Bug 54344 – REGRESSION (r77834): Assertion failing in svg/custom/use-multiple-on-nested-disallowed-font.svg

• Component: SVG
• Status: RESOLVED FIXED

[Darin Adler]

I am getting this assertion failure when running regression tests:

ASSERTION FAILED: m_pushedStyleSelector == m_parent->document()->styleSelector()
/Users/darin/Safari/OpenSource/Source/WebCore/dom/Element.cpp(90) : WebCore::StyleSelectorParentPusher::~StyleSelectorParentPusher()
 -> WebCore::StyleSelectorParentPusher::~StyleSelectorParentPusher()
 -> WebCore::Element::recalcStyle(WebCore::Node::StyleChange)
 -> WebCore::Element::recalcStyle(WebCore::Node::StyleChange)
 -> WebCore::Element::recalcStyle(WebCore::Node::StyleChange)
 -> WebCore::Document::recalcStyle(WebCore::Node::StyleChange)
 -> WebCore::Document::updateStyleIfNeeded()
 -> WebCore::Document::updateLayout()
 -> WebCore::Document::updateLayoutIgnorePendingStylesheets()
 -> WebCore::SVGElementInstance::invalidateAllInstancesOfElement(WebCore::SVGElement*)
 -> WebCore::SVGStyledElement::svgAttributeChanged(WebCore::QualifiedName const&)
 -> WebCore::SVGGradientElement::svgAttributeChanged(WebCore::QualifiedName const&)
 -> WebCore::SVGLinearGradientElement::svgAttributeChanged(WebCore::QualifiedName const&)
 -> WebCore::SVGElement::attributeChanged(WebCore::Attribute*, bool)
 -> WebCore::NamedNodeMap::addAttribute(WTF::PassRefPtr<WebCore::Attribute>)
 -> WebCore::Element::setAttribute(WebCore::QualifiedName const&, WTF::AtomicString const&, int&)
 -> WebCore::Element::setAttribute(WebCore::QualifiedName const&, WTF::AtomicString const&)
 -> WebCore::SVGAnimateTransformElement::resetToBaseValue(WTF::String const&)
 -> WebCore::SMILTimeContainer::updateAnimations(WebCore::SMILTime)
 -> WebCore::SMILTimeContainer::begin()
 -> WebCore::SVGDocumentExtensions::startAnimations()
 -> WebCore::Document::implicitClose()
 -> WebCore::FrameLoader::checkCallImplicitClose()
 -> WebCore::FrameLoader::checkCompleted()
 -> WebCore::FrameLoader::finishedParsing()
 -> WebCore::Document::finishedParsing()
 -> WebCore::HTMLTreeBuilder::finished()
 -> WebCore::HTMLDocumentParser::end()
 -> WebCore::HTMLDocumentParser::attemptToRunDeferredScriptsAndEnd()
 -> WebCore::HTMLDocumentParser::prepareToStopParsing()
 -> WebCore::HTMLDocumentParser::attemptToEnd()
 -> WebCore::HTMLDocumentParser::finish()

I’m not sure if this is also happening on buildbots.

[Dirk Schulze]

*** Bug 53989 has been marked as a duplicate of this bug. ***

[Darin Adler]

We could have marked this as a duplicate in the other direction. Sorry I didn’t find the duplicate!

[Dirk Schulze]

(In reply to comment #2)
> We could have marked this as a duplicate in the other direction. Sorry I didn’t find the duplicate!

Sure, we can mark it the other way around, both bugs have the same information. But this one has 'regression' in the title. So I choose this bug as valid bug instead of renaming the other one.

If you look at the bt on the other bug, you'll see that the location, where the test fails, is the same: StyleSelectorParentPusher.

[Antti Koivisto]

This is not really a regression from r77834. Rather, the assert added there exposes an SVG bug (it is recomputing the style selector in the middle of a style recalc). Strangely, I have never seen this locally.

