Bug 112078 – SVG text path referencing parent text infinite loops

• Status: RESOLVED
• Resolution: FIXED
• Component: SVG

[Stephen Chenney]

See attached repro, which apparently infinitely loops then crashes in DRT.

Chromium https://code.google.com/p/chromium/issues/detail?id=181447

#8  0x0000000001165c5f in WTF::HashMap<WebCore::SVGElement*, WTF::OwnPtr<WTF::HashSet<WebCore::SVGElement*, WTF::PtrHash<WebCore::SVGElement*>, WTF::HashTraits<WebCore::SVGElement*> > >, WTF::PtrHash<WebCore::SVGElement*>, WTF::HashTraits<WebCore::SVGElement*>, WTF::HashTraits<WTF::OwnPtr<WTF::HashSet<WebCore::SVGElement*, WTF::PtrHash<WebCore::SVGElement*>, WTF::HashTraits<WebCore::SVGElement*> > > > >::find (this=
    0x10f36f18cc30, key=@0x7fffff7ff258: 0x10f36f23a8e0) at ../../third_party/WebKit/Source/WTF/wtf/HashMap.h:299
#9  0x00000000011640a8 in WebCore::SVGDocumentExtensions::setOfElementsReferencingTarget (this=0x10f36f18cb60, referencedElement=
    0x10f36f23a8e0) at ../../third_party/WebKit/Source/WebCore/svg/SVGDocumentExtensions.cpp:300
#10 0x00000000011fc22a in WebCore::removeFromCacheAndInvalidateDependencies (object=0x10f36f006578, needsLayout=false)
    at ../../third_party/WebKit/Source/WebCore/rendering/svg/RenderSVGResource.cpp:183
#11 0x00000000011fbff8 in WebCore::RenderSVGResource::markForLayoutAndParentResourceInvalidation (object=0x10f36f006578, needsLayout=false)
    at ../../third_party/WebKit/Source/WebCore/rendering/svg/RenderSVGResource.cpp:202
#12 0x00000000011fc2d4 in WebCore::removeFromCacheAndInvalidateDependencies (object=0x10f36f341038, needsLayout=false)
---Type <return> to continue, or q <return> to quit---
    at ../../third_party/WebKit/Source/WebCore/rendering/svg/RenderSVGResource.cpp:189
#13 0x00000000011fc024 in WebCore::RenderSVGResource::markForLayoutAndParentResourceInvalidation (object=0x10f36f006578, needsLayout=false)
    at ../../third_party/WebKit/Source/WebCore/rendering/svg/RenderSVGResource.cpp:207
#14 0x00000000011fc2d4 in WebCore::removeFromCacheAndInvalidateDependencies (object=0x10f36f341038, needsLayout=false)
    at ../../third_party/WebKit/Source/WebCore/rendering/svg/RenderSVGResource.cpp:189
#15 0x00000000011fc024 in WebCore::RenderSVGResource::markForLayoutAndParentResourceInvalidation (object=0x10f36f006578, needsLayout=false)
    at ../../third_party/WebKit/Source/WebCore/rendering/svg/RenderSVGResource.cpp:207
#16 0x00000000011fc2d4 in WebCore::removeFromCacheAndInvalidateDependencies (object=0x10f36f341038, needsLayout=false)
    at ../../third_party/WebKit/Source/WebCore/rendering/svg/RenderSVGResource.cpp:189
#17 0x00000000011fc024 in WebCore::RenderSVGResource::markForLayoutAndParentResourceInvalidation (object=0x10f36f006578, needsLayout=false)
    at ../../third_party/WebKit/Source/WebCore/rendering/svg/RenderSVGResource.cpp:207
#18 0x00000000011fc2d4 in WebCore::removeFromCacheAndInvalidateDependencies (object=0x10f36f341038, needsLayout=false)
    at ../../third_party/WebKit/Source/WebCore/rendering/svg/RenderSVGResource.cpp:189
#19 0x00000000011fc024 in WebCore::RenderSVGResource::markForLayoutAndParentResourceInvalidation (object=0x10f36f006578, needsLayout=false)
    at ../../third_party/WebKit/Source/WebCore/rendering/svg/RenderSVGResource.cpp:207
#20 0x00000000011fc2d4 in WebCore::removeFromCacheAndInvalidateDependencies (object=0x10f36f341038, needsLayout=false)
    at ../../third_party/WebKit/Source/WebCore/rendering/svg/RenderSVGResource.cpp:189
#21 0x00000000011fc024 in WebCore::RenderSVGResource::markForLayoutAndParentResourceInvalidation (object=0x10f36f006578, needsLayout=false)
    at ../../third_party/WebKit/Source/WebCore/rendering/svg/RenderSVGResource.cpp:207
#22 0x00000000011fc2d4 in WebCore::removeFromCacheAndInvalidateDependencies (object=0x10f36f341038, needsLayout=false)
    at ../../third_party/WebKit/Source/WebCore/rendering/svg/RenderSVGResource.cpp:189
#23 0x00000000011fc024 in WebCore::RenderSVGResource::markForLayoutAndParentResourceInvalidation (object=0x10f36f006578, needsLayout=false)
    at ../../third_party/WebKit/Source/WebCore/rendering/svg/RenderSVGResource.cpp:207

[Stephen Chenney]

Created attachment 192589 [details]
Layout test

[Stephen Chenney]

Created attachment 192609 [details]
Patch

[Stephen Chenney]

I also checked the case of a textpath with a path parent that it was referencing, but the crash did not happen.

[Philip Rogers]

Comment on attachment 192609 [details]
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=192609&action=review

R=me

> LayoutTests/svg/text/textpath-referencing-text-crash-expected.txt:6
>    + LF

Something is up here, these lines don't usually appear.

[Stephen Chenney]

Comment on attachment 192609 [details]
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=192609&action=review

>> LayoutTests/svg/text/textpath-referencing-text-crash-expected.txt:6
>>    + LF
> 
> Something is up here, these lines don't usually appear.

It's Chromium's svn properties file, I think, and safe to leave here.

[WebKit Review Bot]

Comment on attachment 192609 [details]
Patch

Clearing flags on attachment: 192609

Committed r146515: <http://trac.webkit.org/changeset/146515>

[WebKit Review Bot]

All reviewed patches have been landed.  Closing bug.

[Said Abou-Hallawa]

*** Bug 104634 has been marked as a duplicate of this bug. ***