Bug 196035

Summary: [iOS] Crash in WebCore::Node::renderRect
Product: WebKit Reporter: Dean Jackson <dino>
Component: UI EventsAssignee: Dean Jackson <dino>
Status: RESOLVED FIXED    
Severity: Normal CC: cdumez, dbates, esprehn+autocc, ews-watchlist, graouts, kangil.han, webkit-bug-importer
Priority: P2 Keywords: InRadar
Version: WebKit Nightly Build   
Hardware: Unspecified   
OS: Unspecified   
Attachments:
Description Flags
Patch graouts: review+

Dean Jackson
Reported 2019-03-20 14:58:26 PDT
Since https://trac.webkit.org/changeset/242757/webkit fast/images/imagemap-in-shadow-tree.html http/tests/download/area-download.html ASSERTION FAILED: hitRenderer ./dom/Node.cpp(798) : WebCore::LayoutRect WebCore::Node::renderRect(bool *) 1 0x2c641f649 WTFCrash 2 0x2ca4eda7b WTFCrashWithInfo(int, char const*, char const*, int) 3 0x2cc6f207e WebCore::Node::renderRect(bool*) 4 0x105ac91b9 WebKit::ViewGestureGeometryCollector::computeZoomInformationForNode(WebCore::Node&, WebCore::FloatPoint&, WebCore::FloatRect&, bool&, double&, double&) 5 0x1057acf6b WebKit::WebPage::potentialTapAtPosition(unsigned long long, WebCore::FloatPoint const&, bool) 6 0x105c10e37 void IPC::callMemberFunctionImpl<WebKit::WebPage, void (WebKit::WebPage::*)(unsigned long long, WebCore::FloatPoint const&, bool), std::__1::tuple<unsigned long long, WebCore::FloatPoint, bool>, 0ul, 1ul, 2ul>(WebKit::WebPage*, void (WebKit::WebPage::*)(unsigned long long, WebCore::FloatPoint const&, bool), std::__1::tuple<unsigned long long, WebCore::FloatPoint, bool>&&, std::__1::integer_sequence<unsigned long, 0ul, 1ul, 2ul>) 7 0x105c10d10 void IPC::callMemberFunction<WebKit::WebPage, void (WebKit::WebPage::*)(unsigned long long, WebCore::FloatPoint const&, bool), std::__1::tuple<unsigned long long, WebCore::FloatPoint, bool>, std::__1::integer_sequence<unsigned long, 0ul, 1ul, 2ul> >(std::__1::tuple<unsigned long long, WebCore::FloatPoint, bool>&&, WebKit::WebPage*, void (WebKit::WebPage::*)(unsigned long long, WebCore::FloatPoint const&, bool)) 8 0x105bf26d6 void IPC::handleMessage<Messages::WebPage::PotentialTapAtPosition, WebKit::WebPage, void (WebKit::WebPage::*)(unsigned long long, WebCore::FloatPoint const&, bool)>(IPC::Decoder&, WebKit::WebPage*, void (WebKit::WebPage::*)(unsigned long long, WebCore::FloatPoint const&, bool)) 9 0x105be8512 WebKit::WebPage::didReceiveWebPageMessage(IPC::Connection&, IPC::Decoder&) 10 0x105b918ae WebKit::WebPage::didReceiveMessage(IPC::Connection&, IPC::Decoder&) 11 0x104b1cf6a IPC::MessageReceiverMap::dispatchMessage(IPC::Connection&, IPC::Decoder&) 12 0x1057f3afd WebKit::WebProcess::didReceiveMessage(IPC::Connection&, IPC::Decoder&) 13 0x104ad029c IPC::Connection::dispatchMessage(IPC::Decoder&) 14 0x104ac2881 IPC::Connection::dispatchMessage(std::__1::unique_ptr<IPC::Decoder, std::__1::default_delete<IPC::Decoder> >) 15 0x104ad1067 IPC::Connection::dispatchOneIncomingMessage() 16 0x104af1cf8 IPC::Connection::enqueueIncomingMessage(std::__1::unique_ptr<IPC::Decoder, std::__1::default_delete<IPC::Decoder> >)::$_14::operator()() 17 0x104af1c09 WTF::Function<void ()>::CallableWrapper<IPC::Connection::enqueueIncomingMessage(std::__1::unique_ptr<IPC::Decoder, std::__1::default_delete<IPC::Decoder> >)::$_14>::call() 18 0x2c6449add WTF::Function<void ()>::operator()() const 19 0x2c64a9233 WTF::RunLoop::performWork() 20 0x2c64a9bc4 WTF::RunLoop::performWork(void*) 21 0x2c0b9a721 __CFRUNLOOP_IS_CALLING_OUT_TO_A_SOURCE0_PERFORM_FUNCTION__ 22 0x2c0b99f93 __CFRunLoopDoSources0 23 0x2c0b9463f __CFRunLoopRun 24 0x2c0b93e11 CFRunLoopRunSpecific 25 0x104508322 -[NSRunLoop(NSRunLoop) runMode:beforeDate:] 26 0x104508492 -[NSRunLoop(NSRunLoop) run] 27 0x2c22f7812 _xpc_objc_main 28 0x2c22f9cbd xpc_main 29 0x104f6d427 WebKit::XPCServiceMain(int, char const**) 30 0x104e83a6b WKXPCServiceMain 31 0x10444da8e main LEAK: 1 WebPageProxy 
Attachments
Patch (2.31 KB, patch)
2019-03-20 15:42 PDT, Dean Jackson
graouts: review+
Dean Jackson
Comment 1 2019-03-20 14:59:05 PDT
Dean Jackson
Comment 2 2019-03-20 15:42:11 PDT
Antoine Quint
Comment 3 2019-03-20 15:47:34 PDT
Comment on attachment 365416 [details] Patch View in context: https://bugs.webkit.org/attachment.cgi?id=365416&action=review > Source/WebCore/dom/Node.cpp:799 > + if (!hitRenderer && is<HTMLAreaElement>(*this)) { You can use simply `this` here. > Source/WebCore/dom/Node.cpp:802 > + auto* imageElement = area.imageElement(); > + if (imageElement) if (auto* …)
Dean Jackson
Comment 4 2019-03-20 15:49:59 PDT
Note You need to log in before you can comment on or make changes to this bug.