Summary: | REGRESSION(251950@main) Crash under WebCore::Style::ElementRuleCollector::collectMatchingRules | ||||||||
---|---|---|---|---|---|---|---|---|---|
Product: | WebKit | Reporter: | Fujii Hironori <Hironori.Fujii> | ||||||
Component: | CSS | Assignee: | Antti Koivisto <koivisto> | ||||||
Status: | RESOLVED FIXED | ||||||||
Severity: | Normal | CC: | koivisto, webkit-bug-importer | ||||||
Priority: | P2 | Keywords: | InRadar | ||||||
Version: | WebKit Nightly Build | ||||||||
Hardware: | Unspecified | ||||||||
OS: | Unspecified | ||||||||
Bug Depends on: | |||||||||
Bug Blocks: | 242058 | ||||||||
Attachments: |
|
Description
Fujii Hironori
2022-06-29 19:26:51 PDT
ElementRuleCollector::collectMatchingRules has the following code: > if (element.hasAttributesWithoutUpdate() && matchRequest.ruleSet.hasAttributeRules()) { > for (auto& attribute : element.attributesIterator()) > collectMatchingRulesForList(matchRequest.ruleSet.attributeRules(attribute.localName(), isHTML), matchRequest); > } `attribute` wasn't valid value. This code was added by 251950@main (bug#242058). I confirmed this seems to be fixed by reverting 251950@main. > A crash happens in this page
> <https://mainichi.jp/articles/20220630/k00/00m/030/035000c>.
This crash is no longer reproducible to me with this page.
Created attachment 460568 [details]
debugging patch
collectMatchingRulesForList adds a new attribute to UniqueElementData::m_attributeVector while iterating it.
Here is the callstack of attachment#460568 [details] patch. > WebKit2.dll!WTFCrashWithInfo(int __formal, const char * __formal, const char * __formal, int __formal) Line 755 C++ > WebKit2.dll!WebCore::UniqueElementData::addAttribute(const WebCore::QualifiedName & attributeName, const WTF::AtomString & value) Line 334 C++ > WebKit2.dll!WebCore::Element::addAttributeInternal(const WebCore::QualifiedName & name, const WTF::AtomString & value, WebCore::Element::SynchronizationOfLazyAttribute inSynchronizationOfLazyAttribute) Line 3074 C++ > WebKit2.dll!WebCore::Element::setAttributeInternal(unsigned int index, const WebCore::QualifiedName & name, const WTF::AtomString & newValue, WebCore::Element::SynchronizationOfLazyAttribute inSynchronizationOfLazyAttribute) Line 1874 C++ > WebKit2.dll!WebCore::Element::setSynchronizedLazyAttribute(const WebCore::QualifiedName & name, const WTF::AtomString & value) Line 1860 C++ > WebKit2.dll!WebCore::StyledElement::synchronizeStyleAttributeInternalImpl() Line 68 C++ > WebKit2.dll!WebCore::StyledElement::synchronizeStyleAttributeInternal() Line 57 C++ > WebKit2.dll!WebCore::Element::synchronizeAllAttributes() Line 667 C++ > WebKit2.dll!WebCore::Element::hasAttributes() Line 2384 C++ > WebKit2.dll!WebCore::SelectorChecker::checkOne(WebCore::SelectorChecker::CheckingContext & checkingContext, const WebCore::SelectorChecker::LocalContext & context, WebCore::SelectorChecker::MatchType & matchType) Line 684 C++ > WebKit2.dll!WebCore::SelectorChecker::matchRecursively(WebCore::SelectorChecker::CheckingContext & checkingContext, const WebCore::SelectorChecker::LocalContext & context, WebCore::PseudoIdSet & dynamicPseudoIdSet) Line 272 C++ > WebKit2.dll!WebCore::SelectorChecker::match(const WebCore::CSSSelector & selector, const WebCore::Element & element, WebCore::SelectorChecker::CheckingContext & checkingContext) Line 191 C++ > WebKit2.dll!WebCore::Style::ElementRuleCollector::ruleMatches(const WebCore::Style::RuleData & ruleData, unsigned int & specificity, WebCore::Style::ScopeOrdinal styleScopeOrdinal) Line 469 C++ > WebKit2.dll!WebCore::Style::ElementRuleCollector::collectMatchingRulesForList(const WTF::Vector<WebCore::Style::RuleData,1,WTF::CrashOnOverflow,16,WTF::FastMalloc> * rules, const WebCore::Style::MatchRequest & matchRequest) Line 513 C++ > WebKit2.dll!WebCore::Style::ElementRuleCollector::collectMatchingRules(const WebCore::Style::MatchRequest & matchRequest) Line 169 C++ > WebKit2.dll!WebCore::Style::ElementRuleCollector::collectMatchingAuthorRules() Line 254 C++ > WebKit2.dll!WebCore::Style::ElementRuleCollector::matchAllRules(bool matchAuthorAndUserStyles, bool includeSMILProperties) Line 587 C++ > (...) Oh good find Created attachment 460570 [details]
Patch
Committed 251982@main (41eeecebb149): <https://commits.webkit.org/251982@main> All reviewed patches have been landed. Closing bug and clearing flags on attachment 460570 [details]. |