|Summary:||REGRESSION(r30466): 15 out of 60 tests in fast/media crash under guard malloc|
|Product:||WebKit||Reporter:||Mark Rowe (bdash) <email@example.com>|
|Component:||WebCore Misc.||Assignee:||Dave Hyatt <firstname.lastname@example.org>|
|Severity:||Major||CC:||email@example.com, firstname.lastname@example.org, email@example.com|
|Priority:||P1||Keywords:||InRadar, Regression, ReviewedForRadar|
|Version:||528+ (Nightly build)|
|OS:||Mac OS X 10.5|
$ run-webkit-tests -g --debug fast/media Testing 60 test cases. fast/media ............. fast/media/mq-compound-query-05.html -> crashed ..................... fast/media/mq-min-constraint.html -> crashed ... fast/media/mq-relative-constraints-02.html -> crashed . fast/media/mq-relative-constraints-03.html -> crashed . fast/media/mq-relative-constraints-04.html -> crashed . fast/media/mq-relative-constraints-05.html -> crashed . fast/media/mq-relative-constraints-06.html -> crashed . fast/media/mq-relative-constraints-07.html -> crashed . fast/media/mq-relative-constraints-08.html -> crashed . fast/media/mq-relative-constraints-09.html -> crashed ............ fast/media/mq-width-absolute-01.html -> crashed . fast/media/mq-width-absolute-02.html -> crashed . fast/media/mq-width-absolute-03.html -> crashed . fast/media/mq-width-absolute-04.html -> crashed . fast/media/viewport-media-query.html -> crashed 934.60s total testing time 45 test cases (75%) succeeded 15 test cases (25%) crashed $
Created an attachment (id=19386) [details] Crash log from one of the crashes All of the crashes appear to have similar crash logs.
The crash was introduced in r30466.
I notice that if a place a breakpoint in CSSStyleSelector::addViewportDependentMediaQueryResult, the first time I enter the method m_viewportDependentMediaQueryResults has a size of zero. After the append, the size is 1. So far, so good. The second time I hit the breakpoint, the size of m_viewportDependentMediaQueryResults is now 4277075694. There seems to be a timing element; if I set the breakpoint and wait a while I can often run without error. But if I move to a new page (with media content) and don't pause I get the crash.
It looks like m_viewportDependentMediaQueryResults is not initialized at the point that we start adding items to it. It should be initialized earlier in CSSStyleSelector's constructor.
There seems to be some kind of access to the CSSStyleSelector after it is deallocated. I keep hitting the destructor for a CSSStyleSelector (with particular address), then enter the constructor (with a new address). I then enter the CSSStyleSelector::addViewportDependentMediaQueryResult for the original (destroyed) this pointer. The elements are all in an uninitialized state, and then the program crashes.
Created an attachment (id=19457) [details] Patch to fix the problem.
(From update of attachment 19457 [details]) r=me