Summary: | Crash in IsolateTracker::addFakeRunIfNecessary(), preceded by assertion failure (m_nestedIsolateCount >= 1) in IsolateTracker::exitIsolate() | ||||||
---|---|---|---|---|---|---|---|
Product: | WebKit | Reporter: | mitz | ||||
Component: | Layout and Rendering | Assignee: | Ryosuke Niwa <rniwa> | ||||
Status: | RESOLVED FIXED | ||||||
Severity: | Normal | CC: | eric, leviw, rniwa, xji | ||||
Priority: | P1 | Keywords: | InRadar | ||||
Version: | 528+ (Nightly build) | ||||||
Hardware: | Unspecified | ||||||
OS: | Unspecified | ||||||
URL: | data:text/html,%3Cspan%20style=%22unicode-bidi:%20-webkit-isolate;%22%3E%3Cspan%20style=%22unicode-bidi:%20-webkit-isolate;%22%3Ea%3C/span%3E%3C/span%3E%3Cbr%3E | ||||||
Bug Depends on: | |||||||
Bug Blocks: | 69267 | ||||||
Attachments: |
|
Description
mitz
2011-10-03 11:54:24 PDT
It’s not clear to me why IsolateTracker initializes m_nestedIsolateCount to 1 regardless of the number of enclosing isolating inlines. In release builds, this ends up crashing in IsolateTracker::addFakeRunIfNecessary(): Exception Type: EXC_BAD_ACCESS (SIGSEGV) Exception Codes: KERN_INVALID_ADDRESS at 0x0000000000000010 0 com.apple.WebCore 0x0000000107adc69d WebCore::IsolateTracker::addFakeRunIfNecessary(WebCore::RenderObject*, WebCore::BidiResolver<WebCore::InlineIterator, WebCore::BidiRun>&) + 113 1 com.apple.WebCore 0x00000001071a7536 WebCore::BidiResolver<WebCore::InlineIterator, WebCore::BidiRun>::appendRun() + 724 2 com.apple.WebCore 0x00000001071a701e WebCore::BidiResolver<WebCore::InlineIterator, WebCore::BidiRun>::createBidiRunsForLine(WebCore::InlineIterator const&, WebCore::VisualDirectionOverride, bool) + 3626 3 com.apple.WebCore 0x0000000107adae75 WebCore::RenderBlock::layoutRunsAndFloatsInRange(WebCore::LineLayoutState&, WebCore::BidiResolver<WebCore::InlineIterator, WebCore::BidiRun>&, WebCore::InlineIterator const&, WebCore::BidiStatus const&, unsigned int) + 1271 4 com.apple.WebCore 0x0000000107adbdde WebCore::RenderBlock::layoutRunsAndFloats(WebCore::LineLayoutState&, bool) + 1238 5 com.apple.WebCore 0x00000001071a1391 WebCore::RenderBlock::layoutInlineChildren(bool, int&, int&) + 425 6 com.apple.WebCore 0x0000000107ad25d7 WebCore::RenderBlock::layoutBlock(bool, int, WebCore::RenderBlock::BlockLayoutPass) + 1655 7 com.apple.WebCore 0x000000010719cab8 WebCore::RenderBlock::layout() + 42 8 com.apple.WebCore 0x000000010719f5f2 WebCore::RenderBlock::layoutBlockChild(WebCore::RenderBox*, WebCore::RenderBlock::MarginInfo&, int&, int&) + 838 9 com.apple.WebCore 0x000000010719e60a WebCore::RenderBlock::layoutBlockChildren(bool, int&) + 668 10 com.apple.WebCore 0x0000000107ad25f5 WebCore::RenderBlock::layoutBlock(bool, int, WebCore::RenderBlock::BlockLayoutPass) + 1685 11 com.apple.WebCore 0x000000010719cab8 WebCore::RenderBlock::layout() + 42 12 com.apple.WebCore 0x000000010719f5f2 WebCore::RenderBlock::layoutBlockChild(WebCore::RenderBox*, WebCore::RenderBlock::MarginInfo&, int&, int&) + 838 13 com.apple.WebCore 0x000000010719e60a WebCore::RenderBlock::layoutBlockChildren(bool, int&) + 668 14 com.apple.WebCore 0x0000000107ad25f5 WebCore::RenderBlock::layoutBlock(bool, int, WebCore::RenderBlock::BlockLayoutPass) + 1685 15 com.apple.WebCore 0x000000010719cab8 WebCore::RenderBlock::layout() + 42 16 com.apple.WebCore 0x000000010719ca1f WebCore::RenderView::layout() + 579 Thank you. (In reply to comment #1) > It’s not clear to me why IsolateTracker initializes m_nestedIsolateCount to 1 regardless of the number of enclosing isolating inlines. It's probably wrong. We simply don't have enough isolate test cases yet. Hm... I can't reproduce this crash on ToT. (In reply to comment #6) > Hm... I can't reproduce this crash on ToT. Apparently, I was doing it wrong. A patch coming in a minute. Created attachment 116847 [details]
fixes the bug
Comment on attachment 116847 [details] fixes the bug View in context: https://bugs.webkit.org/attachment.cgi?id=116847&action=review > Source/WebCore/ChangeLog:9 > + The crash was caused by our false assumption that at most one isolated container exits between the start s/exits/exists/ Comment on attachment 116847 [details]
fixes the bug
Looks right to me :)
Comment on attachment 116847 [details]
fixes the bug
Seems fine to me. I'm not sure I remember why I had that assumption. Clearly I designed the system to accommodate more than one. More test coverage will tell us if this is the right code design or not. :)
Committed r101406: <http://trac.webkit.org/changeset/101406> |