Summary: | Acid3 crashes (ASSERT) after double-attach | ||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|
Product: | WebKit | Reporter: | Eric Seidel (no email) <eric> | ||||||||
Component: | New Bugs | Assignee: | Nobody <webkit-unassigned> | ||||||||
Status: | RESOLVED FIXED | ||||||||||
Severity: | Normal | CC: | mitz, zimmermann | ||||||||
Priority: | P1 | ||||||||||
Version: | 528+ (Nightly build) | ||||||||||
Hardware: | Mac | ||||||||||
OS: | OS X 10.5 | ||||||||||
URL: | http://www.hixie.ch/tests/evil/acid/003/ | ||||||||||
Bug Depends on: | |||||||||||
Bug Blocks: | 17064 | ||||||||||
Attachments: |
|
Description
Eric Seidel (no email)
2008-01-28 23:51:32 PST
This only crashes when I load Acid3 from Hixie's website. Suggesting that this crash is dependent on some sub-resource. Created attachment 18766 [details]
reduced test case
Ha! I totally stumbled upon this reduction by accident.
Created attachment 18767 [details]
slightly more reduced test
I think this is the culprit: void SVGTextPathElement::buildPendingResource() { // FIXME: Real logic here! if (attached()) detach(); ASSERT(!attached()); attach(); } I'm not quite sure how we get a document inserted event, followed by another appendChild, since the document insertion and final append child should be the same line of code. The double attach callstacks: $19 = (class WebCore::Text * const) 0x1aa15f50 #0 WebCore::Text::attach (this=0x1aa15f50) at /Stuff/Projects/WebKit/WebCore/dom/Text.cpp:164 #1 0x01ab9713 in WebCore::ContainerNode::attach (this=0x1aa16910) at /Stuff/Projects/WebKit/WebCore/dom/ContainerNode.cpp:630 #2 0x01b731a2 in WebCore::Element::attach (this=0x1aa16910) at /Stuff/Projects/WebKit/WebCore/dom/Element.cpp:681 #3 0x01f3c0f8 in WebCore::SVGTextPathElement::buildPendingResource (this=0x1aa16910) at /Stuff/Projects/WebKit/WebCore/svg/SVGTextPathElement.cpp:113 #4 0x01f3d60d in WebCore::SVGTextPathElement::insertedIntoDocument (this=0x1aa16910) at /Stuff/Projects/WebKit/WebCore/svg/SVGTextPathElement.cpp:103 #5 0x01ab8836 in WebCore::ContainerNode::insertedIntoDocument (this=0x1aa13f00) at /Stuff/Projects/WebKit/WebCore/dom/ContainerNode.cpp:649 #6 0x01b70836 in WebCore::Element::insertedIntoDocument (this=0x1aa13f00) at /Stuff/Projects/WebKit/WebCore/dom/Element.cpp:652 #7 0x01ead7cb in WebCore::SVGElement::insertedIntoDocument (this=0x1aa13f00) at /Stuff/Projects/WebKit/WebCore/svg/SVGElement.cpp:193 #8 0x01aba3ac in dispatchChildInsertionEvents (child=0x1aa13f00, ec=@0xbfffda64) at /Stuff/Projects/WebKit/WebCore/dom/ContainerNode.cpp:914 #9 0x01abaaa3 in WebCore::ContainerNode::appendChild (this=0x18a3e730, newChild=@0xbfffda68, ec=@0xbfffda64) at /Stuff/Projects/WebKit/WebCore/dom/ContainerNode.cpp:541 #10 0x01d03c9a in WebCore::JSNode::appendChild (this=0x1a9a0ec0, exec=0xbfffdcf4, args=@0xbfffdb50) at /Stuff/Projects/WebKit/WebCore/bindings/js/JSNodeCustom.cpp:102 #11 0x01d01fd8 in WebCore::jsNodePrototypeFunctionAppendChild (exec=0xbfffdcf4, thisObj=0x1a9a0ec0, args=@0xbfffdb50) at /Stuff/Projects/build/Debug/DerivedSources/WebCore/JSNode.cpp:455 #12 0x0041f018 in KJS::PrototypeFunction::callAsFunction (this=0x1a9a0de0, exec=0xbfffdcf4, thisObj=0x1a9a0ec0, args=@0xbfffdb50) at function.cpp:882 #13 0x0043bbcc in KJS::JSObject::call (this=0x1a9a0de0, exec=0xbfffdcf4, thisObj=0x1a9a0ec0, args=@0xbfffdb50) at object.cpp:96 #14 0x004964b4 in KJS::FunctionCallDotNode::inlineEvaluate (this=0x1aa12090, exec=0xbfffdcf4) at nodes.cpp:1225 #15 0x00457a8c in KJS::FunctionCallDotNode::evaluate (this=0x1aa12090, exec=0xbfffdcf4) at nodes.cpp:1230 #16 0x00449e07 in KJS::ExprStatementNode::execute (this=0x1aa120b0, exec=0xbfffdcf4) at nodes.cpp:3719 #17 0x0042accd in statementListExecute (statements=@0x1aa15de0, exec=0xbfffdcf4) at nodes.cpp:3672 #18 0x0042ad5a in KJS::BlockNode::execute (this=0x1aa15dd0, exec=0xbfffdcf4) at nodes.cpp:3697 #19 0x004475f6 in KJS::ProgramNode::execute (this=0x1aa15dd0, exec=0xbfffdcf4) at nodes.cpp:4604 #20 0x00464d58 in KJS::Interpreter::evaluate (exec=0x3a06320, sourceURL=@0xbfffde2c, startingLineNumber=2, code=0x3a0b800, codeLength=415, thisV=0x1a9a0000) at interpreter.cpp:123 #21 0x01fef603 in WebCore::KJSProxy::evaluate (this=0x1a1dca40, filename=@0xbfffdeec, baseLine=2, str=@0xbfffdedc) at /Stuff/Projects/WebKit/WebCore/bindings/js/kjs_proxy.cpp:87 #22 0x01bc4222 in WebCore::FrameLoader::executeScript (this=0x38b1000, url=@0xbfffdeec, baseLine=2, script=@0xbfffdedc) at /Stuff/Projects/WebKit/WebCore/loader/FrameLoader.cpp:790 #23 0x01fb6e7b in WebCore::XMLTokenizer::endElementNs (this=0x18a3c050) at /Stuff/Projects/WebKit/WebCore/dom/XMLTokenizer.cpp:847 #24 0x01fb6f10 in endElementNsHandler (closure=0x18a4c900, localname=0x38c386c "script", prefix=0x0, uri=0x38c3847 "http://www.w3.org/2000/svg") at /Stuff/Projects/WebKit/WebCore/dom/XMLTokenizer.cpp:1032 #25 0x96dfb226 in xmlParseAttributeType () #26 0x96dd87ed in xmlParseChunk () #27 0x01fb3bef in WebCore::XMLTokenizer::write (this=0x18a3c050, s=@0xbfffe144) at /Stuff/Projects/WebKit/WebCore/dom/XMLTokenizer.cpp:623 #28 0x01bb873e in WebCore::FrameLoader::write (this=0x38b1000, str=0x3996c20 "<svg xmlns=\"http://www.w3.org/2000/svg\">\n <path id=\"path\" d=\"M0 0\"/>\n <script>\n <![CDATA[\n var svgns = \"http://www.w3.org/2000/svg\";\n var text = document.createElementNS(svgns, \"text\");"..., len=524, flush=false) at /Stuff/Projects/WebKit/WebCore/loader/FrameLoader.cpp:1028 #29 0x01bb8872 in WebCore::FrameLoader::addData (this=0x38b1000, bytes=0x3996c20 "<svg xmlns=\"http://www.w3.org/2000/svg\">\n <path id=\"path\" d=\"M0 0\"/>\n <script>\n <![CDATA[\n var svgns = \"http://www.w3.org/2000/svg\";\n var text = document.createElementNS(svgns, \"text\");"..., length=524) at /Stuff/Projects/WebKit/WebCore/loader/FrameLoader.cpp:1776 #30 0x01f9db88 in -[WebCoreFrameBridge addData:] (self=0x14c0a8e0, _cmd=0x227f923, data=0x14cad150) at /Stuff/Projects/WebKit/WebCore/page/mac/WebCoreFrameBridge.mm:295 #31 0x01fa2b4e in -[WebCoreFrameBridge receivedData:textEncodingName:] (self=0x14c0a8e0, _cmd=0x25568c, data=0x14cad150, textEncodingName=0x0) at /Stuff/Projects/WebKit/WebCore/page/mac/WebCoreFrameBridge.mm:1239 #32 0x001be2b6 in -[WebHTMLRepresentation receivedData:withDataSource:] (self=0x18a31b60, _cmd=0x25579a, data=0x14cad150, dataSource=0x18ade190) at /Stuff/Projects/WebKit/WebKit/mac/WebView/WebHTMLRepresentation.mm:173 #33 0x0019b342 in -[WebDataSource(WebInternal) _receivedData:] (self=0x18ade190, _cmd=0x23ae9d, data=0x14cad150) at /Stuff/Projects/WebKit/WebKit/mac/WebView/WebDataSource.mm:214 #34 0x001b1806 in WebFrameLoaderClient::committedLoad (this=0x14c19360, loader=0x39d9600, data=0x3996c20 "<svg xmlns=\"http://www.w3.org/2000/svg\">\n <path id=\"path\" d=\"M0 0\"/>\n <script>\n <![CDATA[\n var svgns = \"http://www.w3.org/2000/svg\";\n var text = document.createElementNS(svgns, \"text\");"..., length=524) at /Stuff/Projects/WebKit/WebKit/mac/WebCoreSupport/WebFrameLoaderClient.mm:700 #35 0x01bb399f in WebCore::FrameLoader::committedLoad (this=0x38b1000, loader=0x39d9600, data=0x3996c20 "<svg xmlns=\"http://www.w3.org/2000/svg\">\n <path id=\"path\" d=\"M0 0\"/>\n <script>\n <![CDATA[\n var svgns = \"http://www.w3.org/2000/svg\";\n var text = document.createElementNS(svgns, \"text\");"..., length=524) at /Stuff/Projects/WebKit/WebCore/loader/FrameLoader.cpp:3260 #36 0x01b57ce3 in WebCore::DocumentLoader::commitLoad (this=0x39d9600, data=0x3996c20 "<svg xmlns=\"http://www.w3.org/2000/svg\">\n <path id=\"path\" d=\"M0 0\"/>\n <script>\n <![CDATA[\n var svgns = \"http://www.w3.org/2000/svg\";\n var text = document.createElementNS(svgns, \"text\");"..., length=524) at /Stuff/Projects/WebKit/WebCore/loader/DocumentLoader.cpp:353 #37 0x01b57f02 in WebCore::DocumentLoader::receivedData (this=0x39d9600, data=0x3996c20 "<svg xmlns=\"http://www.w3.org/2000/svg\">\n <path id=\"path\" d=\"M0 0\"/>\n <script>\n <![CDATA[\n var svgns = \"http://www.w3.org/2000/svg\";\n var text = document.createElementNS(svgns, \"text\");"..., length=524) at /Stuff/Projects/WebKit/WebCore/loader/DocumentLoader.cpp:365 #38 0x01bb30a7 in WebCore::FrameLoader::receivedData (this=0x38b1000, data=0x3996c20 "<svg xmlns=\"http://www.w3.org/2000/svg\">\n <path id=\"path\" d=\"M0 0\"/>\n <script>\n <![CDATA[\n var svgns = \"http://www.w3.org/2000/svg\";\n var text = document.createElementNS(svgns, \"text\");"..., length=524) at /Stuff/Projects/WebKit/WebCore/loader/FrameLoader.cpp:2223 #39 0x01d8700a in WebCore::MainResourceLoader::addData (this=0x3969600, data=0x3996c20 "<svg xmlns=\"http://www.w3.org/2000/svg\">\n <path id=\"path\" d=\"M0 0\"/>\n <script>\n <![CDATA[\n var svgns = \"http://www.w3.org/2000/svg\";\n var text = document.createElementNS(svgns, \"text\");"..., length=524, allAtOnce=false) at /Stuff/Projects/WebKit/WebCore/loader/MainResourceLoader.cpp:138 #40 0x01e7e9a1 in