Bug 156984

Summary: REGRESSION(r199964): Crashes with guard malloc
Product: WebKit Reporter: Antti Koivisto <koivisto>
Component: Layout and RenderingAssignee: Nobody <webkit-unassigned>
Status: RESOLVED FIXED    
Severity: Normal CC: commit-queue, ddkilzer, esprehn+autocc, glenn, kling, kondapallykalyan, ryanhaddad, simon.fraser, webkit-bug-importer
Priority: P2 Keywords: InRadar
Version: WebKit Nightly Build   
Hardware: Unspecified   
OS: Unspecified   
Attachments:
Description Flags
patch kling: review+

Description Antti Koivisto 2016-04-25 09:31:00 PDT 
Accessing deleted RenderStyle.

CRASHING TEST: css1/pseudo/firstline.html

Global Trace Buffer (reverse chronological seconds):
3.899656     CFNetwork                 	0x00007fff86a88553 TCP Conn 0x1836f6e00 event 1. err: 0
3.918368     CFNetwork                 	0x00007fff869f8f4b TCP Conn 0x1836f6e00 started
5.136279     CFNetwork                 	0x00007fff86b86ed7 Explicitly setting CF cookie storage singleton
5.138031     CFNetwork                 	0x00007fff86bbd8ad Explicitly setting cookie storage singleton

