Bug 151020 – ASSERTION FAILED: resultAnimationElement.m_animatedType in WebCore::SVGAnimateElementBase::calculateAnimatedValue

• Component: SVG
• Status: RESOLVED CONFIGURATION CHANGED

[Renata Hodovan]

Created attachment 265047 [details]
Test

Load the attached test with debug MiniBrowser:

<svg>
    <textPath>
        <set attributeName="y"></set>
    </textPath>
</svg>


OS: Ubuntu 14.10 x86_64
Checked build: debug EFL
Checked version: 9fa8210


Backtrace:

ASSERTION FAILED: resultAnimationElement.m_animatedType
../../Source/WebCore/svg/SVGAnimateElementBase.cpp(106) : virtual void WebCore::SVGAnimateElementBase::calculateAnimatedValue(float, unsigned int, WebCore::SVGSMILElement*)
1   0x7f2db2c42e17 WTFCrash
2   0x7f2dba24e9f6 WebCore::SVGAnimateElementBase::calculateAnimatedValue(float, unsigned int, WebCore::SVGSMILElement*)
3   0x7f2dba27ef20 WebCore::SVGAnimationElement::updateAnimation(float, unsigned int, WebCore::SVGSMILElement*)
4   0x7f2db98b4124 WebCore::SVGSMILElement::progress(WebCore::SMILTime, WebCore::SVGSMILElement*, bool)
5   0x7f2db98a789a WebCore::SMILTimeContainer::updateAnimations(WebCore::SMILTime, bool)
6   0x7f2db98a6ba5 WebCore::SMILTimeContainer::begin()
7   0x7f2db981267b WebCore::SVGDocumentExtensions::startAnimations()
8   0x7f2db8d6f784 WebCore::Document::implicitClose()
9   0x7f2db91d4f67 WebCore::FrameLoader::checkCallImplicitClose()
10  0x7f2db91d4c9e WebCore::FrameLoader::checkCompleted()
11  0x7f2db91d4a0e WebCore::FrameLoader::finishedParsing()
12  0x7f2db8d796a0 WebCore::Document::finishedParsing()
13  0x7f2dba0e4187 WebCore::HTMLConstructionSite::finishedParsing()
14  0x7f2db90cd7a4 WebCore::HTMLTreeBuilder::finished()
15  0x7f2db909de48 WebCore::HTMLDocumentParser::end()
16  0x7f2db909df21 WebCore::HTMLDocumentParser::attemptToRunDeferredScriptsAndEnd()
17  0x7f2db909cc03 WebCore::HTMLDocumentParser::prepareToStopParsing()
18  0x7f2db909df64 WebCore::HTMLDocumentParser::attemptToEnd()
19  0x7f2db909e01b WebCore::HTMLDocumentParser::finish()
20  0x7f2db91bfe42 WebCore::DocumentWriter::end()
21  0x7f2db91a9718 WebCore::DocumentLoader::finishedLoading(double)
22  0x7f2db91a9476 WebCore::DocumentLoader::notifyFinished(WebCore::CachedResource*)
23  0x7f2db9254883 WebCore::CachedResource::checkNotify()
24  0x7f2db9254992 WebCore::CachedResource::finishLoading(WebCore::SharedBuffer*)
25  0x7f2db9250b86 WebCore::CachedRawResource::finishLoading(WebCore::SharedBuffer*)
26  0x7f2db92195b4 WebCore::SubresourceLoader::didFinishLoading(double)
27  0x7f2db9214093 WebCore::ResourceLoader::didFinishLoading(WebCore::ResourceHandle*, double)
28  0x7f2db9a06fce
29  0x7f2db0a00cd6
30  0x7f2db0a272a4
31  0x7f2db0a272c9
Aborted (core dumped)

