Bug 105371 - Crash in TextTrack::trackIndexRelativeToRenderedTracks()
Summary: Crash in TextTrack::trackIndexRelativeToRenderedTracks()
Status: RESOLVED FIXED
Alias: None
Product: WebKit
Classification: Unclassified
Component: Media (show other bugs)
Version: 528+ (Nightly build)
Hardware: Unspecified Unspecified
: P2 Normal
Assignee: Eric Carlson
URL: http://build.webkit.org/results/Apple...
Keywords: MakingBotsRed
Depends on:
Blocks:
 
Reported: 2012-12-18 17:37 PST by Simon Fraser (smfr)
Modified: 2012-12-21 01:01 PST (History)
11 users (show)

See Also:


Attachments
Proposed patch (8.79 KB, patch)
2012-12-19 12:50 PST, Eric Carlson
dino: review+
webkit-ews: commit-queue-
Details | Formatted Diff | Diff
Put "#if ENABLE(VIDEO_TRACK)" around new code. (8.83 KB, patch)
2012-12-19 13:23 PST, Eric Carlson
no flags Details | Formatted Diff | Diff

Note You need to log in before you can comment on or make changes to this bug.
Description Simon Fraser (smfr) 2012-12-18 17:37:16 PST
CRASHING TEST: media/video-controls-captions-trackmenu.html

Process:         DumpRenderTree [47704]
Path:            /Volumes/VOLUME/*/DumpRenderTree
Identifier:      DumpRenderTree
Version:         0
Code Type:       X86-64 (Native)
Parent Process:  Python [46425]
User ID:         501

Date/Time:       2012-12-18 17:18:36.095 -0800
OS Version:      Mac OS X 10.8.2 (12C54)
Report Version:  10

Crashed Thread:  0  Dispatch queue: com.apple.main-thread

Exception Type:  EXC_BAD_ACCESS (SIGSEGV)
Exception Codes: KERN_INVALID_ADDRESS at 0x00000000bbadbeef

VM Regions Near 0xbbadbeef:
--> 
    __TEXT                 0000000104bee000-0000000104c8a000 [  624K] r-x/rwx SM=COW  /Volumes/VOLUME/*

Application Specific Information:
CRASHING TEST: media/video-controls-captions-trackmenu.html

Thread 0 Crashed:: Dispatch queue: com.apple.main-thread
0   com.apple.WebCore             	0x0000000107e81af5 WebCore::TextTrack::trackIndexRelativeToRenderedTracks() + 85 (TextTrack.cpp:332)
1   com.apple.WebCore             	0x0000000107e8317f WebCore::TextTrackCue::calculateComputedLinePosition() + 127 (TextTrackCue.cpp:578)
2   com.apple.WebCore             	0x0000000107a82c8e WebCore::RenderTextTrackCue::initializeLayoutParameters(WebCore::InlineFlowBox*&, WebCore::LayoutUnit&, WebCore::LayoutUnit&) + 318 (RenderTextTrackCue.cpp:71)
3   com.apple.WebCore             	0x0000000107a82a5e WebCore::RenderTextTrackCue::repositionCueSnapToLinesSet() + 62 (RenderTextTrackCue.cpp:203)
4   com.apple.WebCore             	0x0000000107a829ef WebCore::RenderTextTrackCue::layout() + 303 (RenderTextTrackCue.cpp:49)
5   com.apple.WebCore             	0x0000000106c23876 WebCore::RenderObject::layoutIfNeeded() + 54 (RenderObject.h:687)
6   com.apple.WebCore             	0x00000001077d9411 WebCore::RenderBlock::layoutPositionedObjects(bool) + 673 (RenderBlock.cpp:2653)
7   com.apple.WebCore             	0x00000001077d6159 WebCore::RenderBlock::layoutBlock(bool, WebCore::LayoutUnit) + 2537 (RenderBlock.cpp:1568)
8   com.apple.WebCore             	0x00000001077d4d0e WebCore::RenderBlock::layout() + 126 (RenderBlock.cpp:1360)
9   com.apple.WebCore             	0x000000010796361f WebCore::RenderTextTrackContainerElement::layout() + 31 (RenderMediaControlElements.cpp:94)
10  com.apple.WebCore             	0x0000000106c23876 WebCore::RenderObject::layoutIfNeeded() + 54 (RenderObject.h:687)
11  com.apple.WebCore             	0x00000001078a92a5 WebCore::RenderDeprecatedFlexibleBox::layoutVerticalBox(bool) + 1941 (RenderDeprecatedFlexibleBox.cpp:713)
12  com.apple.WebCore             	0x00000001078a6342 WebCore::RenderDeprecatedFlexibleBox::layoutBlock(bool, WebCore::LayoutUnit) + 1010 (RenderDeprecatedFlexibleBox.cpp:283)
13  com.apple.WebCore             	0x00000001077d4d0e WebCore::RenderBlock::layout() + 126 (RenderBlock.cpp:1360)
14  com.apple.WebCore             	0x0000000107962ec6 WebCore::RenderMedia::layout() + 1078 (RenderMedia.cpp:83)
Comment 1 Simon Fraser (smfr) 2012-12-18 18:04:25 PST
Skipped in Debug in http://trac.webkit.org/changeset/138094
Comment 2 Simon Fraser (smfr) 2012-12-19 11:14:08 PST
This is followed by a crash in Release:

