Bug 88217

Summary:

Crash in WebCore::RenderView::getRetainedWidgets

Product:

WebKit

Reporter:

Antti Koivisto <koivisto>

Component:

Frames

Assignee:

Nobody <webkit-unassigned>

Status:

RESOLVED FIXED

Severity:

Normal

CC:

kling, zalan

Priority:

Keywords:

InRadar

Version:

528+ (Nightly build)

Hardware:

Unspecified

OS:

Unspecified

Attachments:

Description	Flags
patch	kenneth: review+

Antti Koivisto

Reported 2012-06-04 01:16:32 PDT

This has been seen on the field. Looks like RenderView is null. Don't know how to repro. Thread 0 name: Dispatch queue: com.apple.main-thread Thread 0 Crashed: 0 WebCore 0x3778ff90 WebCore::RenderView::getRetainedWidgets(WTF::Vector<WebCore::RenderWidget*, 0ul>&) (HashTable.h:315) 1 WebCore 0x3778ff20 WebCore::RenderView::updateWidgetPositions() (Vector.h:326) 2 WebCore 0x3779178e WebCore::FrameView::performPostLayoutTasks() (FrameView.cpp:2224) 3 WebCore 0x37771962 WebCore::FrameView::layout(bool) (FrameView.cpp:951) 4 WebCore 0x37915e02 WebCore::RenderFrameBase::layoutWithFlattening(bool, bool) (RenderFrameBase.cpp:50) 5 WebCore 0x3788e98a WebCore::RenderIFrame::layout() (RenderIFrame.cpp:119) 6 WebCore 0x37778330 WebCore::RenderBlock::layoutInlineChildren(bool, int&, int&) (RenderObject.h:573) 7 WebCore 0x37773a1c WebCore::RenderBlock::layoutBlock(bool, int) (RenderBlock.cpp:1269) 8 WebCore 0x37772d3a WebCore::RenderBlock::layout() (RenderBlock.cpp:1167) 9 WebCore 0x37775bd6 WebCore::RenderBlock::layoutBlockChild(WebCore::RenderBox*, WebCore::RenderBlock::MarginInfo&, int&, int&) (RenderBlock.cpp:2009) 10 WebCore 0x377751a8 WebCore::RenderBlock::layoutBlockChildren(bool, int&) (RenderBlock.cpp:1947) 11 WebCore 0x37773a28 WebCore::RenderBlock::layoutBlock(bool, int) (RenderBlock.cpp:1271) 12 WebCore 0x37772d3a WebCore::RenderBlock::layout() (RenderBlock.cpp:1167) 13 WebCore 0x37775bd6 WebCore::RenderBlock::layoutBlockChild(WebCore::RenderBox*, WebCore::RenderBlock::MarginInfo&, int&, int&) (RenderBlock.cpp:2009) 14 WebCore 0x377751a8 WebCore::RenderBlock::layoutBlockChildren(bool, int&) (RenderBlock.cpp:1947) 15 WebCore 0x37773a28 WebCore::RenderBlock::layoutBlock(bool, int) (RenderBlock.cpp:1271) 16 WebCore 0x37772d3a WebCore::RenderBlock::layout() (RenderBlock.cpp:1167) 17 WebCore 0x37775bd6 WebCore::RenderBlock::layoutBlockChild(WebCore::RenderBox*, WebCore::RenderBlock::MarginInfo&, int&, int&) (RenderBlock.cpp:2009) 18 WebCore 0x377751a8 WebCore::RenderBlock::layoutBlockChildren(bool, int&) (RenderBlock.cpp:1947) 19 WebCore 0x37773a28 WebCore::RenderBlock::layoutBlock(bool, int) (RenderBlock.cpp:1271) 20 WebCore 0x37772d3a WebCore::RenderBlock::layout() (RenderBlock.cpp:1167) 21 WebCore 0x37775bd6 WebCore::RenderBlock::layoutBlockChild(WebCore::RenderBox*, WebCore::RenderBlock::MarginInfo&, int&, int&) (RenderBlock.cpp:2009) 22 WebCore 0x377751a8 WebCore::RenderBlock::layoutBlockChildren(bool, int&) (RenderBlock.cpp:1947) 23 WebCore 0x37773a28 WebCore::RenderBlock::layoutBlock(bool, int) (RenderBlock.cpp:1271) 24 WebCore 0x37772d3a WebCore::RenderBlock::layout() (RenderBlock.cpp:1167) 25 WebCore 0x37775bd6 WebCore::RenderBlock::layoutBlockChild(WebCore::RenderBox*, WebCore::RenderBlock::MarginInfo&, int&, int&) (RenderBlock.cpp:2009) 26 WebCore 0x377751a8 WebCore::RenderBlock::layoutBlockChildren(bool, int&) (RenderBlock.cpp:1947) 27 WebCore 0x37773a28 WebCore::RenderBlock::layoutBlock(bool, int) (RenderBlock.cpp:1271) 28 WebCore 0x37772d3a WebCore::RenderBlock::layout() (RenderBlock.cpp:1167) 