Summary: | REGRESSION: Large rowspan causes WebKit to call abort() | ||||||||
---|---|---|---|---|---|---|---|---|---|
Product: | WebKit | Reporter: | jonathanjohnsson | ||||||
Component: | Tables | Assignee: | Darin Adler <darin> | ||||||
Status: | RESOLVED FIXED | ||||||||
Severity: | Normal | CC: | ap | ||||||
Priority: | P1 | Keywords: | HasReduction, InRadar, Regression | ||||||
Version: | 420+ | ||||||||
Hardware: | Mac | ||||||||
OS: | OS X 10.4 | ||||||||
Attachments: |
|
Description
jonathanjohnsson
2006-07-09 06:34:46 PDT
Created attachment 9295 [details]
Test case (will crash!)
I forgot to say that the crash reporter isn't invoked, so there is no crash log to attach. WebKit simply quits. Stack trace (from gdb): #1 0x9012dfb4 in abort () #2 0x01cdbb7c in WTF::VectorBuffer<WebCore::RenderTableSection::RowStruct, 0ul>::allocateBuffer (this=0x18a31c50, newCapacity=674227123) at /Users/ap/WebKit/WebKitBuild/Debug/JavaScriptCore.framework/PrivateHeaders/Vector.h:251 #3 0x01cdbd20 in WTF::Vector<WebCore::RenderTableSection::RowStruct, 0ul>::reserveCapacity (this=0x18a31c4c, newCapacity=674227123) at /Users/ap/WebKit/WebKitBuild/Debug/JavaScriptCore.framework/PrivateHeaders/Vector.h:536 #4 0x01cdbde8 in WTF::Vector<WebCore::RenderTableSection::RowStruct, 0ul>::expandCapacity (this=0x18a31c4c, newMinCapacity=674227123) at /Users/ap/WebKit/WebKitBuild/Debug/JavaScriptCore.framework/PrivateHeaders/Vector.h:493 #5 0x01cdbe90 in WTF::Vector<WebCore::RenderTableSection::RowStruct, 0ul>::resize (this=0x18a31c4c, size=674227123) at /Users/ap/WebKit/WebKitBuild/Debug/JavaScriptCore.framework/PrivateHeaders/Vector.h:522 #6 0x01a07788 in WebCore::RenderTableSection::ensureRows (this=0x18a31bec, numRows=674227123) at /Users/ap/WebKit/WebCore/rendering/RenderTableSection.cpp:150 BTW, we have mangleme and iExploder tests in WebKitTools/Scripts: run-mangleme-tests and run-iexploder-tests, I'm sure mangleme can find another problem with rowspans, since all this does is prevent the abort that checks for numeric overflow. Created attachment 9350 [details]
patch, including change log and a layout test
Comment on attachment 9350 [details]
patch, including change log and a layout test
r=me
Committed revision 15390. |