Bug 81868

Summary:	REGRESSION(r98542): crash when MatchedStyleDeclarationCache is resized
Product:	WebKit	Reporter:	Mike Lawther <mikelawther>
Component:	CSS	Assignee:	Nobody <webkit-unassigned>
Status:	RESOLVED CONFIGURATION CHANGED
Severity:	Normal	CC:	bfulgham, koivisto, webkit-bug-importer
Priority:	P2	Keywords:	InRadar
Version:	528+ (Nightly build)
Hardware:	Unspecified
OS:	Unspecified

Mike Lawther

Reported 2012-03-21 20:54:55 PDT

As reported in http://code.google.com/p/chromium/issues/detail?id=103653: We've been seeing crashes in Chrome with stacks like: 0x001270c2] WebCore::RenderStyle::~RenderStyle() 0x0030b8db] WebCore::CSSStyleSelector::MatchedStyleDeclarationCacheItem::operator=(WebCore::CSSStyleSelector::MatchedStyleDeclarationCacheItem const &) hashtable.h:969] WTF::HashTable<unsigned int,std::pair<unsigned int,WebCore::CSSStyleSelector::MatchedStyleDeclarationCacheItem>,WTF::PairFirstExtractor<std::pair<unsigned int,WebCore::CSSStyleSelector::MatchedStyleDeclarationCacheItem> >,WTF::IntHash<unsigned int>,WTF::PairHashTraits<WTF::HashTraits<unsigned int>,WTF::HashTraits<WebCore::CSSStyleSelector::MatchedStyleDeclarationCacheItem> >,WTF::HashTraits<unsigned int> >::rehash(int) hashtable.h:739] WTF::HashTable<unsigned int,std::pair<unsigned int,WebCore::CSSStyleSelector::MatchedStyleDeclarationCacheItem>,WTF::PairFirstExtractor<std::pair<unsigned int,WebCore::CSSStyleSelector::MatchedStyleDeclarationCacheItem> >,WTF::IntHash<unsigned int>,WTF::PairHashTraits<WTF::HashTraits<unsigned int>,WTF::HashTraits<WebCore::CSSStyleSelector::MatchedStyleDeclarationCacheItem> >,WTF::HashTraits<unsigned int> >::add<WTF::HashMapTranslator<WTF::PairHashTraits<WTF::HashTraits<unsigned int>,WTF::HashTraits<WebCore::CSSStyleSelector::MatchedStyleDeclarationCacheItem> >,WTF::IntHash<unsigned int> >,unsigned int,WebCore::CSSStyleSelector::MatchedStyleDeclarationCacheItem>(unsigned int const &,WebCore::CSSStyleSelector::MatchedStyleDeclarationCacheItem const &) cssstyleselector.cpp:2624] WebCore::CSSStyleSelector::addToMatchedDeclarationCache(WebCore::RenderStyle const *,WebCore::RenderStyle const *,unsigned int,WebCore::CSSStyleSelector::MatchResult const &) cssstyleselector.cpp:2717] WebCore::CSSStyleSelector::applyMatchedDeclarations(WebCore::CSSStyleSelector::MatchResult const &) cssstyleselector.cpp:1524] WebCore::CSSStyleSelector::styleForElement(WebCore::Element *,WebCore::RenderStyle *,bool,bool,WebCore::RenderRegion *) element.cpp:1037] WebCore::Element::styleForRenderer() element.cpp:1061] WebCore::Element::recalcStyle(WebCore::Node::StyleChange) element.cpp:1138] WebCore::Element::recalcStyle(WebCore::Node::StyleChange) element.cpp:1138] WebCore::Element::recalcStyle(WebCore::Node::StyleChange) It appears that the MatchedDeclarationCache gets resized, and while the MatchedStyleDeclarationCacheItems are being copied over (http://trac.webkit.org/browser/trunk/Source/JavaScriptCore/wtf/HashTable.h#L970), something goes wrong in a RenderStyle destructor. These crashes go as far back as Nov 2011, and started happening around the time http://trac.webkit.org/changeset/98542 went in.

Attachments
Add attachment proposed patch, testcase, etc.