http://build.webkit.org/results/Apple%20Lion%20Release%20WK1%20(Tests)/r138178%20(7486)/media/video-controls-captions-trackmenu-crash-log.txt

Exception Type:  EXC_BAD_ACCESS (SIGSEGV)
Exception Codes: KERN_INVALID_ADDRESS at 0x0000000000000258

VM Regions Near 0x258:
--> 
    __TEXT                 00000001016d8000-0000000101738000 [  384K] r-x/rwx SM=COW  /Volumes/VOLUME/*

Application Specific Information:
CRASHING TEST: media/video-controls-captions-trackmenu.html
objc[93675]: garbage collection is OFF

Thread 0 Crashed:: Dispatch queue: com.apple.main-thread
0   com.apple.WebCore             	0x00000001024b7a9b WebCore::HTMLMediaElement::textTracks() + 27 (RefPtr.h:66)
1   com.apple.WebCore             	0x0000000102d271fd WebCore::TextTrack::trackIndexRelativeToRenderedTracks() + 29 (TextTrack.cpp:335)
2   com.apple.WebCore             	0x0000000102d2811d WebCore::TextTrackCue::calculateComputedLinePosition() + 45 (TextTrackCue.cpp:584)
3   com.apple.WebCore             	0x0000000102b3b1b2 WebCore::RenderTextTrackCue::initializeLayoutParameters(WebCore::InlineFlowBox*&, WebCore::LayoutUnit&, WebCore::LayoutUnit&) + 130 (RenderTextTrackCue.cpp:74)
Comment 3 Eric Carlson 2012-12-19 12:50:07 PST
Created attachment 180211 [details]
Proposed patch
Comment 4 Early Warning System Bot 2012-12-19 13:15:12 PST
Comment on attachment 180211 [details]
Proposed patch

Attachment 180211 [details] did not pass qt-ews (qt):
Output: http://queues.webkit.org/results/15405766
Comment 5 Early Warning System Bot 2012-12-19 13:16:05 PST
Comment on attachment 180211 [details]
Proposed patch

Attachment 180211 [details] did not pass qt-wk2-ews (qt):
Output: http://queues.webkit.org/results/15410752
Comment 6 Eric Carlson 2012-12-19 13:23:48 PST
Created attachment 180216 [details]
Put "#if ENABLE(VIDEO_TRACK)" around new code.
Comment 7 WebKit Review Bot 2012-12-19 21:51:43 PST
Comment on attachment 180216 [details]
Put "#if ENABLE(VIDEO_TRACK)" around new code.

Clearing flags on attachment: 180216

Committed r138224: <http://trac.webkit.org/changeset/138224>
Comment 8 WebKit Review Bot 2012-12-19 21:51:46 PST
All reviewed patches have been landed.  Closing bug.
Comment 9 Ryosuke Niwa 2012-12-20 14:43:08 PST
Iā€™m seeing another crash on /media/track/track-prefer-captions-crash.html:

