Summary: | WML causes crash on Slashdot.org main page | ||||||||
---|---|---|---|---|---|---|---|---|---|
Product: | WebKit | Reporter: | red47514f7 | ||||||
Component: | Layout and Rendering | Assignee: | George Staikos <staikos> | ||||||
Status: | RESOLVED FIXED | ||||||||
Severity: | Normal | CC: | jmalonzo, red47514f7, staikos, zimmermann | ||||||
Priority: | P2 | ||||||||
Version: | 528+ (Nightly build) | ||||||||
Hardware: | PC | ||||||||
OS: | All | ||||||||
Attachments: |
|
Description
red47514f7
2009-08-05 00:44:43 PDT
Maybe I misclassified the bug because disabling one CSS file ( http://c.fsdn.com/sd/idlecore-tidied.css?T_2_5_0_266b ) fixes the problem. Bug was first filed when r46770 was fresh nightly. It appeared a few days earlier. gdb reports WebCore::RenderFieldset::findLegend Full backtrace minus paths and application part: #0 0xb7a0b9bf in WebCore::RenderFieldset::findLegend () #1 0xb7a0c83d in WebCore::RenderFieldset::calcPrefWidths () #2 0xb79f6d9b in WebCore::RenderBox::minPrefWidth () #3 0xb7a003d3 in WebCore::RenderBox::calcWidth () #4 0xb79e8cba in WebCore::RenderBlock::layoutBlock () #5 0xb79d6b18 in WebCore::RenderBlock::layout () #6 0xb79e865b in WebCore::RenderBlock::layoutBlockChildren () #7 0xb79e9311 in WebCore::RenderBlock::layoutBlock () #8 0xb79d6b18 in WebCore::RenderBlock::layout () #9 0xb79e865b in WebCore::RenderBlock::layoutBlockChildren () #10 0xb79e9311 in WebCore::RenderBlock::layoutBlock () #11 0xb79d6b18 in WebCore::RenderBlock::layout () #12 0xb79e865b in WebCore::RenderBlock::layoutBlockChildren () #13 0xb79e9311 in WebCore::RenderBlock::layoutBlock () #14 0xb79d6b18 in WebCore::RenderBlock::layout () #15 0xb79e865b in WebCore::RenderBlock::layoutBlockChildren () #16 0xb79e9311 in WebCore::RenderBlock::layoutBlock () #17 0xb79d6b18 in WebCore::RenderBlock::layout () #18 0xb79d896c in WebCore::RenderBlock::insertFloatingObject () #19 0xb79e3377 in WebCore::RenderBlock::handleFloatingChild () #20 0xb79e6313 in WebCore::RenderBlock::handleSpecialChild () #21 0xb79e84b9 in WebCore::RenderBlock::layoutBlockChildren () #22 0xb79e9311 in WebCore::RenderBlock::layoutBlock () #23 0xb79d6b18 in WebCore::RenderBlock::layout () #24 0xb79e865b in WebCore::RenderBlock::layoutBlockChildren () #25 0xb79e9311 in WebCore::RenderBlock::layoutBlock () #26 0xb79d6b18 in WebCore::RenderBlock::layout () #27 0xb79e865b in WebCore::RenderBlock::layoutBlockChildren () #28 0xb79e9311 in WebCore::RenderBlock::layoutBlock () #29 0xb79d6b18 in WebCore::RenderBlock::layout () #30 0xb79e865b in WebCore::RenderBlock::layoutBlockChildren () #31 0xb79e9311 in WebCore::RenderBlock::layoutBlock () #32 0xb79d6b18 in WebCore::RenderBlock::layout () #33 0xb79e865b in WebCore::RenderBlock::layoutBlockChildren () #34 0xb79e9311 in WebCore::RenderBlock::layoutBlock () #35 0xb79d6b18 in WebCore::RenderBlock::layout () #36 0xb7a6ff17 in WebCore::RenderView::layout () #37 0xb7932682 in WebCore::FrameView::layout () #38 0xb773c250 in WebCore::Document::updateLayout () #39 0xb774f5d9 in WebCore::Document::updateLayoutIgnorePendingStylesheets () #40 0xb76b684b in WebCore::CSSComputedStyleDeclaration::getPropertyCSSValue () #41 0xb76bcf98 in WebCore::CSSComputedStyleDeclaration::getPropertyCSSValue () #42 0xb76b5446 in WebCore::CSSComputedStyleDeclaration::getPropertyValue () #43 0xb76f6353 in WebCore::CSSStyleDeclaration::getPropertyValue () #44 0xb7cb66c4 in WebCore::jsCSSStyleDeclarationPrototypeFunctionGetPropertyValue () Simple reduction (derived from slashdot.org). <form> tag can be added if you wish so. <html> <head> <style> label{display:block;} </style> </head> <body> <fieldset> <label></label> a </fieldset> </body> </html> Created attachment 34261 [details]
Reduction for slashdot.org crash
<form> tag around <fieldset> is omitted for brevity. It would make no difference.
Further investigating: it only ocurs when WML support was enabled during the build. CC'ing Nikolas as he knows more about WML. I believe this is a regression of a bug that was fixed before. It's platform independent. Created attachment 34908 [details]
Patch and testcase to fix the bug
Bug # can be added when landing. It's in my local tree. (In reply to comment #9) > Bug # can be added when landing. It's in my local tree. Looks ok. r=me. Checked in r47329 |