Program terminated with signal SIGSEGV, Segmentation fault.
#0  0x00007f2db2c42e1c in WTFCrash () at ../../Source/WTF/wtf/Assertions.cpp:321
321     *(int *)(uintptr_t)0xbbadbeef = 0;
#0  0x00007f2db2c42e1c in WTFCrash () at ../../Source/WTF/wtf/Assertions.cpp:321
#1  0x00007f2dba24e9f6 in WebCore::SVGAnimateElementBase::calculateAnimatedValue (this=0x7f2da0ecc000, percentage=0, repeatCount=0, resultElement=0x7f2da0ecc000) at ../../Source/WebCore/svg/SVGAnimateElementBase.cpp:106
#2  0x00007f2dba27ef20 in WebCore::SVGAnimationElement::updateAnimation (this=0x7f2da0ecc000, percent=0, repeatCount=0, resultElement=0x7f2da0ecc000) at ../../Source/WebCore/svg/SVGAnimationElement.cpp:629
#3  0x00007f2db98b4124 in WebCore::SVGSMILElement::progress (this=0x7f2da0ecc000, elapsed=..., resultElement=0x7f2da0ecc000, seekToTime=false) at ../../Source/WebCore/svg/animation/SVGSMILElement.cpp:1120
#4  0x00007f2db98a789a in WebCore::SMILTimeContainer::updateAnimations (this=0x7f2da0fcf190, elapsed=..., seekToTime=false) at ../../Source/WebCore/svg/animation/SMILTimeContainer.cpp:296
#5  0x00007f2db98a6ba5 in WebCore::SMILTimeContainer::begin (this=0x7f2da0fcf190) at ../../Source/WebCore/svg/animation/SMILTimeContainer.cpp:138
#6  0x00007f2db981267b in WebCore::SVGDocumentExtensions::startAnimations (this=0x7f2da0ece000) at ../../Source/WebCore/svg/SVGDocumentExtensions.cpp:99
#7  0x00007f2db8d6f784 in WebCore::Document::implicitClose (this=0x7f2da0c26a40) at ../../Source/WebCore/dom/Document.cpp:2731
#8  0x00007f2db91d4f67 in WebCore::FrameLoader::checkCallImplicitClose (this=0x7f2da0ee5098) at ../../Source/WebCore/loader/FrameLoader.cpp:889
#9  0x00007f2db91d4c9e in WebCore::FrameLoader::checkCompleted (this=0x7f2da0ee5098) at ../../Source/WebCore/loader/FrameLoader.cpp:835
#10 0x00007f2db91d4a0e in WebCore::FrameLoader::finishedParsing (this=0x7f2da0ee5098) at ../../Source/WebCore/loader/FrameLoader.cpp:756
#11 0x00007f2db8d796a0 in WebCore::Document::finishedParsing (this=0x7f2da0c26a40) at ../../Source/WebCore/dom/Document.cpp:4897
#12 0x00007f2dba0e4187 in WebCore::HTMLConstructionSite::finishedParsing (this=0x7f2da0efe6e0) at ../../Source/WebCore/html/parser/HTMLConstructionSite.cpp:403
#13 0x00007f2db90cd7a4 in WebCore::HTMLTreeBuilder::finished (this=0x7f2da0efe6c0) at ../../Source/WebCore/html/parser/HTMLTreeBuilder.cpp:2937
#14 0x00007f2db909de48 in WebCore::HTMLDocumentParser::end (this=0x7f2da0c48cc0) at ../../Source/WebCore/html/parser/HTMLDocumentParser.cpp:393
#15 0x00007f2db909df21 in WebCore::HTMLDocumentParser::attemptToRunDeferredScriptsAndEnd (this=0x7f2da0c48cc0) at ../../Source/WebCore/html/parser/HTMLDocumentParser.cpp:402
#16 0x00007f2db909cc03 in WebCore::HTMLDocumentParser::prepareToStopParsing (this=0x7f2da0c48cc0) at ../../Source/WebCore/html/parser/HTMLDocumentParser.cpp:132
#17 0x00007f2db909df64 in WebCore::HTMLDocumentParser::attemptToEnd (this=0x7f2da0c48cc0) at ../../Source/WebCore/html/parser/HTMLDocumentParser.cpp:414
#18 0x00007f2db909e01b in WebCore::HTMLDocumentParser::finish (this=0x7f2da0c48cc0) at ../../Source/WebCore/html/parser/HTMLDocumentParser.cpp:442
#19 0x00007f2db91bfe42 in WebCore::DocumentWriter::end (this=0x7f2da0c249e0) at ../../Source/WebCore/loader/DocumentWriter.cpp:247
#20 0x00007f2db91a9718 in WebCore::DocumentLoader::finishedLoading (this=0x7f2da0c24940, finishTime=0) at ../../Source/WebCore/loader/DocumentLoader.cpp:437
#21 0x00007f2db91a9476 in WebCore::DocumentLoader::notifyFinished (this=0x7f2da0c24940, resource=0x7f2da0c36000) at ../../Source/WebCore/loader/DocumentLoader.cpp:384
