Bug 130352 – ASSERTION FAILED: (!child->renderer() || child->inNamedFlow()) || current.shadowRoot() in WebCore::Style::attachChildren

• Component: CSS
• Status: RESOLVED WORKSFORME

[Renata Hodovan]

Created attachment 226943 [details]
Test case

The test evoking the above assertion does not make too much sense but it reproduces the crash with 100% certainty. Since the test contains many filling 'A' characters, I don't paste it here but you can find it in the attachment.

Backtrace:

ASSERTION FAILED: (!child->renderer() || child->inNamedFlow()) || current.shadowRoot()
/home/reni2/data/REPOS/webkit_sec/Source/WebCore/style/StyleResolveTree.cpp(435) : void WebCore::Style::attachChildren(WebCore::ContainerNode&, WebCore::ContainerNode&)
1   0x7ffff5ed5075 WTFCrash
2   0x7ffff1a83541
3   0x7ffff1a8373d
4   0x7ffff1a83c3c
5   0x7ffff1a84314
6   0x7ffff1a848b1
7   0x7ffff1a846be
8   0x7ffff1a8493d
9   0x7ffff1a84a71
10  0x7ffff1a84a71
11  0x7ffff1a84d08 WebCore::Style::resolveTree(WebCore::Document&, WebCore::Style::Change)
12  0x7ffff0f7bea4 WebCore::Document::recalcStyle(WebCore::Style::Change)
13  0x7ffff0f7c159 WebCore::Document::updateStyleIfNeeded()
14  0x7ffff0f7c257 WebCore::Document::updateLayout()
15  0x7ffff18d0e96 WebCore::RenderLayer::hitTest(WebCore::HitTestRequest const&, WebCore::HitTestLocation const&, WebCore::HitTestResult&)
16  0x7ffff1994988 WebCore::RenderView::hitTest(WebCore::HitTestRequest const&, WebCore::HitTestLocation const&, WebCore::HitTestResult&)
17  0x7ffff199494d WebCore::RenderView::hitTest(WebCore::HitTestRequest const&, WebCore::HitTestResult&)
18  0x7ffff0f804d1 WebCore::Document::prepareMouseEvent(WebCore::HitTestRequest const&, WebCore::LayoutPoint const&, WebCore::PlatformMouseEvent const&)
19  0x7ffff14ff2f4 WebCore::EventHandler::prepareMouseEvent(WebCore::HitTestRequest const&, WebCore::PlatformMouseEvent const&)
20  0x7ffff14fd330 WebCore::EventHandler::handleMouseMoveEvent(WebCore::PlatformMouseEvent const&, WebCore::HitTestResult*, bool)
21  0x7ffff14fce57 WebCore::EventHandler::mouseMoved(WebCore::PlatformMouseEvent const&)
22  0x7ffff7b48056 ewk_frame_feed_mouse_move
23  0x7ffff7b5cbef
24  0x7ffff7b5d5c5
25  0x7ffff6ca7272 evas_object_event_callback_call
26  0x7ffff6ca73b9 evas_object_event_callback_call
27  0x7ffff6cab382
28  0x7fffeb98fc36 ecore_event_evas_mouse_move
29  0x7ffff78d50e7 _ecore_event_call
30  0x7ffff78d9479
31  0x7ffff78d99c7 ecore_main_loop_begin