WebCore::ResourceLoader::didReceiveData (this=0x3969600, data=0x3996c20 "<svg xmlns=\"http://www.w3.org/2000/svg\">\n <path id=\"path\" d=\"M0 0\"/>\n <script>\n <![CDATA[\n var svgns = \"http://www.w3.org/2000/svg\";\n var text = document.createElementNS(svgns, \"text\");"..., length=524, lengthReceived=524, allAtOnce=false) at /Stuff/Projects/WebKit/WebCore/loader/ResourceLoader.cpp:236 #41 0x01d87342 in WebCore::MainResourceLoader::didReceiveData (this=0x3969600, data=0x3996c20 "<svg xmlns=\"http://www.w3.org/2000/svg\">\n <path id=\"path\" d=\"M0 0\"/>\n <script>\n <![CDATA[\n var svgns = \"http://www.w3.org/2000/svg\";\n var text = document.createElementNS(svgns, \"text\");"..., length=524, lengthReceived=524, allAtOnce=false) at /Stuff/Projects/WebKit/WebCore/loader/MainResourceLoader.cpp:299 #42 0x01e7e578 in WebCore::ResourceLoader::didReceiveData (this=0x3969600, data=0x3996c20 "<svg xmlns=\"http://www.w3.org/2000/svg\">\n <path id=\"path\" d=\"M0 0\"/>\n <script>\n <![CDATA[\n var svgns = \"http://www.w3.org/2000/svg\";\n var text = document.createElementNS(svgns, \"text\");"..., length=524, lengthReceived=524) at /Stuff/Projects/WebKit/WebCore/loader/ResourceLoader.cpp:367 #43 0x01e7bdbd in -[WebCoreResourceHandleAsDelegate connection:didReceiveData:lengthReceived:] (self=0x18af43d0, _cmd=0x9407832c, con=0x18af4630, data=0x3996c00, lengthReceived=524) at /Stuff/Projects/WebKit/WebCore/platform/network/mac/ResourceHandleMac.mm:434 #44 0x94e28e57 in -[NSURLConnection(NSURLConnectionReallyInternal) sendDidReceiveData:originalLength:] () #45 0x94e28dbe in _NSURLConnectionDidReceiveData () #46 0x93850153 in sendDidReceiveDataCallback () #47 0x9384d807 in _CFURLConnectionSendCallbacks () #48 0x9384d1db in muxerSourcePerform () #49 0x935c164e in CFRunLoopRunSpecific () #50 0x935c1d38 in CFRunLoopRunInMode () #51 0x900348a4 in RunCurrentEventLoopInMode () #52 0x900345f6 in ReceiveNextEventCommon () #53 0x90034531 in BlockUntilNextEventMatchingListInMode () #54 0x952ced5b in _DPSNextEvent () #55 0x952ce6a0 in -[NSApplication nextEventMatchingMask:untilDate:inMode:dequeue:] () #56 0x00009d4e in ?? () #57 0x952c76d1 in -[NSApplication run] () #58 0x952949ba in NSApplicationMain () #59 0x00002876 in ?? () (gdb) continue $20 = (class WebCore::Text * const) 0x1aa15f50 #0 WebCore::Text::attach (this=0x1aa15f50) at /Stuff/Projects/WebKit/WebCore/dom/Text.cpp:164 #1 0x01ab9713 in WebCore::ContainerNode::attach (this=0x1aa16910) at /Stuff/Projects/WebKit/WebCore/dom/ContainerNode.cpp:630 #2 0x01b731a2 in WebCore::Element::attach (this=0x1aa16910) at /Stuff/Projects/WebKit/WebCore/dom/Element.cpp:681 #3 0x01ab9713 in WebCore::ContainerNode::attach (this=0x1aa13f00) at /Stuff/Projects/WebKit/WebCore/dom/ContainerNode.cpp:630 #4 0x01b731a2 in WebCore::Element::attach (this=0x1aa13f00) at /Stuff/Projects/WebKit/WebCore/dom/Element.cpp:681 #5 0x01abab1b in WebCore::ContainerNode::appendChild (this=0x18a3e730, newChild=@0xbfffda68, ec=@0xbfffda64) at /Stuff/Projects/WebKit/WebCore/dom/ContainerNode.cpp:545 #6 0x01d03c9a in WebCore::JSNode::appendChild (this=0x1a9a0ec0, exec=0xbfffdcf4, args=@0xbfffdb50) at /Stuff/Projects/WebKit/WebCore/bindings/js/JSNodeCustom.cpp:102 #7 0x01d01fd8 in WebCore::jsNodePrototypeFunctionAppendChild (exec=0xbfffdcf4, thisObj=0x1a9a0ec0, args=@0xbfffdb50) at /Stuff/Projects/build/Debug/DerivedSources/WebCore/JSNode.cpp:455 #8 0x0041f018 in KJS::PrototypeFunction::callAsFunction (this=0x1a9a0de0, exec=0xbfffdcf4, thisObj=0x1a9a0ec0, args=@0xbfffdb50) at function.cpp:882 #9 0x0043bbcc in KJS::JSObject::call (this=0x1a9a0de0, exec=0xbfffdcf4, thisObj=0x1a9a0ec0, args=@0xbfffdb50) at object.cpp:96 #10 0x004964b4 in KJS::FunctionCallDotNode::inlineEvaluate (this=0x1aa12090, exec=0xbfffdcf4) at nodes.cpp:1225 #11 0x00457a8c in KJS::FunctionCallDotNode::evaluate (this=0x1aa12090, exec=0xbfffdcf4) at nodes.cpp:1230 #12 0x00449e07 in KJS::ExprStatementNode::execute (this=0x1aa120b0, exec=0xbfffdcf4) at nodes.cpp:3719 #13 0x0042accd in statementListExecute (statements=@0x1aa15de0, exec=0xbfffdcf4) at nodes.cpp:3672 #14 0x0042ad5a in KJS::BlockNode::execute (this=0x1aa15dd0, exec=0xbfffdcf4) at nodes.cpp:3697 #15 0x004475f6 in KJS::ProgramNode::execute (this=0x1aa15dd0, exec=0xbfffdcf4) at nodes.cpp:4604 #16 0x00464d58 in KJS::Interpreter::evaluate (exec=0x3a06320, sourceURL=@0xbfffde2c, startingLineNumber=2, code=0x3a0b800, codeLength=415, thisV=0x1a9a0000) at interpreter.cpp:123 #17 0x01fef603 in WebCore::KJSProxy::evaluate (this=0x1a1dca40, filename=@0xbfffdeec, baseLine=2, str=@0xbfffdedc) at /Stuff/Projects/WebKit/WebCore/bindings/js/kjs_proxy.cpp:87 #18 0x01bc4222 in WebCore::FrameLoader::executeScript (this=0x38b1000, url=@0xbfffdeec, baseLine=2, script=@0xbfffdedc) at /Stuff/Projects/WebKit/WebCore/loader/FrameLoader.cpp:790 #19 0x01fb6e7b in WebCore::XMLTokenizer::endElementNs (this=0x18a3c050) at /Stuff/Projects/WebKit/WebCore/dom/XMLTokenizer.cpp:847 #20 0x01fb6f10 in endElementNsHandler (closure=0x18a4c900, localname=0x38c386c "script", prefix=0x0, uri=0x38c3847 "http://www.w3.org/2000/svg") at /Stuff/Projects/WebKit/WebCore/dom/XMLTokenizer.cpp:1032 #21 0x96dfb226 in xmlParseAttributeType () #22 0x96dd87ed in xmlParseChunk () #23 0x01fb3bef in WebCore::XMLTokenizer::write (this=0x18a3c050, s=@0xbfffe144) at /Stuff/Projects/WebKit/WebCore/dom/XMLTokenizer.cpp:623 #24 0x01bb873e in WebCore::FrameLoader::write (this=0x38b1000, str=0x3996c20 "<svg xmlns=\"http://www.w3.org/2000/svg\">\n <path id=\"path\" d=\"M0 0\"/>\n <script>\n <![CDATA[\n var svgns = \"http://www.w3.org/2000/svg\";\n var text = document.createElementNS(svgns, \"text\");"..., len=524, flush=false) at /Stuff/Projects/WebKit/WebCore/loader/FrameLoader.cpp:1028 #25 0x01bb8872 in WebCore::FrameLoader::addData (this=0x38b1000, bytes=0x3996c20 "<svg xmlns=\"http://www.w3.org/2000/svg\">\n <path id=\"path\" d=\"M0 0\"/>\n <script>\n <![CDATA[\n var svgns = \"http://www.w3.org/2000/svg\";\n var text = document.createElementNS(svgns, \"text\");"..., length=524) at /Stuff/Projects/WebKit/WebCore/loader/FrameLoader.cpp:1776 #26 0x01f9db88 in -[WebCoreFrameBridge addData:] (self=0x14c0a8e0, _cmd=0x227f923, data=0x14cad150) at /Stuff/Projects/WebKit/WebCore/page/mac/WebCoreFrameBridge.mm:295 #27 0x01fa2b4e in -[WebCoreFrameBridge receivedData:textEncodingName:] (self=0x14c0a8e0, _cmd=0x25568c, data=0x14cad150, textEncodingName=0x0) at /Stuff/Projects/WebKit/WebCore/page/mac/WebCoreFrameBridge.mm:1239 #28 0x001be2b6 in -[WebHTMLRepresentation receivedData:withDataSource:] (self=0x18a31b60, _cmd=0x25579a, data=0x14cad150, dataSource=0x18ade190) at /Stuff/Projects/WebKit/WebKit/mac/WebView/WebHTMLRepresentation.mm:173 #29 0x0019b342 in -[WebDataSource(WebInternal) _receivedData:] (self=0x18ade190, _cmd=0x23ae9d, data=0x14cad150) at /Stuff/Projects/WebKit/WebKit/mac/WebView/WebDataSource.mm:214 #30 0x001b1806 in WebFrameLoaderClient::committedLoad (this=0x14c19360, loader=0x39d9600, data=0x3996c20 "<svg xmlns=\"http://www.w3.org/2000/svg\">\n <path id=\"path\" d=\"M0 0\"/>\n <script>\n <![CDATA[\n var svgns = \"http://www.w3.org/2000/svg\";\n var text = document.createElementNS(svgns, \"text\");"..., length=524) at /Stuff/Projects/WebKit/WebKit/mac/WebCoreSupport/WebFrameLoaderClient.mm:700 #31 0x01bb399f in WebCore::FrameLoader::committedLoad (this=0x38b1000, loader=0x39d9600, data=0x3996c20 "<svg xmlns=\"http://www.w3.org/2000/svg\">\n <path id=\"path\" d=\"M0 0\"/>\n <script>\n <![CDATA[\n var svgns = \"http://www.w3.org/2000/svg\";\n var text = document.createElementNS(svgns, \"text\");"..., length=524) at /Stuff/Projects/WebKit/WebCore/loader/FrameLoader.cpp:3260 #32 0x01b57ce3 in WebCore::DocumentLoader::commitLoad (this=0x39d9600, data=0x3996c20 "<svg xmlns=\"http://www.w3.org/2000/svg\">\n <path id=\"path\" d=\"M0 0\"/>\n <script>\n <![CDATA[\n var svgns = \"http://www.w3.org/2000/svg\";\n var text = document.createElementNS(svgns, \"text\");"..., length=524) at /Stuff/Projects/WebKit/WebCore/loader/DocumentLoader.cpp:353 #33 0x01b57f02 in WebCore::DocumentLoader::receivedData (this=0x39d9600, data=0x3996c20 "<svg xmlns=\"http://www.w3.org/2000/svg\">\n <path id=\"path\" d=\"M0 0\"/>\n <script>\n <![CDATA[\n var svgns = \"http://www.w3.org/2000/svg\";\n var text = document.createElementNS(svgns, \"text\");"..., length=524) at /Stuff/Projects/WebKit/WebCore/loader/DocumentLoader.cpp:365 #34 0x01bb30a7 in WebCore::FrameLoader::receivedData (this=0x38b1000, data=0x3996c20 "<svg xmlns=\"http://www.w3.org/2000/svg\">\n <path id=\"path\" d=\"M0 0\"/>\n <script>\n <![CDATA[\n var svgns = \"http://www.w3.org/2000/svg\";\n var text = document.createElementNS(svgns, \"text\");"..., length=524) at /Stuff/Projects/WebKit/WebCore/loader/FrameLoader.cpp:2223 #35 0x01d8700a in WebCore::MainResourceLoader::addData (this=0x3969600, data=0x3996c20 "<svg xmlns=\"http://www.w3.org/2000/svg\">\n <path id=\"path\" d=\"M0 0\"/>\n <script>\n <![CDATA[\n var svgns = \"http://www.w3.org/2000/svg\";\n var text = document.createElementNS(svgns, \"text\");"..., length=524, allAtOnce=false) at /Stuff/Projects/WebKit/WebCore/loader/MainResourceLoader.cpp:138 #36 0x01e7e9a1 in WebCore::ResourceLoader::didReceiveData (this=0x3969600, data=0x3996c20 "<svg xmlns=\"http://www.w3.org/2000/svg\">\n <path id=\"path\" d=\"M0 0\"/>\n <script>\n <![CDATA[\n var svgns = \"http://www.w3.org/2000/svg\";\n var text = document.createElementNS(svgns, \"text\");"..., length=524, lengthReceived=524, allAtOnce=false) at /Stuff/Projects/WebKit/WebCore/loader/ResourceLoader.cpp:236 #37 0x01d87342 in WebCore::MainResourceLoader::didReceiveData (this=0x3969600, data=0x3996c20 "<svg xmlns=\"http://www.w3.org/2000/svg\">\n <path id=\"path\" d=\"M0 0\"/>\n <script>\n <![CDATA[\n var svgns = \"http://www.w3.org/2000/svg\";\n var text = document.createElementNS(svgns, \"text\");"..., length=524, lengthReceived=524, allAtOnce=false) at /Stuff/Projects/WebKit/WebCore/loader/MainResourceLoader.cpp:299 #38 0x01e7e578 in WebCore::ResourceLoader::didReceiveData (this=0x3969600, data=0x3996c20 "<svg xmlns=\"http://www.w3.org/2000/svg\">\n <path id=\"path\" d=\"M0 0\"/>\n <script>\n <![CDATA[\n var svgns = \"http://www.w3.org/2000/svg\";\n var text = document.createElementNS(svgns, \"text\");"..., length=524, lengthReceived=524) at /Stuff/Projects/WebKit/WebCore/loader/ResourceLoader.cpp:367 #39 0x01e7bdbd in -[WebCoreResourceHandleAsDelegate connection:didReceiveData:lengthReceived:] (self=0x18af43d0, _cmd=0x9407832c, con=0x18af4630, data=0x3996c00, lengthReceived=524) at /Stuff/Projects/WebKit/WebCore/platform/network/mac/ResourceHandleMac.mm:434 #40 0x94e28e57 in -[NSURLConnection(NSURLConnectionReallyInternal) sendDidReceiveData:originalLength:] () #41 0x94e28dbe in _NSURLConnectionDidReceiveData () #42 0x93850153 in sendDidReceiveDataCallback () #43 0x9384d807 in _CFURLConnectionSendCallbacks () #44 0x9384d1db in muxerSourcePerform () #45 0x935c164e in CFRunLoopRunSpecific () #46 0x935c1d38 in CFRunLoopRunInMode () #47 0x900348a4 in RunCurrentEventLoopInMode () #48 0x900345f6 in ReceiveNextEventCommon () #49 0x90034531 in BlockUntilNextEventMatchingListInMode () #50 0x952ced5b in _DPSNextEvent () #51 0x952ce6a0 in -[NSApplication nextEventMatchingMask:untilDate:inMode:dequeue:] () #52 0x00009d4e in ?? () #53 0x952c76d1 in -[NSApplication run] () #54 0x952949ba in NSApplicationMain () #55 0x00002876 in ?? () " Created attachment 18774 [details]
Remove SVGTextPathElement::buildPendingResource to fix crash
LayoutTests/ChangeLog | 10 ++++++++++
.../svg/custom/textPath-assert-expected.txt | 1 +
LayoutTests/svg/custom/textPath-assert.svg | 17 +++++++++++++++++
WebCore/ChangeLog | 16 ++++++++++++++++
WebCore/svg/SVGTextPathElement.cpp | 12 ------------
WebCore/svg/SVGTextPathElement.h | 1 -
6 files changed, 44 insertions(+), 13 deletions(-)
|