[Antti Koivisto]

I can catch this by adding this assert:


Index: Source/WebCore/dom/Document.cpp
===================================================================
--- Source/WebCore/dom/Document.cpp	(revision 78321)
+++ Source/WebCore/dom/Document.cpp	(working copy)
@@ -2944,6 +2944,7 @@
 
 void Document::recalcStyleSelector()
 {
+    ASSERT(!m_inStyleRecalc);
     if (!renderer() || !attached())
         return;

[Antti Koivisto]

It also fails svg/custom/use-invalid-style.svg

[Antti Koivisto]

2947	    ASSERT(!m_inStyleRecalc);
(gdb) bt
#0  0x000000010113a875 in WebCore::Document::recalcStyleSelector (this=0x1060cf000) at /Users/antti/webkit/OpenSource/Source/WebCore/dom/Document.cpp:2947
#1  0x000000010113af45 in WebCore::Document::styleSelectorChanged (this=0x1060cf000, updateFlag=WebCore::DeferRecalcStyle) at /Users/antti/webkit/OpenSource/Source/WebCore/dom/Document.cpp:2871
#2  0x0000000101b440ef in WebCore::SVGFontFaceElement::removeFromMappedElementSheet (this=0x107181720) at /Users/antti/webkit/OpenSource/Source/WebCore/svg/SVGFontFaceElement.cpp:351
#3  0x0000000101b4410b in WebCore::SVGFontFaceElement::removedFromDocument (this=0x107181720) at /Users/antti/webkit/OpenSource/Source/WebCore/svg/SVGFontFaceElement.cpp:329
#4  0x0000000100ff778d in WebCore::ContainerNode::removedFromDocument (this=0x107192260) at /Users/antti/webkit/OpenSource/Source/WebCore/dom/ContainerNode.cpp:743
#5  0x000000010125b357 in WebCore::Element::removedFromDocument (this=0x107192260) at /Users/antti/webkit/OpenSource/Source/WebCore/dom/Element.cpp:919
#6  0x0000000101ba1c09 in WebCore::SVGStyledElement::removedFromDocument (this=0x107192260) at /Users/antti/webkit/OpenSource/Source/WebCore/svg/SVGStyledElement.cpp:362
#7  0x0000000100ff778d in WebCore::ContainerNode::removedFromDocument (this=0x107168960) at /Users/antti/webkit/OpenSource/Source/WebCore/dom/ContainerNode.cpp:743
#8  0x000000010125b357 in WebCore::Element::removedFromDocument (this=0x107168960) at /Users/antti/webkit/OpenSource/Source/WebCore/dom/Element.cpp:919
#9  0x0000000101ba1c09 in WebCore::SVGStyledElement::removedFromDocument (this=0x107168960) at /Users/antti/webkit/OpenSource/Source/WebCore/svg/SVGStyledElement.cpp:362
#10 0x0000000100ff778d in WebCore::ContainerNode::removedFromDocument (this=0x10719cc10) at /Users/antti/webkit/OpenSource/Source/WebCore/dom/ContainerNode.cpp:743
#11 0x000000010125b357 in WebCore::Element::removedFromDocument (this=0x10719cc10) at /Users/antti/webkit/OpenSource/Source/WebCore/dom/Element.cpp:919
#12 0x0000000101ba1c09 in WebCore::SVGStyledElement::removedFromDocument (this=0x10719cc10) at /Users/antti/webkit/OpenSource/Source/WebCore/svg/SVGStyledElement.cpp:362
#13 0x0000000100ff778d in WebCore::ContainerNode::removedFromDocument (this=0x107106c20) at /Users/antti/webkit/OpenSource/Source/WebCore/dom/ContainerNode.cpp:743
#14 0x000000010125b357 in WebCore::Element::removedFromDocument (this=0x107106c20) at /Users/antti/webkit/OpenSource/Source/WebCore/dom/Element.cpp:919
#15 0x0000000101ba1c09 in WebCore::SVGStyledElement::removedFromDocument (this=0x107106c20) at /Users/antti/webkit/OpenSource/Source/WebCore/svg/SVGStyledElement.cpp:362