29 WebCore 0x378488e0 WebCore::RenderBlock::insertFloatingObject(WebCore::RenderBox*) (RenderObject.h:573) 30 WebCore 0x377a1bf0 WebCore::RenderBlock::LineBreaker::skipLeadingWhitespace(WebCore::BidiResolver<WebCore::InlineIterator, WebCore::BidiRun>&, WebCore::LineInfo const&, WebCore::RenderBlock::FloatingObject*, WebCore::LineWidth&) (RenderBlockLineLayout.cpp:1550) 31 WebCore 0x3779f6ba WebCore::RenderBlock::LineBreaker::nextLineBreak(WebCore::BidiResolver<WebCore::InlineIterator, WebCore::BidiRun>&, WebCore::LineInfo&, std::pair<WebCore::RenderText*, WebCore::LazyLineBreakIterator>&, WebCore::RenderBlock::FloatingObject*) (RenderBlockLineLayout.cpp:1845) 32 WebCore 0x3779e618 WebCore::RenderBlock::layoutRunsAndFloats(WebCore::LineLayoutState&, bool, WTF::Vector<WebCore::RenderBlock::FloatWithRect, 0ul>&) (RenderBlockLineLayout.cpp:948) 33 WebCore 0x37778372 WebCore::RenderBlock::layoutInlineChildren(bool, int&, int&) (RenderBlockLineLayout.cpp:1188) 34 WebCore 0x37773a1c WebCore::RenderBlock::layoutBlock(bool, int) (RenderBlock.cpp:1269) 35 WebCore 0x37772d3a WebCore::RenderBlock::layout() (RenderBlock.cpp:1167) 36 WebCore 0x37775bd6 WebCore::RenderBlock::layoutBlockChild(WebCore::RenderBox*, WebCore::RenderBlock::MarginInfo&, int&, int&) (RenderBlock.cpp:2009) 37 WebCore 0x377751a8 WebCore::RenderBlock::layoutBlockChildren(bool, int&) (RenderBlock.cpp:1947) 38 WebCore 0x37773a28 WebCore::RenderBlock::layoutBlock(bool, int) (RenderBlock.cpp:1271) 39 WebCore 0x37772d3a WebCore::RenderBlock::layout() (RenderBlock.cpp:1167) 40 WebCore 0x37775bd6 WebCore::RenderBlock::layoutBlockChild(WebCore::RenderBox*, WebCore::RenderBlock::MarginInfo&, int&, int&) (RenderBlock.cpp:2009) 41 WebCore 0x377751a8 WebCore::RenderBlock::layoutBlockChildren(bool, int&) (RenderBlock.cpp:1947) 42 WebCore 0x37773a28 WebCore::RenderBlock::layoutBlock(bool, int) (RenderBlock.cpp:1271) 43 WebCore 0x37772d3a WebCore::RenderBlock::layout() (RenderBlock.cpp:1167) 44 WebCore 0x37775bd6 WebCore::RenderBlock::layoutBlockChild(WebCore::RenderBox*, WebCore::RenderBlock::MarginInfo&, int&, int&) (RenderBlock.cpp:2009) 45 WebCore 0x377751a8 WebCore::RenderBlock::layoutBlockChildren(bool, int&) (RenderBlock.cpp:1947) 46 WebCore 0x37773a28 WebCore::RenderBlock::layoutBlock(bool, int) (RenderBlock.cpp:1271) 47 WebCore 0x37772d3a WebCore::RenderBlock::layout() (RenderBlock.cpp:1167) 48 WebCore 0x37772cf8 WebCore::RenderView::layout() (RenderView.cpp:130) 49 WebCore 0x37771ea8 WebCore::FrameView::layout(bool) (FrameView.cpp:1078) 50 WebCore 0x37781326 WebCore::Document::updateLayout() (Document.cpp:1704) 51 WebCore 0x37788666 WebCore::VisibleSelection::toNormalizedRange() const (Node.h:365) 52 WebKit 0x31bb782e -[WebFrame(WebPrivate) selectedDOMRange] (FrameSelection.h:190)

Attachments
patch (1.83 KB, patch) 2012-06-04 01:31 PDT, Antti Koivisto	kenneth: review+	Details Formatted Diff Diff
View All Add attachment proposed patch, testcase, etc.

Antti Koivisto

Comment 1 2012-06-04 01:17:04 PDT

<rdar://problem/10156800>

Antti Koivisto

Comment 2 2012-06-04 01:31:31 PDT

Created attachment 145536 [details] patch

alan

Comment 3 2012-06-04 02:17:56 PDT

Comment on attachment 145536 [details] patch LGTM. root->updateWidgetPositions() calls are null checked at other places too.

Antti Koivisto

Comment 4 2012-06-04 02:32:32 PDT

http://trac.webkit.org/changeset/119378

Note You need to log in before you can comment on or make changes to this bug.