Program received signal SIGSEGV, Segmentation fault.
0x00007ffff5ed507a in WTFCrash () at /home/reni2/data/REPOS/webkit_sec/Source/WTF/wtf/Assertions.cpp:333
333	    *(int *)(uintptr_t)0xbbadbeef = 0;
(gdb) bt
#0  0x00007ffff5ed507a in WTFCrash () at /home/reni2/data/REPOS/webkit_sec/Source/WTF/wtf/Assertions.cpp:333
#1  0x00007ffff1a83541 in WebCore::Style::attachChildren (current=..., renderingParentNode=...)
    at /home/reni2/data/REPOS/webkit_sec/Source/WebCore/style/StyleResolveTree.cpp:435
#2  0x00007ffff1a8373d in WebCore::Style::attachDistributedChildren (insertionPoint=..., renderingParentNode=...)
    at /home/reni2/data/REPOS/webkit_sec/Source/WebCore/style/StyleResolveTree.cpp:468
#3  0x00007ffff1a83c3c in WebCore::Style::attachRenderTree (current=..., renderingParentNode=..., resolvedStyle=...)
    at /home/reni2/data/REPOS/webkit_sec/Source/WebCore/style/StyleResolveTree.cpp:553
#4  0x00007ffff1a84314 in WebCore::Style::resolveLocal (current=..., renderingParentNode=..., inheritedChange=WebCore::Style::Force)
    at /home/reni2/data/REPOS/webkit_sec/Source/WebCore/style/StyleResolveTree.cpp:679
#5  0x00007ffff1a848b1 in WebCore::Style::resolveTree (current=..., renderingParentNode=..., change=WebCore::Style::Force)
    at /home/reni2/data/REPOS/webkit_sec/Source/WebCore/style/StyleResolveTree.cpp:826
#6  0x00007ffff1a846be in WebCore::Style::resolveShadowTree (shadowRoot=..., change=WebCore::Style::Force)
    at /home/reni2/data/REPOS/webkit_sec/Source/WebCore/style/StyleResolveTree.cpp:734
#7  0x00007ffff1a8493d in WebCore::Style::resolveTree (current=..., renderingParentNode=..., change=WebCore::Style::Force)
    at /home/reni2/data/REPOS/webkit_sec/Source/WebCore/style/StyleResolveTree.cpp:834
#8  0x00007ffff1a84a71 in WebCore::Style::resolveTree (current=..., renderingParentNode=..., change=WebCore::Style::Force)
    at /home/reni2/data/REPOS/webkit_sec/Source/WebCore/style/StyleResolveTree.cpp:858
#9  0x00007ffff1a84a71 in WebCore::Style::resolveTree (current=..., renderingParentNode=..., change=WebCore::Style::Force)
    at /home/reni2/data/REPOS/webkit_sec/Source/WebCore/style/StyleResolveTree.cpp:858
#10 0x00007ffff1a84d08 in WebCore::Style::resolveTree (document=..., change=WebCore::Style::Force)
    at /home/reni2/data/REPOS/webkit_sec/Source/WebCore/style/StyleResolveTree.cpp:899
#11 0x00007ffff0f7bea4 in WebCore::Document::recalcStyle (this=0x74f390, change=WebCore::Style::Force)
    at /home/reni2/data/REPOS/webkit_sec/Source/WebCore/dom/Document.cpp:1770
#12 0x00007ffff0f7c159 in WebCore::Document::updateStyleIfNeeded (this=0x74f390)
    at /home/reni2/data/REPOS/webkit_sec/Source/WebCore/dom/Document.cpp:1818
#13 0x00007ffff0f7c257 in WebCore::Document::updateLayout (this=0x74f390) at /home/reni2/data/REPOS/webkit_sec/Source/WebCore/dom/Document.cpp:1837
#14 0x00007ffff18d0e96 in WebCore::RenderLayer::hitTest (this=0x9e2b70, request=..., hitTestLocation=..., result=...)
    at /home/reni2/data/REPOS/webkit_sec/Source/WebCore/rendering/RenderLayer.cpp:4594
#15 0x00007ffff1994988 in WebCore::RenderView::hitTest (this=0x8a68d0, request=..., location=..., result=...)