Mike Lawther

Comment 1 2012-04-02 23:34:57 PDT

The issue reported in http://code.google.com/p/chromium/issues/detail?id=103653 seems related - 0x02851797 [chrome.dll + 0x00c21797] WebCore::DataRef<WebCore::SVGRenderStyle>::~DataRef<WebCore::SVGRenderStyle>() 0x0273cdf1 [chrome.dll + 0x00b0cdf1] WebCore::RenderStyle::`scalar deleting destructor'(unsigned int) 0x028c4273 [chrome.dll - refptr.h:116 WTF::RefPtr<WebCore::RenderStyle>::operator=(WTF::RefPtr<WebCore::RenderStyle> const &) 0x028c3fc0 [chrome.dll + 0x00c93fc0] WebCore::CSSStyleSelector::MatchedStyleDeclarationCacheItem::operator=(WebCore::CSSStyleSelector::MatchedStyleDeclarationCacheItem const &) 0x028c446c [chrome.dll - hashtable.h:767 WTF::HashTable<unsigned int,std::pair<unsigned int,WebCore::CSSStyleSelector::MatchedStyleDeclarationCacheItem>,WTF::PairFirstExtractor<std::pair<unsigned int,WebCore::CSSStyleSelector::MatchedStyleDeclarationCacheItem> >,WTF::IntHash<unsigned int>,WTF::PairHashTraits<WTF::HashTraits<unsigned int>,WTF::HashTraits<WebCore::CSSStyleSelector::MatchedStyleDeclarationCacheItem> >,WTF::HashTraits<unsigned int> >::reinsert(std::pair<unsigned int,WebCore::CSSStyleSelector::MatchedStyleDeclarationCacheItem> &) 0x028c4110 [chrome.dll - hashtable.h:909 WTF::HashTable<unsigned int,std::pair<unsigned int,WebCore::CSSStyleSelector::MatchedStyleDeclarationCacheItem>,WTF::PairFirstExtractor<std::pair<unsigned int,WebCore::CSSStyleSelector::MatchedStyleDeclarationCacheItem> >,WTF::IntHash<unsigned int>,WTF::PairHashTraits<WTF::HashTraits<unsigned int>,WTF::HashTraits<WebCore::CSSStyleSelector::MatchedStyleDeclarationCacheItem> >,WTF::HashTraits<unsigned int> >::expand() 0x028c3e4c [chrome.dll - hashtable.h:701 WTF::HashTable<unsigned int,std::pair<unsigned int,WebCore::CSSStyleSelector::MatchedStyleDeclarationCacheItem>,WTF::PairFirstExtractor<std::pair<unsigned int,WebCore::CSSStyleSelector::MatchedStyleDeclarationCacheItem> >,WTF::IntHash<unsigned int>,WTF::PairHashTraits<WTF::HashTraits<unsigned int>,WTF::HashTraits<WebCore::CSSStyleSelector::MatchedStyleDeclarationCacheItem> >,WTF::HashTraits<unsigned int> >::add<unsigned int,WebCore::CSSStyleSelector::MatchedStyleDeclarationCacheItem,WTF::HashMapTranslator<std::pair<unsigned int,WebCore::CSSStyleSelector::MatchedStyleDeclarationCacheItem>,WTF::PairHashTraits<WTF::HashTraits<unsigned int>,WTF::HashTraits<WebCore::CSSStyleSelector::MatchedStyleDeclarationCacheItem> >,WTF::IntHash<unsigned int> > >(unsigned int const &,WebCore::CSSStyleSelector::MatchedStyleDeclarationCacheItem const &) 0x028bbba9 [chrome.dll - cssstyleselector.cpp:2228 WebCore::CSSStyleSelector::addToMatchedDeclarationCache(WebCore::RenderStyle const *,unsigned int,WebCore::CSSStyleSelector::MatchResult const &) 0x028bbe22 [chrome.dll - cssstyleselector.cpp:2300 WebCore::CSSStyleSelector::applyMatchedDeclarations(WebCore::CSSStyleSelector::MatchResult const &) 0x028b9d41 [chrome.dll - cssstyleselector.cpp:1249 WebCore::CSSStyleSelector::styleForElement(WebCore::Element *,WebCore::RenderStyle *,bool,bool)

Brent Fulgham

Comment 2 2022-07-13 15:31:59 PDT

This code has been significantly refactored since this patch was proposed. There doesn't seem to be any action we can take here.

Radar WebKit Bug Importer

Comment 3 2022-07-13 15:32:16 PDT

<rdar://problem/96977515>

Note You need to log in before you can comment on or make changes to this bug.