Bug 71377

Summary:

Assertion in FontCache::getCachedFontData() when painting into composited layer

Product:

WebKit

Reporter:

Simon Fraser (smfr) <simon.fraser>

Component:

Layout and Rendering

Assignee:

Simon Fraser (smfr) <simon.fraser>

Status:

RESOLVED FIXED

Severity:

Normal

CC:

msaboff, simon.fraser, webkit-bug-importer

Priority:

Keywords:

InRadar

Version:

528+ (Nightly build)

Hardware:

Unspecified

OS:

Unspecified

URL:

http://build.webkit.org/results/SnowLeopard%20Intel%20Debug%20(Tests)/r99063%20(2806)/platform/mac/accessibility/select-element-selection-with-optgroups-crash-log.txt

Attachments:

Description	Flags
Patch	andersca: review+

Simon Fraser (smfr)

Reported 2011-11-02 11:11:33 PDT

Bots show an assertion here: Exception Type: EXC_BAD_ACCESS (SIGSEGV) Exception Codes: KERN_INVALID_ADDRESS at 0x00000000bbadbeef Crashed Thread: 0 Dispatch queue: com.apple.main-thread Thread 0 Crashed: Dispatch queue: com.apple.main-thread 0 com.apple.WebCore 0x0000000101730a0b WebCore::FontCache::getCachedFontData(WebCore::FontPlatformData const*, WebCore::FontCache::ShouldRetain) + 121 (FontCache.cpp:280) 1 com.apple.WebCore 0x000000010173bb2e WebCore::FontCache::getFontDataForCharacters(WebCore::Font const&, unsigned short const*, int) + 1462 (FontCacheMac.mm:166) 2 com.apple.WebCore 0x0000000101740f0d WebCore::Font::glyphDataAndPageForCharacter(int, bool, WebCore::FontDataVariant) const + 2325 (FontFastPath.cpp:201) 3 com.apple.WebCore 0x00000001017411cd WebCore::Font::glyphDataForCharacter(int, bool, WebCore::FontDataVariant) const + 47 (FontFastPath.cpp:47) 4 com.apple.WebCore 0x00000001017412c2 WebCore::Font::getEmphasisMarkGlyphData(WTF::AtomicString const&, WebCore::GlyphData&) const + 220 (FontFastPath.cpp:280) 5 com.apple.WebCore 0x000000010174131c WebCore::Font::emphasisMarkHeight(WTF::AtomicString const&) const + 52 (FontFastPath.cpp:315) 6 com.apple.WebCore 0x00000001018f4414 WebCore::InlineFlowBox::computeOverAnnotationAdjustment(int) const + 742 (InlineFlowBox.cpp:1417) 7 com.apple.WebCore 0x00000001020757e5 WebCore::RootInlineBox::selectionTop() const + 95 (RootInlineBox.cpp:419) 8 com.apple.WebCore 0x0000000101f6771f WebCore::RenderLineBoxList::lineIntersectsDirtyRect(WebCore::RenderBoxModelObject*, WebCore::InlineFlowBox*, WebCore::PaintInfo const&, WebCore::IntPoint const&) const + 51 (RenderLineBoxList.cpp:197) 9 com.apple.WebCore 0x0000000101f6820e WebCore::RenderLineBoxList::paint(WebCore::RenderBoxModelObject*, WebCore::PaintInfo&, WebCore::IntPoint const&) const + 1310 (RenderLineBoxList.cpp:260) 10 com.apple.WebCore 0x0000000101e9b443 WebCore::RenderBlock::paintContents(WebCore::PaintInfo&, WebCore::IntPoint const&) + 161 (RenderBlock.cpp:2507) 11 com.apple.WebCore 0x0000000101ea6193 WebCore::RenderBlock::paintObject(WebCore::PaintInfo&, WebCore::IntPoint const&) + 477 (RenderBlock.cpp:2622) 