    at /home/reni2/data/REPOS/webkit_sec/Source/WebCore/rendering/RenderView.cpp:101
#16 0x00007ffff199494d in WebCore::RenderView::hitTest (this=0x8a68d0, request=..., result=...)
    at /home/reni2/data/REPOS/webkit_sec/Source/WebCore/rendering/RenderView.cpp:96
#17 0x00007ffff0f804d1 in WebCore::Document::prepareMouseEvent (this=0x74f390, request=..., documentPoint=..., event=...)
    at /home/reni2/data/REPOS/webkit_sec/Source/WebCore/dom/Document.cpp:3008
#18 0x00007ffff14ff2f4 in WebCore::EventHandler::prepareMouseEvent (this=0x77daf0, request=..., mev=...)
    at /home/reni2/data/REPOS/webkit_sec/Source/WebCore/page/EventHandler.cpp:2258
#19 0x00007ffff14fd330 in WebCore::EventHandler::handleMouseMoveEvent (this=0x77daf0, mouseEvent=..., hoveredNode=0x7fffffffc450, 
    onlyUpdateScrollbars=false) at /home/reni2/data/REPOS/webkit_sec/Source/WebCore/page/EventHandler.cpp:1820
#20 0x00007ffff14fce57 in WebCore::EventHandler::mouseMoved (this=0x77daf0, event=...)
    at /home/reni2/data/REPOS/webkit_sec/Source/WebCore/page/EventHandler.cpp:1737
#21 0x00007ffff7b48056 in ewk_frame_feed_mouse_move (ewkFrame=0x775570, moveEvent=0x7fffffffc7e0)
    at /home/reni2/data/REPOS/webkit_sec/Source/WebKit/efl/ewk/ewk_frame.cpp:953
#22 0x00007ffff7b5cbef in _ewk_view_smart_mouse_move (smartData=0x943930, moveEvent=0x7fffffffc7e0)
    at /home/reni2/data/REPOS/webkit_sec/Source/WebKit/efl/ewk/ewk_view.cpp:521
#23 0x00007ffff7b5d5c5 in _ewk_view_on_mouse_move (data=0x943930, eventInfo=0x7fffffffc7e0)
    at /home/reni2/data/REPOS/webkit_sec/Source/WebKit/efl/ewk/ewk_view.cpp:637
#24 0x00007ffff6ca7272 in evas_object_event_callback_call (obj=0x774db0, type=type@entry=EVAS_CALLBACK_MOUSE_MOVE, 
    event_info=event_info@entry=0x7fffffffc7e0, event_id=event_id@entry=486) at evas_callbacks.c:232
#25 0x00007ffff6ca73b9 in evas_object_event_callback_call (obj=obj@entry=0x775380, type=type@entry=EVAS_CALLBACK_MOUSE_MOVE, 
    event_info=event_info@entry=0x7fffffffc7e0, event_id=event_id@entry=486) at evas_callbacks.c:261
#26 0x00007ffff6cab382 in evas_event_feed_mouse_move (e=0x8a9210, x=536, y=547, timestamp=<optimized out>, data=<optimized out>) at evas_events.c:836
#27 0x00007fffeb98fc36 in ecore_event_evas_mouse_move (data=<optimized out>, type=<optimized out>, event=0xf914a0) at ecore_input_evas.c:238
#28 0x00007ffff78d50e7 in _ecore_call_handler_cb (event=<optimized out>, type=<optimized out>, data=<optimized out>, func=<optimized out>)
    at ecore_private.h:321
#29 _ecore_event_call () at ecore_events.c:559
---Type <return> to continue, or q <return> to quit---
#30 0x00007ffff78d9479 in _ecore_main_loop_iterate_internal (once_only=once_only@entry=0) at ecore_main.c:1922
#31 0x00007ffff78d99c7 in ecore_main_loop_begin () at ecore_main.c:956
#32 0x0000000000406866 in main (argc=2, argv=0x7fffffffda98) at /home/reni2/data/REPOS/webkit_sec/Tools/EWebLauncher/main.c:1002

[Brent Fulgham]

This issue no longer occurs under GuardMalloc or ASAN as of r204037. If you believe there is still a bug, please reopen this issue with a revised test case.