Thread 0 Crashed:: Dispatch queue: com.apple.main-thread
0   com.apple.WebCore             	0x000000010428a251 WebCore::RenderBlock::minLineHeightForReplacedRenderer(bool, WebCore::LayoutUnit) const + 65
1   com.apple.WebCore             	0x000000010364669c WebCore::LineWidth::updateAvailableWidth(WebCore::LayoutUnit) + 60
2   com.apple.WebCore             	0x000000010415deff WebCore::LineBreaker::nextLineBreak(WebCore::BidiResolverWithIsolate<WebCore::InlineIterator, WebCore::BidiRun, WebCore::BidiIsolatedRun>&, WebCore::LineInfo&, WebCore::LineLayoutState&, WebCore::RenderTextInfo&, WebCore::FloatingObject*, unsigned int, WTF::Vector<WebCore::WordMeasurement, 64ul, WTF::CrashOnOverflow, 16ul>&) + 207
3   com.apple.WebCore             	0x00000001042a674e WebCore::RenderBlockFlow::layoutRunsAndFloatsInRange(WebCore::LineLayoutState&, WebCore::BidiResolverWithIsolate<WebCore::InlineIterator, WebCore::BidiRun, WebCore::BidiIsolatedRun>&, WebCore::InlineIterator const&, WebCore::BidiStatus const&, unsigned int) + 862
4   com.apple.WebCore             	0x00000001042a4cc0 WebCore::RenderBlockFlow::layoutRunsAndFloats(WebCore::LineLayoutState&, bool) + 1200
5   com.apple.WebCore             	0x00000001042a9485 WebCore::RenderBlockFlow::layoutLineBoxes(bool, WebCore::LayoutUnit&, WebCore::LayoutUnit&) + 1845
6   com.apple.WebCore             	0x0000000104294c12 WebCore::RenderBlockFlow::layoutBlock(bool, WebCore::LayoutUnit) + 946
7   com.apple.WebCore             	0x00000001035e2346 WebCore::RenderBlock::layout() + 54
8   com.apple.WebCore             	0x00000001042969d3 WebCore::RenderBlockFlow::layoutBlockChild(WebCore::RenderBox&, WebCore::RenderBlockFlow::MarginInfo&, WebCore::LayoutUnit&, WebCore::LayoutUnit&) + 883
9   com.apple.WebCore             	0x00000001042958ec WebCore::RenderBlockFlow::layoutBlockChildren(bool, WebCore::LayoutUnit&) + 508
10  com.apple.WebCore             	0x0000000104294bfa WebCore::RenderBlockFlow::layoutBlock(bool, WebCore::LayoutUnit) + 922
11  com.apple.WebCore             	0x00000001035e2346 WebCore::RenderBlock::layout() + 54
12  com.apple.WebCore             	0x00000001042969d3 WebCore::RenderBlockFlow::layoutBlockChild(WebCore::RenderBox&, WebCore::RenderBlockFlow::MarginInfo&, WebCore::LayoutUnit&, WebCore::LayoutUnit&) + 883
13  com.apple.WebCore             	0x00000001042958ec WebCore::RenderBlockFlow::layoutBlockChildren(bool, WebCore::LayoutUnit&) + 508
14  com.apple.WebCore             	0x0000000104294bfa WebCore::RenderBlockFlow::layoutBlock(bool, WebCore::LayoutUnit) + 922
15  com.apple.WebCore             	0x00000001035e2346 WebCore::RenderBlock::layout() + 54
16  com.apple.WebCore             	0x00000001042969d3 WebCore::RenderBlockFlow::layoutBlockChild(WebCore::RenderBox&, WebCore::RenderBlockFlow::MarginInfo&, WebCore::LayoutUnit&, WebCore::LayoutUnit&) + 883
17  com.apple.WebCore             	0x00000001042958ec WebCore::RenderBlockFlow::layoutBlockChildren(bool, WebCore::LayoutUnit&) + 508
18  com.apple.WebCore             	0x0000000104294bfa WebCore::RenderBlockFlow::layoutBlock(bool, WebCore::LayoutUnit) + 922
19  com.apple.WebCore             	0x00000001035e2346 WebCore::RenderBlock::layout() + 54
20  com.apple.WebCore             	0x00000001035e21bd WebCore::RenderView::layout() + 765
21  com.apple.WebCore             	0x00000001035df781 WebCore::FrameView::layout(bool) + 2993
22  com.apple.WebCore             	0x00000001035de49a WebCore::Document::implicitClose() + 874
23  com.apple.WebCore             	0x00000001035ddcd3 WebCore::FrameLoader::checkCompleted() + 275
24  com.apple.WebCore             	0x00000001035dc9cb WebCore::FrameLoader::finishedParsing() + 123
25  com.apple.WebCore             	0x00000001035db7a6 WebCore::Document::finishedParsing() + 390
26  com.apple.WebCore             	0x00000001035b3f72 WebCore::HTMLDocumentParser::prepareToStopParsing() + 162
27  com.apple.WebCore             	0x00000001035b2d2a WebCore::DocumentWriter::end() + 58
28  com.apple.WebCore             	0x00000001035a490c WebCore::DocumentLoader::finishedLoading(double) + 268
29  com.apple.WebCore             	0x000000010363a159 WebCore::CachedResource::checkNotify() + 153
30  com.apple.WebCore             	0x00000001038f79c3 WebCore::CachedRawResource::finishLoading(WebCore::SharedBuffer*) + 227
31  com.apple.WebCore             	0x0000000103639feb WebCore::SubresourceLoader::didFinishLoading(double) + 1163
32  com.apple.WebKit              	0x00000001020a1af8 WebKit::WebResourceLoader::didReceiveWebResourceLoaderMessage(IPC::Connection&, IPC::MessageDecoder&) + 460
33  com.apple.WebKit              	0x0000000101ef382d IPC::Connection::dispatchMessage(std::__1::unique_ptr<IPC::MessageDecoder, std::__1::default_delete<IPC::MessageDecoder> >) + 127
34  com.apple.WebKit              	0x0000000101ef6196 IPC::Connection::dispatchOneMessage() + 126
35  com.apple.JavaScriptCore      	0x0000000103285535 WTF::RunLoop::performWork() + 437
36  com.apple.JavaScriptCore      	0x00000001032858e2 WTF::RunLoop::performWork(void*) + 34
37  com.apple.CoreFoundation      	0x00007fff894d7881 __CFRUNLOOP_IS_CALLING_OUT_TO_A_SOURCE0_PERFORM_FUNCTION__ + 17
38  com.apple.CoreFoundation      	0x00007fff894b6fbc __CFRunLoopDoSources0 + 556
39  com.apple.CoreFoundation      	0x00007fff894b64df __CFRunLoopRun + 927
40  com.apple.CoreFoundation      	0x00007fff894b5ed8 CFRunLoopRunSpecific + 296
41  com.apple.HIToolbox           	0x00007fff8f6e1935 RunCurrentEventLoopInMode + 235
42  com.apple.HIToolbox           	0x00007fff8f6e176f ReceiveNextEventCommon + 432
43  com.apple.HIToolbox           	0x00007fff8f6e15af _BlockUntilNextEventMatchingListInModeWithFilter + 71
44  com.apple.AppKit              	0x00007fff973b9efa _DPSNextEvent + 1067
45  com.apple.AppKit              	0x00007fff973b932a -[NSApplication _nextEventMatchingEventMask:untilDate:inMode:dequeue:] + 454
46  com.apple.AppKit              	0x00007fff973ade84 -[NSApplication run] + 682
47  com.apple.AppKit              	0x00007fff9737746c NSApplicationMain + 1176
48  libxpc.dylib                  	0x00007fff90afa194 _xpc_objc_main + 795
49  libxpc.dylib                  	0x00007fff90af8bbe xpc_main + 494
50  com.apple.WebKit.WebContent   	0x0000000101e377df 0x101e36000 + 6111
51  libdyld.dylib                 	0x00007fff82be85ad start + 1
Comment 1 Antti Koivisto 2016-04-25 09:35:23 PDT 
Created attachment 277255 [details]
patch
Comment 2 Andreas Kling 2016-04-25 09:44:11 PDT 
Comment on attachment 277255 [details]
patch

r=me
Comment 3 Antti Koivisto 2016-04-25 10:03:09 PDT 
https://trac.webkit.org/r200031
Comment 4 Radar WebKit Bug Importer 2016-04-26 01:24:06 PDT 
<rdar://problem/25926869>