http://build.webkit.org/results/Apple%20MountainLion%20Release%20WK1%20(Tests)/r138293%20(5052)/media/track/track-prefer-captions-crash-log.txt
0   com.apple.WebCore             	0x0000000106c50933 WebCore::HTMLMediaElement::removeTrack(WebCore::TextTrack*) + 67 (HTMLMediaElement.cpp:2805)
1   com.apple.WebCore             	0x0000000106c50e7d WebCore::HTMLMediaElement::didRemoveTrack(WebCore::HTMLTrackElement*) + 93 (HTMLMediaElement.cpp:4267)
2   com.apple.WebCore             	0x0000000106c9a6a5 WebCore::HTMLTrackElement::removedFrom(WebCore::ContainerNode*) + 85 (HTMLTrackElement.cpp:92)
3   com.apple.WebCore             	0x00000001068ff346 WebCore::Private::NodeRemovalDispatcher<WebCore::Node, WebCore::ContainerNode, true>::dispatch(WebCore::Node*, WebCore::ContainerNode*) + 70 (Node.h:724)
4   com.apple.WebCore             	0x00000001068fecca void WebCore::removeAllChildrenInContainer<WebCore::Node, WebCore::ContainerNode>(WebCore::ContainerNode*) + 378 (TreeShared.h:77)
5   com.apple.WebCore             	0x00000001069e854b WebCore::Document::removedLastRef() + 539 (OwnPtr.h:72)
6   com.apple.WebCore             	0x0000000106f458cb WebCore::JSNodeOwner::finalize(JSC::Handle<JSC::Unknown>, void*) + 59 (JSNode.h:69)
7   com.apple.JavaScriptCore      	0x0000000106255f4c JSC::WeakBlock::sweep() + 108 (WeakImpl.h:84)
8   com.apple.JavaScriptCore      	0x00000001062562b8 JSC::WeakSet::sweep() + 40 (DoublyLinkedList.h:118)
9   com.apple.JavaScriptCore      	0x000000010618d2d8 JSC::MarkedBlock::sweep(JSC::MarkedBlock::SweepMode) + 24 (MarkedBlock.cpp:112)
10  com.apple.JavaScriptCore      	0x0000000106254fa3 JSC::MarkedAllocator::allocateSlowCase(unsigned long) + 99 (MarkedAllocator.cpp:34)
11  com.apple.JavaScriptCore      	0x000000010614a52d JSC::FunctionPrototype::create(JSC::ExecState*, JSC::JSGlobalObject*, JSC::Structure*) + 77 (MarkedAllocator.h:78)
12  com.apple.JavaScriptCore      	0x0000000106145c21 JSC::JSGlobalObject::reset(JSC::JSValue) + 209 (JSGlobalObject.cpp:202)
13  com.apple.WebCore             	0x0000000106e55ae3 WebCore::JSDOMWindowBase::finishCreation(JSC::JSGlobalData&, WebCore::JSDOMWindowShell*) + 35 (JSDOMWindowBase.cpp:69)
14  com.apple.WebCore             	0x0000000106e5a53f WebCore::JSDOMWindow::create(JSC::JSGlobalData&, JSC::Structure*, WTF::PassRefPtr<WebCore::DOMWindow>, WebCore::JSDOMWindowShell*) + 175 (JSDOMWindow.h:42)
15  com.apple.WebCore             	0x0000000106e5a23c WebCore::JSDOMWindowShell::setWindow(WTF::PassRefPtr<WebCore::DOMWindow>) + 380 (JSDOMWindowShell.cpp:75)
16  com.apple.WebCore             	0x0000000107328124 WebCore::ScriptController::clearWindowShell(WebCore::DOMWindow*, bool) + 276 (PassRefPtr.h:68)
17  com.apple.WebCore             	0x0000000106b8dfaf WebCore::FrameLoader::clear(WebCore::Document*, bool, bool, bool) + 271 (FrameLoader.cpp:568)
18  com.apple.WebCore             	0x0000000106a14f71 WebCore::DocumentWriter::begin(WebCore::KURL const&, bool, WebCore::Document*) + 369 (DocumentWriter.cpp:135)
19  com.apple.WebCore             	0x0000000106a04beb WebCore::DocumentLoader::commitData(char const*, unsigned long) + 91 (RefPtr.h:56)
20  com.apple.WebKit              	0x000000010656c7b4 -[WebHTMLRepresentation receivedData:withDataSource:] + 100 (WebHTMLRepresentation.mm:186)
21  com.apple.WebKit              	0x000000010653f49d -[WebDataSource(WebInternal) _receivedData:] + 77 (WebDataSource.mm:216)
