10) at /home/reni/Data/REPOS/webkit_sec/Source/WebCore/dom/Document.cpp:4427 #32 0x00007ffff440ce97 in WebCore::HTMLConstructionSite::finishedParsing (this=0x7f31a8) at /home/reni/Data/REPOS/webkit_sec/Source/WebCore/html/parser/HTMLConstructionSite.cpp:348 #33 0x00007ffff44415b9 in WebCore::HTMLTreeBuilder::finished (this=0x7f3190) at /home/reni/Data/REPOS/webkit_sec/Source/WebCore/html/parser/HTMLTreeBuilder.cpp:2926 #34 0x00007ffff4414596 in WebCore::HTMLDocumentParser::end (this=0x774fd0) at /home/reni/Data/REPOS/webkit_sec/Source/WebCore/html/parser/HTMLDocumentParser.cpp:763 #35 0x00007ffff4414681 in WebCore::HTMLDocumentParser::attemptToRunDeferredScriptsAndEnd (this=0x774fd0) at /home/reni/Data/REPOS/webkit_sec/Source/WebCore/html/parser/HTMLDocumentParser.cpp:774 #36 0x00007ffff44131f0 in WebCore::HTMLDocumentParser::prepareToStopParsing (this=0x774fd0) at /home/reni/Data/REPOS/webkit_sec/Source/WebCore/html/parser/HTMLDocumentParser.cpp:211 #37 0x00007ffff44146c6 in WebCore::HTMLDocumentParser::attemptToEnd (this=0x774fd0) at /home/reni/Data/REPOS/webkit_sec/Source/WebCore/html/parser/HTMLDocumentParser.cpp:786 #38 0x00007ffff441477f in WebCore::HTMLDocumentParser::finish (this=0x774fd0) at /home/reni/Data/REPOS/webkit_sec/Source/WebCore/html/parser/HTMLDocumentParser.cpp:835 #39 0x00007ffff45aada5 in WebCore::DocumentWriter::end (this=0x694190) at /home/reni/Data/REPOS/webkit_sec/Source/WebCore/loader/DocumentWriter.cpp:248 #40 0x00007ffff459d8e4 in WebCore::DocumentLoader::finishedLoading (this=0x6940f0, finishTime=0) at /home/reni/Data/REPOS/webkit_sec/Source/WebCore/loader/DocumentLoader.cpp:402 #41 0x00007ffff459d652 in WebCore::DocumentLoader::notifyFinished (this=0x6940f0, resource=0x7a95c0) at /home/reni/Data/REPOS/webkit_sec/Source/WebCore/loader/DocumentLoader.cpp:344 #42 0x00007ffff4584948 in WebCore::CachedResource::checkNotify (this=0x7a95c0) at /home/reni/Data/REPOS/webkit_sec/Source/WebCore/loader/cache/CachedResource.cpp:369 #43 0x00007ffff4584a1e in WebCore::CachedResource::finishLoading (this=0x7a95c0) at /home/reni/Data/REPOS/webkit_sec/Source/WebCore/loader/cache/CachedResource.cpp:385 #44 0x00007ffff4581170 in WebCore::CachedRawResource::finishLoading (this=0x7a95c0, data=0x765080) at /home/reni/Data/REPOS/webkit_sec/Source/WebCore/loader/cache/CachedRawResource.cpp:94 #45 0x00007ffff45e7765 in WebCore::SubresourceLoader::didFinishLoading (this=0x794f30, finishTime=0) at /home/reni/Data/REPOS/webkit_sec/Source/WebCore/loader/SubresourceLoader.cpp:282 #46 0x00007ffff45de04f in WebCore::ResourceLoader::didFinishLoading (this=0x794f30, finishTime=0) at /home/reni/Data/REPOS/webkit_sec/Source/WebCore/loader/ResourceLoader.cpp:488 #47 0x00007ffff4a878e3 in WebCore::QNetworkReplyHandler::finish (this=0x74a890) at /home/reni/Data/REPOS/webkit_sec/Source/WebCore/platform/network/qt/QNetworkReplyHandler.cpp:516 #48 0x00007ffff4a86602 in WebCore::QNetworkReplyHandlerCallQueue::flush (this=0x74a8c8) at /home/reni/Data/REPOS/webkit_sec/Source/WebCore/platform/network/qt/QNetworkReplyHandler.cpp:250 #49 0x00007ffff4a862ff in WebCore::QNetworkReplyHandlerCallQueue::push (this=0x74a8c8, method=(void (WebCore::QNetworkReplyHandler::*)(WebCore::QNetworkReplyHandler * const)) 0x7ffff4a87728 <WebCore::QNetworkReplyHandler::finish()>) at /home/reni/Data/REPOS/webkit_sec/Source/WebCore/platform/network/qt/QNetworkReplyHandler.cpp:216 #50 0x00007ffff4a8724c in WebCore::QNetworkReplyWrapper::didReceiveFinished (this=0x797130) at /home/reni/Data/REPOS/webkit_sec/Source/WebCore/platform/network/qt/QNetworkReplyHandler.cpp:409 #51 0x00007ffff4a89bde in WebCore::QNetworkReplyWrapper::qt_static_metacall (_o=0x797130, _c=QMetaObject::InvokeMetaMethod, _id=1, _a=0x7fffffffcf70) at .moc/release-shared/moc_QNetworkReplyHandler.cpp:176 #52 0x00007ffff22115cb in QMetaObject::activate(QObject*, int, int, void**) () from /usr/local/Trolltech/Qt5/Qt-5.0.0-r40/lib/libQt5Core.so.5 #53 0x00007ffff221284e in QObject::event(QEvent*) () from /usr/local/Trolltech/Qt5/Qt-5.0.0-r40/lib/libQt5Core.so.5 #54 0x00007ffff3058dbc in QApplicationPrivate::notify_helper(QObject*, QEvent*) () from /usr/local/Trolltech/Qt5/Qt-5.0.0-r40/lib/libQt5Widgets.so.5 #55 0x00007ffff305c075 in QApplication::notify(QObject*, QEvent*) () from /usr/local/Trolltech/Qt5/Qt-5.0.0-r40/lib/libQt5Widgets.so.5 #56 0x00007ffff21ecdbe in QCoreApplication::notifyInternal(QObject*, QEvent*) () from /usr/local/Trolltech/Qt5/Qt-5.0.0-r40/lib/libQt5Core.so.5 #57 0x00007ffff21eea76 in QCoreApplicationPrivate::sendPostedEvents(QObject*, int, QThreadData*) () from /usr/local/Trolltech/Qt5/Qt-5.0.0-r40/lib/libQt5Core.so.5 #58 0x00007ffff2234333 in ?? () from /usr/local/Trolltech/Qt5/Qt-5.0.0-r40/lib/libQt5Core.so.5 #59 0x00007fffee3790a6 in g_main_dispatch (context=0x6632f0) at /build/buildd/glib2.0-2.37.3/./glib/gmain.c:3058 ---Type <return> to continue, or q <return> to quit--- #60 g_main_context_dispatch (context=context@entry=0x6632f0) at /build/buildd/glib2.0-2.37.3/./glib/gmain.c:3634 #61 0x00007fffee3793f8 in g_main_context_iterate (context=context@entry=0x6632f0, block=block@entry=1, dispatch=dispatch@entry=1, self=<optimized out>) at /build/buildd/glib2.0-2.37.3/./glib/gmain.c:3705 #62 0x00007fffee37949c in g_main_context_iteration (context=0x6632f0, may_block=1) at /build/buildd/glib2.0-2.37.3/./glib/gmain.c:3766 #63 0x00007ffff22344bc in QEventDispatcherGlib::processEvents(QFlags<QEventLoop::ProcessEventsFlag>) () from /usr/local/Trolltech/Qt5/Qt-5.0.0-r40/lib/libQt5Core.so.5 #64 0x00007ffff21ebd3b in QEventLoop::exec(QFlags<QEventLoop::ProcessEventsFlag>) () from /usr/local/Trolltech/Qt5/Qt-5.0.0-r40/lib/libQt5Core.so.5 #65 0x00007ffff21ef120 in QCoreApplication::exec() () from /usr/local/Trolltech/Qt5/Qt-5.0.0-r40/lib/libQt5Core.so.5 #66 0x0000000000421ba0 in launcherMain (app=...) at /home/reni/Data/REPOS/webkit_sec/Tools/QtTestBrowser/qttestbrowser.cpp:49 #67 0x0000000000423680 in main (argc=2, argv=0x7fffffffdc48) at /home/reni/Data/REPOS/webkit_sec/Tools/QtTestBrowser/qttestbrowser.cpp:318
Attachments
Test case (149 bytes, image/svg+xml)
2013-08-09 05:14 PDT, Renata Hodovan 		no flags
Details
View All Add attachment proposed patch, testcase, etc.
Renata Hodovan
Comment 1 2013-08-09 05:14:45 PDT
Created attachment 208416 [details] Test case
Radar WebKit Bug Importer
Comment 2 2016-08-03 12:24:01 PDT
<rdar://problem/27683331>
Myles C. Maxfield
Comment 3 2018-01-16 11:39:25 PST
This doesn't seem to happen on r226920
Note You need to log in before you can comment on or make changes to this bug.