12 com.apple.WebCore 0x0000000101e9c276 WebCore::RenderBlock::paint(WebCore::PaintInfo&, WebCore::IntPoint const&) + 256 (RenderBlock.cpp:2363) 13 com.apple.WebCore 0x0000000101f4e98a WebCore::RenderLayer::paintLayer(WebCore::RenderLayer*, WebCore::GraphicsContext*, WebCore::IntRect const&, unsigned int, WebCore::RenderObject*, WebCore::RenderRegion*, WTF::HashMap<WebCore::OverlapTestRequestClient*, WebCore::IntRect, WTF::PtrHash<WebCore::OverlapTestRequestClient*>, WTF::HashTraits<WebCore::OverlapTestRequestClient*>, WTF::HashTraits<WebCore::IntRect> >*, unsigned int) + 2814 (RenderLayer.cpp:2807) 14 com.apple.WebCore 0x0000000101f4f762 WebCore::RenderLayer::paintList(WTF::Vector<WebCore::RenderLayer*, 0ul>*, WebCore::RenderLayer*, WebCore::GraphicsContext*, WebCore::IntRect const&, unsigned int, WebCore::RenderObject*, WebCore::RenderRegion*, WTF::HashMap<WebCore::OverlapTestRequestClient*, WebCore::IntRect, WTF::PtrHash<WebCore::OverlapTestRequestClient*>, WTF::HashTraits<WebCore::OverlapTestRequestClient*>, WTF::HashTraits<WebCore::IntRect> >*, unsigned int) + 156 (RenderLayer.cpp:2865) 15 com.apple.WebCore 0x0000000101f58306 WebCore::RenderLayerBacking::paintIntoLayer(WebCore::RenderLayer*, WebCore::GraphicsContext*, WebCore::IntRect const&, unsigned int, WebCore::GraphicsLayerPaintingPhase, WebCore::RenderObject*) + 1782 (RenderLayerBacking.cpp:1169) 16 com.apple.WebCore 0x0000000101f58664 WebCore::RenderLayerBacking::paintContents(WebCore::GraphicsLayer const*, WebCore::GraphicsContext&, WebCore::GraphicsLayerPaintingPhase, WebCore::IntRect const&) + 464 (RenderLayerBacking.cpp:1218) 17 com.apple.WebCore 0x00000001017d3bf6 WebCore::GraphicsLayer::paintGraphicsLayerContents(WebCore::GraphicsContext&, WebCore::IntRect const&) + 94 (GraphicsLayer.cpp:284) 18 com.apple.WebCore 0x00000001017dd363 WebCore::GraphicsLayerCA::platformCALayerPaintContents(WebCore::GraphicsContext&, WebCore::IntRect const&) + 37 (GraphicsLayerCA.cpp:908) 19 com.apple.WebCore 0x00000001022a0fa4 drawLayerContents(CGContext*, CALayer*, WebCore::PlatformCALayer*) + 501 (WebLayer.mm:79) ...

Attachments
Patch (1.71 KB, patch) 2011-11-02 11:46 PDT, Simon Fraser (smfr)	andersca: review+	Details Formatted Diff Diff
View All Add attachment proposed patch, testcase, etc.

Radar WebKit Bug Importer

Comment 1 2011-11-02 11:13:02 PDT

<rdar://problem/10384540>

Simon Fraser (smfr)

Comment 2 2011-11-02 11:32:24 PDT

Bot shows that it's fast/inline/inline-box-adjust-position-crash2.html

Simon Fraser (smfr)

Comment 3 2011-11-02 11:46:39 PDT

Created attachment 113343 [details] Patch

Michael Saboff

Comment 4 2011-11-02 12:03:55 PDT

Looks to be the right place given the backtrace.

Simon Fraser (smfr)

Comment 5 2011-11-02 14:02:25 PDT

http://trac.webkit.org/changeset/99095

Note You need to log in before you can comment on or make changes to this bug.