22  com.apple.WebKit              	0x00000001065574f7 WebFrameLoaderClient::committedLoad(WebCore::DocumentLoader*, char const*, int) + 103 (WebFrameLoaderClient.mm:841)
23  com.apple.WebCore             	0x0000000106a04e30 WebCore::DocumentLoader::commitLoad(char const*, int) + 144 (RefCounted.h:148)
24  com.apple.WebCore             	0x00000001070ef173 WebCore::MainResourceLoader::dataReceived(WebCore::CachedResource*, char const*, int) + 787 (MainResourceLoader.cpp:497)
25  com.apple.WebCore             	0x00000001068bb5c5 WebCore::CachedRawResource::data(WTF::PassRefPtr<WebCore::ResourceBuffer>, bool) + 309 (CachedRawResource.cpp:70)
26  com.apple.WebCore             	0x00000001073ff1fa WebCore::SubresourceLoader::sendDataToResource(char const*, int) + 122 (PassRefPtr.h:68)
27  com.apple.WebCore             	0x00000001073ff2dc WebCore::SubresourceLoader::didReceiveData(char const*, int, long long, bool) + 76 (ResourceLoader.h:142)
28  com.apple.WebCore             	0x0000000107308c38 WebCore::ResourceLoader::didReceiveData(WebCore::ResourceHandle*, char const*, int, int) + 136 (InspectorInstrumentation.h:260)
29  com.apple.Foundation          	0x00007fff87ee6f58 __65-[NSURLConnectionInternal _withConnectionAndDelegate:onlyActive:]_block_invoke_0 + 28
30  com.apple.Foundation          	0x00007fff87ee6e9c -[NSURLConnectionInternal _withConnectionAndDelegate:onlyActive:] + 227
31  com.apple.Foundation          	0x00007fff87ee6d98 -[NSURLConnectionInternal _withActiveConnectionAndDelegate:] + 63
32  com.apple.Foundation          	0x00007fff87ee992b _NSURLConnectionDidReceiveData_LengthReceived + 86
33  com.apple.CFNetwork           	0x00007fff8971d7b1 ___delegate_didReceiveDataArray_block_invoke_0 + 132
34  com.apple.CFNetwork           	0x00007fff89710753 ___withDelegateAsync_block_invoke_0 + 90
35  com.apple.CFNetwork           	0x00007fff8979f2ca __block_global_1 + 28
36  com.apple.CoreFoundation      	0x00007fff92f8c724 CFArrayApplyFunction + 68
37  com.apple.CFNetwork           	0x00007fff89701a6c RunloopBlockContext::perform() + 126
38  com.apple.CFNetwork           	0x00007fff8970194b MultiplexerSource::perform() + 221
39  com.apple.CoreFoundation      	0x00007fff92f6e101 __CFRUNLOOP_IS_CALLING_OUT_TO_A_SOURCE0_PERFORM_FUNCTION__ + 17
40  com.apple.CoreFoundation      	0x00007fff92f6da25 __CFRunLoopDoSources0 + 245
41  com.apple.CoreFoundation      	0x00007fff92f90dc5 __CFRunLoopRun + 789
42  com.apple.CoreFoundation      	0x00007fff92f906b2 CFRunLoopRunSpecific + 290
43  com.apple.Foundation          	0x00007fff87f6489e -[NSRunLoop(NSRunLoop) runMode:beforeDate:] + 268
44  DumpRenderTree                	0x0000000105e714c9 runTest(std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> > const&) + 1624 (DumpRenderTree.mm:1378)
45  DumpRenderTree                	0x0000000105e70c54 dumpRenderTree(int, char const**) + 1855 (DumpRenderTree.mm:842)
46  DumpRenderTree                	0x0000000105e71832 main + 86 (DumpRenderTree.mm:927)
47  libdyld.dylib                 	0x00007fff89a677e1 start + 1
Comment 10 Ryosuke Niwa 2012-12-21 00:38:18 PST
Here's an interesting stack trace.
Thread 0 Crashed:: Dispatch queue: com.apple.main-thread
0   com.apple.WebCore             	0x000000010ce8f631 WebCore::TreeShared<WebCore::Node, WebCore::ContainerNode>::ref() + 161 (TreeShared.h:64)
1   com.apple.WebCore             	0x000000010e02f8cc WebCore::Node::refEventTarget() + 28 (Node.cpp:848)
2   com.apple.WebCore             	0x000000010d2da016 WebCore::EventTarget::ref() + 22 (EventTarget.h:105)
