Bug 17559

Summary: REGRESSION(r30466): 15 out of 60 tests in fast/media crash under guard malloc
Product: WebKit Reporter: Mark Rowe (bdash) <mrowe@apple.com>
Component: WebCore Misc.Assignee: Dave Hyatt <hyatt@apple.com>
Status: RESOLVED FIXED    
Severity: Major CC: bfulgham@webkit.org, hyatt@apple.com, mrowe@apple.com
Priority: P1 Keywords: InRadar, Regression, ReviewedForRadar
Version: 528+ (Nightly build)   
Hardware: Macintosh   
OS: Mac OS X 10.5   
Attachments:
Description Flags
Crash log from one of the crashes
none
Patch to fix the problem. aroben: review+

Description From 2008-02-26 15:04:45 PST
$ run-webkit-tests -g --debug fast/media
Testing 60 test cases.
fast/media .............
fast/media/mq-compound-query-05.html -> crashed
.....................
fast/media/mq-min-constraint.html -> crashed
...
fast/media/mq-relative-constraints-02.html -> crashed
.
fast/media/mq-relative-constraints-03.html -> crashed
.
fast/media/mq-relative-constraints-04.html -> crashed
.
fast/media/mq-relative-constraints-05.html -> crashed
.
fast/media/mq-relative-constraints-06.html -> crashed
.
fast/media/mq-relative-constraints-07.html -> crashed
.
fast/media/mq-relative-constraints-08.html -> crashed
.
fast/media/mq-relative-constraints-09.html -> crashed
............
fast/media/mq-width-absolute-01.html -> crashed
.
fast/media/mq-width-absolute-02.html -> crashed
.
fast/media/mq-width-absolute-03.html -> crashed
.
fast/media/mq-width-absolute-04.html -> crashed
.
fast/media/viewport-media-query.html -> crashed

934.60s total testing time

45 test cases (75%) succeeded
15 test cases (25%) crashed
$
------- Comment #1 From 2008-02-26 15:05:02 PST -------
<rdar://problem/5766945>
------- Comment #2 From 2008-02-26 15:08:43 PST -------
Created an attachment (id=19386) [details]
Crash log from one of the crashes

All of the crashes appear to have similar crash logs.
------- Comment #3 From 2008-02-27 13:10:30 PST -------
The crash was introduced in r30466.
------- Comment #4 From 2008-02-28 21:17:24 PST -------
I notice that if a place a breakpoint in CSSStyleSelector::addViewportDependentMediaQueryResult, the first time I enter the method m_viewportDependentMediaQueryResults has a size of zero.  After the append, the size is 1.  So far, so good.

The second time I hit the breakpoint, the size of m_viewportDependentMediaQueryResults is now 4277075694.

There seems to be a timing element; if I set the breakpoint and wait a while I can often run without error.  But if I move to a new page (with media content) and don't pause I get the crash.
------- Comment #5 From 2008-02-28 21:29:33 PST -------
It looks like m_viewportDependentMediaQueryResults is not initialized at the point that we start adding items to it. It should be initialized earlier in CSSStyleSelector's constructor.
------- Comment #6 From 2008-02-28 22:02:53 PST -------
There seems to be some kind of access to the CSSStyleSelector after it is deallocated.  I keep hitting the destructor for a CSSStyleSelector (with particular address), then enter the constructor (with a new address).  I then enter the CSSStyleSelector::addViewportDependentMediaQueryResult for the original (destroyed) this pointer.  The elements are all in an uninitialized state, and then the program crashes.
------- Comment #7 From 2008-02-29 13:03:17 PST -------
Created an attachment (id=19457) [details]
Patch to fix the problem.
------- Comment #8 From 2008-02-29 13:13:04 PST -------
(From update of attachment 19457 [details])
r=me
------- Comment #9 From 2008-02-29 14:13:12 PST -------
This was landed in r30670.