Bug 17559 – REGRESSION(r30466): 15 out of 60 tests in fast/media crash under guard malloc

• Component: WebCore Misc.
• Status: RESOLVED FIXED

[Mark Rowe (bdash)]

$ run-webkit-tests -g --debug fast/media
Testing 60 test cases.
fast/media .............
fast/media/mq-compound-query-05.html -> crashed
.....................
fast/media/mq-min-constraint.html -> crashed
...
fast/media/mq-relative-constraints-02.html -> crashed
.
fast/media/mq-relative-constraints-03.html -> crashed
.
fast/media/mq-relative-constraints-04.html -> crashed
.
fast/media/mq-relative-constraints-05.html -> crashed
.
fast/media/mq-relative-constraints-06.html -> crashed
.
fast/media/mq-relative-constraints-07.html -> crashed
.
fast/media/mq-relative-constraints-08.html -> crashed
.
fast/media/mq-relative-constraints-09.html -> crashed
............
fast/media/mq-width-absolute-01.html -> crashed
.
fast/media/mq-width-absolute-02.html -> crashed
.
fast/media/mq-width-absolute-03.html -> crashed
.
fast/media/mq-width-absolute-04.html -> crashed
.
fast/media/viewport-media-query.html -> crashed

934.60s total testing time

45 test cases (75%) succeeded
15 test cases (25%) crashed
$

[Mark Rowe (bdash)]

<rdar://problem/5766945>

[Mark Rowe (bdash)]

Created attachment 19386 [details]
Crash log from one of the crashes

All of the crashes appear to have similar crash logs.

[Mark Rowe (bdash)]

The crash was introduced in r30466.

[Brent Fulgham]

I notice that if a place a breakpoint in CSSStyleSelector::addViewportDependentMediaQueryResult, the first time I enter the method m_viewportDependentMediaQueryResults has a size of zero.  After the append, the size is 1.  So far, so good.

The second time I hit the breakpoint, the size of m_viewportDependentMediaQueryResults is now 4277075694.

There seems to be a timing element; if I set the breakpoint and wait a while I can often run without error.  But if I move to a new page (with media content) and don't pause I get the crash.

[Jon Honeycutt]

It looks like m_viewportDependentMediaQueryResults is not initialized at the point that we start adding items to it. It should be initialized earlier in CSSStyleSelector's constructor.

[Brent Fulgham]

There seems to be some kind of access to the CSSStyleSelector after it is deallocated.  I keep hitting the destructor for a CSSStyleSelector (with particular address), then enter the constructor (with a new address).  I then enter the CSSStyleSelector::addViewportDependentMediaQueryResult for the original (destroyed) this pointer.  The elements are all in an uninitialized state, and then the program crashes.

[Dave Hyatt]

Created attachment 19457 [details]
Patch to fix the problem.

[Adam Roben (:aroben)]

Comment on attachment 19457 [details]
Patch to fix the problem.

r=me

[Mark Rowe (bdash)]

This was landed in r30670.