#22 0x00007f2db9254883 in WebCore::CachedResource::checkNotify (this=0x7f2da0c36000) at ../../Source/WebCore/loader/cache/CachedResource.cpp:297
#23 0x00007f2db9254992 in WebCore::CachedResource::finishLoading (this=0x7f2da0c36000) at ../../Source/WebCore/loader/cache/CachedResource.cpp:313
#24 0x00007f2db9250b86 in WebCore::CachedRawResource::finishLoading (this=0x7f2da0c36000, data=0x7f2da0fb65c0) at ../../Source/WebCore/loader/cache/CachedRawResource.cpp:103
#25 0x00007f2db92195b4 in WebCore::SubresourceLoader::didFinishLoading (this=0x7f2da0c2fa80, finishTime=0) at ../../Source/WebCore/loader/SubresourceLoader.cpp:372
#26 0x00007f2db9214093 in WebCore::ResourceLoader::didFinishLoading (this=0x7f2da0c2fa80, finishTime=0) at ../../Source/WebCore/loader/ResourceLoader.cpp:638
#27 0x00007f2db9a06fce in WebCore::readCallback (asyncResult=0x12c79a0, data=0x7f2da0fbc660) at ../../Source/WebCore/platform/network/soup/ResourceHandleSoup.cpp:1341
#28 0x00007f2db0a00cd6 in async_ready_callback_wrapper (source_object=0x12099b0, res=0x12c79a0, user_data=0x7f2da0fbc660) at ginputstream.c:523
#29 0x00007f2db0a272a4 in g_task_return_now (task=0x12c79a0) at gtask.c:1077
#30 0x00007f2db0a272c9 in complete_in_idle_cb (task=0x12c79a0) at gtask.c:1086
#31 0x00007f2db085aebd in g_main_dispatch (context=0x12034a0) at gmain.c:3064
#32 g_main_context_dispatch (context=context@entry=0x12034a0) at gmain.c:3663
#33 0x00007f2db0fb1138 in _ecore_glib_select__locked (ecore_timeout=<optimized out>, efds=0x7ffe0894f720, wfds=0x7ffe0894f6a0, rfds=0x7ffe0894f620, ecore_fds=<optimized out>, ctx=<optimized out>) at lib/ecore/ecore_glib.c:172
#34 _ecore_glib_select (ecore_fds=<optimized out>, rfds=0x7ffe0894f620, wfds=0x7ffe0894f6a0, efds=0x7ffe0894f720, ecore_timeout=<optimized out>) at lib/ecore/ecore_glib.c:204
#35 0x00007f2db0fb4784 in _ecore_main_select (timeout=9.532824124368238e-130) at lib/ecore/ecore_main.c:1459
#36 0x00007f2db0fb5194 in _ecore_main_loop_iterate_internal (once_only=once_only@entry=0) at lib/ecore/ecore_main.c:1893
#37 0x00007f2db0fb5287 in ecore_main_loop_begin () at lib/ecore/ecore_main.c:983
#38 0x00007f2db2c9dd03 in WTF::RunLoop::run () at ../../Source/WTF/wtf/efl/RunLoopEfl.cpp:49
#39 0x00007f2db8af3fad in WebKit::ChildProcessMain<WebKit::WebProcess, WebKit::WebProcessMain> (argc=2, argv=0x7ffe0894fb58) at ../../Source/WebKit2/Shared/unix/ChildProcessMain.h:61
#40 0x00007f2db8af3bbb in WebKit::WebProcessMainUnix (argc=2, argv=0x7ffe0894fb58) at ../../Source/WebKit2/WebProcess/efl/WebProcessMainEfl.cpp:161
#41 0x00000000004008fa in main (argc=2, argv=0x7ffe0894fb58) at ../../Source/WebKit2/WebProcess/EntryPoint/unix/WebProcessMain.cpp:44

[Brent Fulgham]

This reproduces under r204037.

[Radar WebKit Bug Importer]

<rdar://problem/27710964>

[Ahmad Saleem]

Fixed in Blink by - https://src.chromium.org/viewvc/blink?view=revision&revision=189707

WebKit Source - https://github.com/WebKit/WebKit/blob/1c560f2f0a48c96b3c68110cc2e4a8a44a1aa9ae/Source/WebCore/svg/SVGTextContentElement.h#L109

Change from "SVGLengthMode::Other" to "SVGLengthMode::Width".

I am not sure if it is reproducible on production anymore, it might not since this commit got rid of issue of mismatch in two places here of this function "lengthModeForAnimatedLengthAttribute":

https://github.com/WebKit/WebKit/commit/4c53eb1e29f8c451411f0ef7f5f47d84adeb3118

[Ahmad Saleem]

I am not able to reproduce this using Debug MiniBrowser build based of WebKit 260676@main.

Marking this as “RESOLVED CONFIGURATION CHANGED”. Please reopen, if it is reproducible. Thanks!