3   com.apple.WebCore             	0x000000010d2d9ff2 void WTF::refIfNotNull<WebCore::EventTarget>(WebCore::EventTarget*) + 50 (PassRefPtr.h:48)
4   com.apple.WebCore             	0x000000010d2d9fb4 WTF::PassRefPtr<WebCore::EventTarget>::PassRefPtr(WebCore::EventTarget*) + 36 (PassRefPtr.h:61)
5   com.apple.WebCore             	0x000000010d2b733d WTF::PassRefPtr<WebCore::EventTarget>::PassRefPtr(WebCore::EventTarget*) + 29 (PassRefPtr.h:61)
6   com.apple.WebCore             	0x000000010d74b56d WebCore::HTMLMediaElement::scheduleEvent(WTF::AtomicString const&) + 109 (HTMLMediaElement.cpp:639)
7   com.apple.WebCore             	0x000000010d74fb5b WebCore::HTMLMediaElement::scheduleTimeupdateEvent(bool) + 171 (HTMLMediaElement.cpp:2718)
8   com.apple.WebCore             	0x000000010d74cb53 WebCore::HTMLMediaElement::updateActiveTextTrackCues(float) + 1075 (HTMLMediaElement.cpp:1146)
9   com.apple.WebCore             	0x000000010d750a63 WebCore::HTMLMediaElement::endIgnoringTrackDisplayUpdateRequests() + 163 (HTMLMediaElement.cpp:1385)
10  com.apple.WebCore             	0x000000010d76d6ed WebCore::TrackDisplayUpdateScope::~TrackDisplayUpdateScope() + 109 (HTMLMediaElement.cpp:217)
11  com.apple.WebCore             	0x000000010d75b6c5 WebCore::TrackDisplayUpdateScope::~TrackDisplayUpdateScope() + 21 (HTMLMediaElement.cpp:217)
12  com.apple.WebCore             	0x000000010d754dd1 WebCore::HTMLMediaElement::removeTrack(WebCore::TextTrack*) + 129 (HTMLMediaElement.cpp:2809)
13  com.apple.WebCore             	0x000000010d755417 WebCore::HTMLMediaElement::didRemoveTrack(WebCore::HTMLTrackElement*) + 423 (HTMLMediaElement.cpp:2928)
14  com.apple.WebCore             	0x000000010d7b85d9 WebCore::HTMLTrackElement::removedFrom(WebCore::ContainerNode*) + 105 (HTMLTrackElement.cpp:88)
15  com.apple.WebCore             	0x000000010d0917b2 WebCore::ChildNodeRemovalNotifier::notifyNodeRemovedFromDocument(WebCore::Node*) + 130 (ContainerNodeAlgorithms.h:239)
16  com.apple.WebCore             	0x000000010d08ef9b WebCore::ChildNodeRemovalNotifier::notify(WebCore::Node*) + 59 (ContainerNodeAlgorithms.h:256)
17  com.apple.WebCore             	0x000000010d091214 WebCore::Private::NodeRemovalDispatcher<WebCore::Node, WebCore::ContainerNode, true>::dispatch(WebCore::Node*, WebCore::ContainerNode*) + 116 (ContainerNodeAlgorithms.h:143)
18  com.apple.WebCore             	0x000000010d09115b void WebCore::Private::addChildNodesToDeletionQueue<WebCore::Node, WebCore::ContainerNode>(WebCore::Node*&, WebCore::Node*&, WebCore::ContainerNode*) + 331 (ContainerNodeAlgorithms.h:183)
19  com.apple.WebCore             	0x000000010d08e9fa void WebCore::removeAllChildrenInContainer<WebCore::Node, WebCore::ContainerNode>(WebCore::ContainerNode*) + 250 (ContainerNodeAlgorithms.h:104)
20  com.apple.WebCore             	0x000000010d089b15 WebCore::ContainerNode::removeAllChildren() + 21 (ContainerNode.cpp:95)
21  com.apple.WebCore             	0x000000010d29d070 WebCore::Document::removedLastRef() + 448 (Document.cpp:710)

The problem is that we can't dispatch an event inside removedFrom(). When removedFrom is called, m_deletionHasBegun had already set to true and nobody can ref that node.

We need to find some other way of fixing this bug.
Comment 11 Ryosuke Niwa 2012-12-21 00:49:24 PST
If we really do have a requirement to fire an event at this timing, then we need to invent a new class like ChildFrameDisconnector (see http://trac.webkit.org/changeset/116629) and use that instead.