#16 0x0000000100ff778d in WebCore::ContainerNode::removedFromDocument (this=0x10716dd70) at /Users/antti/webkit/OpenSource/Source/WebCore/dom/ContainerNode.cpp:743
#17 0x000000010125b357 in WebCore::Element::removedFromDocument (this=0x10716dd70) at /Users/antti/webkit/OpenSource/Source/WebCore/dom/Element.cpp:919
#18 0x0000000101ba1c09 in WebCore::SVGStyledElement::removedFromDocument (this=0x10716dd70) at /Users/antti/webkit/OpenSource/Source/WebCore/svg/SVGStyledElement.cpp:362
#19 0x0000000100ffae05 in WebCore::Private::NodeRemovalDispatcher<WebCore::Node, true>::dispatch (node=0x10716dd70) at ContainerNodeAlgorithms.h:99
#20 0x0000000100ffb4b1 in WebCore::Private::addChildNodesToDeletionQueue<WebCore::Node, WebCore::ContainerNode> (head=@0x7fff5fbfd4e8, tail=@0x7fff5fbfd4e0, container=0x1071298a0) at ContainerNodeAlgorithms.h:139
#21 0x0000000100ffb50f in WebCore::removeAllChildrenInContainer<WebCore::Node, WebCore::ContainerNode> (container=0x1071298a0) at ContainerNodeAlgorithms.h:47
#22 0x0000000100ff68a3 in WebCore::ContainerNode::removeAllChildren (this=0x1071298a0) at /Users/antti/webkit/OpenSource/Source/WebCore/dom/ContainerNode.cpp:72
#23 0x00000001019c4831 in WebCore::RenderSVGShadowTreeRootContainer::updateFromElement (this=0x107186168) at /Users/antti/webkit/OpenSource/Source/WebCore/rendering/svg/RenderSVGShadowTreeRootContainer.cpp:71
#24 0x0000000101bc4985 in WebCore::SVGUseElement::recalcStyle (this=0x1196ecad0, change=WebCore::Node::NoChange) at /Users/antti/webkit/OpenSource/Source/WebCore/svg/SVGUseElement.cpp:372
#25 0x000000010125af00 in WebCore::Element::recalcStyle (this=0x1196e9d80, change=WebCore::Node::NoChange) at /Users/antti/webkit/OpenSource/Source/WebCore/dom/Element.cpp:1107
#26 0x000000010125af00 in WebCore::Element::recalcStyle (this=0x119533780, change=WebCore::Node::NoChange) at /Users/antti/webkit/OpenSource/Source/WebCore/dom/Element.cpp:1107
#27 0x000000010125af00 in WebCore::Element::recalcStyle (this=0x105b44ee0, change=WebCore::Node::NoChange) at /Users/antti/webkit/OpenSource/Source/WebCore/dom/Element.cpp:1107
#28 0x0000000101142f6a in WebCore::Document::recalcStyle (this=0x1060cf000, change=WebCore::Node::NoChange) at /Users/antti/webkit/OpenSource/Source/WebCore/dom/Document.cpp:1520
#29 0x000000010113a17f in WebCore::Document::updateStyleIfNeeded (this=0x1060cf000) at /Users/antti/webkit/OpenSource/Source/WebCore/dom/Document.cpp:1562
#30 0x0000000101139ed1 in WebCore::Document::updateLayout (this=0x1060cf000) at /Users/antti/webkit/OpenSource/Source/WebCore/dom/Document.cpp:1589

[Antti Koivisto]

DOM mutation from recalcStyle is evil.

[Antti Koivisto]

Created attachment 82302 [details]
patch

Intead of recomputing, just mark style selector dirty if it is invalidated in the middle of a style recalc.

[Antti Koivisto]

Created attachment 82303 [details]
more correct patch

[Andreas Kling]

Comment on attachment 82303 [details]
more correct patch

r=me

(Niko/Dirk: heads up!)

[Antti Koivisto]

http://trac.webkit.org/changeset/78468

[Csaba Osztrogonác]

*** Bug 54086 has been marked as a duplicate of this bug. ***