|Summary:||REGRESSION(r30466): 15 out of 60 tests in fast/media crash under guard malloc|
|Product:||WebKit||Reporter:||Mark Rowe (bdash) <mrowe>|
|Component:||WebCore Misc.||Assignee:||Dave Hyatt <hyatt>|
|Severity:||Major||CC:||bfulgham, hyatt, mrowe|
|Priority:||P1||Keywords:||InRadar, Regression, ReviewedForRadar|
|Version:||528+ (Nightly build)|
|OS:||Mac OS X 10.5|
Description Mark Rowe (bdash) 2008-02-26 15:04:45 PST
$ run-webkit-tests -g --debug fast/media Testing 60 test cases. fast/media ............. fast/media/mq-compound-query-05.html -> crashed ..................... fast/media/mq-min-constraint.html -> crashed ... fast/media/mq-relative-constraints-02.html -> crashed . fast/media/mq-relative-constraints-03.html -> crashed . fast/media/mq-relative-constraints-04.html -> crashed . fast/media/mq-relative-constraints-05.html -> crashed . fast/media/mq-relative-constraints-06.html -> crashed . fast/media/mq-relative-constraints-07.html -> crashed . fast/media/mq-relative-constraints-08.html -> crashed . fast/media/mq-relative-constraints-09.html -> crashed ............ fast/media/mq-width-absolute-01.html -> crashed . fast/media/mq-width-absolute-02.html -> crashed . fast/media/mq-width-absolute-03.html -> crashed . fast/media/mq-width-absolute-04.html -> crashed . fast/media/viewport-media-query.html -> crashed 934.60s total testing time 45 test cases (75%) succeeded 15 test cases (25%) crashed $
Comment 1 Mark Rowe (bdash) 2008-02-26 15:05:02 PST
Comment 2 Mark Rowe (bdash) 2008-02-26 15:08:43 PST
Created attachment 19386 [details] Crash log from one of the crashes All of the crashes appear to have similar crash logs.
Comment 3 Mark Rowe (bdash) 2008-02-27 13:10:30 PST
The crash was introduced in r30466.
Comment 4 Brent Fulgham 2008-02-28 21:17:24 PST
I notice that if a place a breakpoint in CSSStyleSelector::addViewportDependentMediaQueryResult, the first time I enter the method m_viewportDependentMediaQueryResults has a size of zero. After the append, the size is 1. So far, so good. The second time I hit the breakpoint, the size of m_viewportDependentMediaQueryResults is now 4277075694. There seems to be a timing element; if I set the breakpoint and wait a while I can often run without error. But if I move to a new page (with media content) and don't pause I get the crash.
Comment 5 Jon Honeycutt 2008-02-28 21:29:33 PST
It looks like m_viewportDependentMediaQueryResults is not initialized at the point that we start adding items to it. It should be initialized earlier in CSSStyleSelector's constructor.
Comment 6 Brent Fulgham 2008-02-28 22:02:53 PST
There seems to be some kind of access to the CSSStyleSelector after it is deallocated. I keep hitting the destructor for a CSSStyleSelector (with particular address), then enter the constructor (with a new address). I then enter the CSSStyleSelector::addViewportDependentMediaQueryResult for the original (destroyed) this pointer. The elements are all in an uninitialized state, and then the program crashes.
Comment 7 Dave Hyatt 2008-02-29 13:03:17 PST
Created attachment 19457 [details] Patch to fix the problem.
Comment 8 Adam Roben (:aroben) 2008-02-29 13:13:04 PST
Comment on attachment 19457 [details] Patch to fix the problem. r=me
Comment 9 Mark Rowe (bdash) 2008-02-29 14:13:12 PST
This was landed in r30670.