Summary: | REGRESSION(r30466): 15 out of 60 tests in fast/media crash under guard malloc | ||||||||
---|---|---|---|---|---|---|---|---|---|
Product: | WebKit | Reporter: | Mark Rowe (bdash) <mrowe> | ||||||
Component: | WebCore Misc. | Assignee: | Dave Hyatt <hyatt> | ||||||
Status: | RESOLVED FIXED | ||||||||
Severity: | Major | CC: | bfulgham, hyatt, mrowe | ||||||
Priority: | P1 | Keywords: | InRadar, Regression | ||||||
Version: | 528+ (Nightly build) | ||||||||
Hardware: | Mac | ||||||||
OS: | OS X 10.5 | ||||||||
Attachments: |
|
Description
Mark Rowe (bdash)
2008-02-26 15:04:45 PST
Created attachment 19386 [details]
Crash log from one of the crashes
All of the crashes appear to have similar crash logs.
I notice that if a place a breakpoint in CSSStyleSelector::addViewportDependentMediaQueryResult, the first time I enter the method m_viewportDependentMediaQueryResults has a size of zero. After the append, the size is 1. So far, so good. The second time I hit the breakpoint, the size of m_viewportDependentMediaQueryResults is now 4277075694. There seems to be a timing element; if I set the breakpoint and wait a while I can often run without error. But if I move to a new page (with media content) and don't pause I get the crash. It looks like m_viewportDependentMediaQueryResults is not initialized at the point that we start adding items to it. It should be initialized earlier in CSSStyleSelector's constructor. There seems to be some kind of access to the CSSStyleSelector after it is deallocated. I keep hitting the destructor for a CSSStyleSelector (with particular address), then enter the constructor (with a new address). I then enter the CSSStyleSelector::addViewportDependentMediaQueryResult for the original (destroyed) this pointer. The elements are all in an uninitialized state, and then the program crashes. Created attachment 19457 [details]
Patch to fix the problem.
Comment on attachment 19457 [details]
Patch to fix the problem.
r=me
|