123337 – ASSERT_NOT_REACHED() is fired in WebCore::valueForLength

RESOLVED FIXED 123337

ASSERT_NOT_REACHED() is fired in WebCore::valueForLength

https://bugs.webkit.org/show_bug.cgi?id=123337

Summary ASSERT_NOT_REACHED() is fired in WebCore::valueForLength

Renata Hodovan

Reported 2013-10-25 06:36:39 PDT

Created attachment 215171 [details] Test case The following test fails on ToTT WebKit: <body style="-webkit-writing-mode: vertical-rl;" > <table> <td style="width: -webkit-fit-content;"> </td> </table> </body> The backtrace: Program received signal SIGSEGV, Segmentation fault. 0x00007ffff5d23529 in WTFCrash () at /home/reni/Data/REPOS/webkit_sec/Source/WTF/wtf/Assertions.cpp:342 342 *(int *)(uintptr_t)0xbbadbeef = 0; (gdb) bt #0 0x00007ffff5d23529 in WTFCrash () at /home/reni/Data/REPOS/webkit_sec/Source/WTF/wtf/Assertions.cpp:342 #1 0x00007ffff1317c81 in WebCore::valueForLength (length=..., maximumValue=..., renderView=0x93bea0, roundPercentages=false) at /home/reni/Data/REPOS/webkit_sec/Source/WebCore/css/LengthFunctions.cpp:113 #2 0x00007ffff1c309e9 in WebCore::RenderElement::valueForLength (this=0x11da740, length=..., maximumValue=..., roundPercentages=false) at /home/reni/Data/REPOS/webkit_sec/Source/WebCore/rendering/RenderElement.h:201 #3 0x00007ffff1d573ea in WebCore::RenderTableCell::logicalHeightForRowSizing (this=0x11da740) at /home/reni/Data/REPOS/webkit_sec/Source/WebCore/rendering/RenderTableCell.h:102 #4 0x00007ffff1d4fef5 in WebCore::RenderTableSection::calcRowLogicalHeight (this=0x11d6aa0) at /home/reni/Data/REPOS/webkit_sec/Source/WebCore/rendering/RenderTableSection.cpp:345 #5 0x00007ffff1d3cfcc in WebCore::RenderTable::layout (this=0x11d8510) at /home/reni/Data/REPOS/webkit_sec/Source/WebCore/rendering/RenderTable.cpp:458 #6 0x00007ffff1be82ed in WebCore::RenderBlockFlow::layoutBlockChild (this=0x1183020, child=..., marginInfo=..., previousFloatLogicalBottom=..., maxFloatLogicalBottom=...) at /home/reni/Data/REPOS/webkit_sec/Source/WebCore/rendering/RenderBlockFlow.cpp:596 #7 0x00007ffff1be7de4 in WebCore::RenderBlockFlow::layoutBlockChildren (this=0x1183020, relayoutChildren=true, maxFloatLogicalBottom=...) at /home/reni/Data/REPOS/webkit_sec/Source/WebCore/rendering/RenderBlockFlow.cpp:515 #8 0x00007ffff1be723b in WebCore::RenderBlockFlow::layoutBlock (this=0x1183020, relayoutChildren=true, pageLogicalHeight=...) at /home/reni/Data/REPOS/webkit_sec/Source/WebCore/rendering/RenderBlockFlow.cpp:362 #9 0x00007ffff1bb895d in WebCore::RenderBlock::layout (this=0x1183020) at /home/reni/Data/REPOS/webkit_sec/Source/WebCore/rendering/RenderBlock.cpp:1292 #10 0x00007ffff1be82ed in WebCore::RenderBlockFlow::layoutBlockChild (this=0x1182380, child=..., marginInfo=..., previousFloatLogicalBottom=..., maxFloatLogicalBottom=...) at /home/reni/Data/REPOS/webkit_sec/Source/WebCore/rendering/RenderBlockFlow.cpp:596 #11 0x00007ffff1be7de4 in WebCore::RenderBlockFlow::layoutBlockChildren (this=0x1182380, relayoutChildren=true, maxFloatLogicalBottom=...) at /home/reni/Data/REPOS/webkit_sec/Source/WebCore/rendering/RenderBlockFlow.cpp:515 #12 0x00007ffff1be723b in WebCore::RenderBlockFlow::layoutBlock (this=0x1182380, relayoutChildren=true, pageLogicalHeight=...) at /home/reni/Data/REPOS/webkit_sec/Source/WebCore/rendering/RenderBlockFlow.cpp:362 #13 0x00007ffff1bb895d in WebCore::RenderBlock::layout (this=0x1182380) at /home/reni/Data/REPOS/webkit_sec/Source/WebCore/rendering/RenderBlock.cpp:1292 #14 0x00007ffff1be82ed in WebCore::RenderBlockFlow::layoutBlockChild (this=0x93bea0, child=..., marginInfo=..., previousFloatLogicalBottom=..., maxFloatLogicalBottom=...) at /home/reni/Data/REPOS/webkit_sec/Source/WebCore/rendering/RenderBlockFlow.cpp:596 #15 0x00007ffff1be7de4 in WebCore::RenderBlockFlow::layoutBlockChildren (this=0x93bea0, relayoutChildren=true, maxFloatLogicalBottom=...) at /home/reni/Data/REPOS/webkit_sec/Source/WebCore/rendering/RenderBlockFlow.cpp:515 #16 0x00007ffff1be723b in WebCore::RenderBlockFlow::layoutBlock (this=0x93bea0, relayoutChildren=true, pageLogicalHeight=...) at /home/reni/Data/REPOS/webkit_sec/Source/WebCore/rendering/RenderBlockFlow.cpp:362 #17 0x00007ffff1bb895d in WebCore::RenderBlock::layout (this=0x93bea0) at /home/reni/Data/REPOS/webkit_sec/Source/WebCore/rendering/RenderBlock.cpp:1292 #18 0x00007ffff1d7cb87 in WebCore::RenderView::layoutContent (this=0x93bea0, state=...) at /home/reni/Data/REPOS/webkit_sec/Source/WebCore/rendering/RenderView.cpp:151 #19 0x00007ffff1d7d742 in WebCore::RenderView::layout (this=0x93bea0) at /home/reni/Data/REPOS/webkit_sec/Source/WebCore/rendering/RenderView.cpp:337 #20 0x00007ffff19381fb in WebCore::FrameView::layout (this=0x8cdab0, allowSubtree=true) at /home/reni/Data/REPOS/webkit_sec/Source/WebCore/page/FrameView.cpp:1255 #21 0x00007ffff13bcce5 in WebCore::Document::implicitClose (this=0x11f1010) at /home/reni/Data/REPOS/webkit_sec/Source/WebCore/dom/Document.cpp:2414 #22 0x00007ffff1826245 in WebCore::FrameLoader::checkCallImplicitClose (this=0x934538) at /home/reni/Data/REPOS/webkit_sec/Source/WebCore/loader/FrameLoader.cpp:850 #23 0x00007ffff1825fd9 in WebCore::FrameLoader::checkCompleted (this=0x934538) at /home/reni/Data/REPOS/webkit_sec/Source/WebCore/loader/FrameLoader.cpp:793 #24 0x00007ffff1825d34 in WebCore::FrameLoader::finishedParsing (this=0x934538) at /home/reni/Data/REPOS/webkit_sec/Source/WebCore/loader/FrameLoader.cpp:726 ---Type <return> to continue, or q <return> to quit--- #25 0x00007ffff13c40e3 in WebCore::Document::finishedParsing (this=0x11f1010) at /home/reni/Data/REPOS/webkit_sec/Source/WebCore/dom/Document.cpp:4374 #26 0x00007ffff16a0801 in WebCore::HTMLConstructionSite::finishedParsing (this=0x8d8308) at /home/reni/Data/REPOS/webkit_sec/Source/WebCore/html/parser/HTMLConstructionSite.cpp:352 #27 0x00007ffff16d8ddc in WebCore::HTMLTreeBuilder::finished (this=0x8d82f0) at /home/reni/Data/REPOS/webkit_sec/Source/WebCore/html/parser/HTMLTreeBuilder.cpp:2908 #28 0x00007ffff16a7a5e in WebCore::HTMLDocumentParser::end (this=0x11299d0) at /home/reni/Data/REPOS/webkit_sec/Source/WebCore/html/parser/HTMLDocumentParser.cpp:758 #29 0x00007ffff16a7b49 in WebCore::HTMLDocumentParser::attemptToRunDeferredScriptsAndEnd (this=0x11299d0) at /home/reni/Data/REPOS/webkit_sec/Source/WebCore/html/parser/HTMLDocumentParser.cpp:769 #30 0x00007ffff16a6791 in WebCore::HTMLDocumentParser::prepareToStopParsing (this=0x11299d0) at /home/reni/Data/REPOS/webkit_sec/Source/WebCore/html/parser/HTMLDocumentParser.cpp:212 #31 0x00007ffff16a7b8e in WebCore::HTMLDocumentParser::attemptToEnd (this=0x11299d0) at /home/reni/Data/REPOS/webkit_sec/Source/WebCore/html/parser/HTMLDocumentParser.cpp:781 #32 0x00007ffff16a7c47 in WebCore::HTMLDocumentParser::finish (this=0x11299d0) at /home/reni/Data/REPOS/webkit_sec/Source/WebCore/html/parser/HTMLDocumentParser.cpp:830 #33 0x00007ffff1818a58 in WebCore::DocumentWriter::end (this=0x1163da0) at /home/reni/Data/REPOS/webkit_sec/Source/WebCore/loader/DocumentWriter.cpp:245 #34 0x00007ffff18062be in WebCore::DocumentLoader::finishedLoading (this=0x1163d00, finishTime=0) at /home/reni/Data/REPOS/webkit_sec/Source/WebCore/loader/DocumentLoader.cpp:408 #35 0x00007ffff180602c in WebCore::DocumentLoader::notifyFinished (this=0x1163d00, resource=0x1179d50) at /home/reni/Data/REPOS/webkit_sec/Source/WebCore/loader/DocumentLoader.cpp:345 #36 0x00007ffff189c526 in WebCore::CachedResource::checkNotify (this=0x1179d50) at /home/reni/Data/REPOS/webkit_sec/Source/WebCore/loader/cache/CachedResource.cpp:369 #37 0x00007ffff189c600 in WebCore::CachedResource::finishLoading (this=0x1179d50) at /home/reni/Data/REPOS/webkit_sec/Source/WebCore/loader/cache/CachedResource.cpp:385 #38 0x00007ffff189905a in WebCore::CachedRawResource::finishLoading (this=0x1179d50, data=0x8fea10) at /home/reni/Data/REPOS/webkit_sec/Source/WebCore/loader/cache/CachedRawResource.cpp:94 #39 0x00007ffff1856e64 in WebCore::SubresourceLoader::didFinishLoading (this=0x117a2c0, finishTime=0) at /home/reni/Data/REPOS/webkit_sec/Source/WebCore/loader/SubresourceLoader.cpp:283 #40 0x00007ffff1853005 in WebCore::ResourceLoader::didFinishLoading (this=0x117a2c0, finishTime=0) at /home/reni/Data/REPOS/webkit_sec/Source/WebCore/loader/ResourceLoader.cpp:487 #41 0x00007ffff2528c7a in WebCore::readCallback (asyncResult=0x117f1b0, data=0x117ab80) at /home/reni/Data/REPOS/webkit_sec/Source/WebCore/platform/network/soup/ResourceHandleSoup.cpp:1328 #42 0x00007fffe898abc9 in async_ready_callback_wrapper (source_object=0x670980, res=0x117f1b0, user_data=0x117ab80) at ginputstream.c:530 #43 0x00007fffe89acccb in g_task_return_now (task=0x117f1b0) at gtask.c:1105 #44 complete_in_idle_cb (task=<optimized out>) at gtask.c:1114 #45 0x00007fffee09a473 in g_main_dispatch (context=0x117ee30) at gmain.c:3054 #46 g_main_context_dispatch (context=0x117ee30) at gmain.c:3630 #47 0x00007ffff75c8aee in _ecore_glib_select__locked (ecore_timeout=0x117ee30, efds=<optimized out>, wfds=<optimized out>, rfds=<optimized out>, ecore_fds=1, ctx=<optimized out>) at ecore_glib.c:171 #48 _ecore_glib_select (ecore_fds=1, rfds=<optimized out>, wfds=<optimized out>, efds=<optimized out>, ecore_timeout=0x117ee30) at ecore_glib.c:205 #49 0x00007ffff75c2cb9 in _ecore_main_select (timeout=<optimized out>) at ecore_main.c:1466 #50 0x00007ffff75c3789 in _ecore_main_loop_iterate_internal (once_only=0) at ecore_main.c:1860 ---Type <return> to continue, or q <return> to quit--- #51 0x00007ffff75c3b47 in ecore_main_loop_begin () at ecore_main.c:956 #52 0x0000000000406dfa in main (argc=2, argv=0x7fffffffdbd8) at /home/reni/Data/REPOS/webkit_sec/Tools/EWebLauncher/main.c:1044

Attachments
Test case (144 bytes, text/html) 2013-10-25 06:36 PDT, Renata Hodovan	no flags	Details
Patch (3.94 KB, patch) 2016-09-02 14:47 PDT, zalan	no flags	Details Formatted Diff Diff
Archive of layout-test-results from ews122 for ios-simulator-elcapitan-wk2 (7.08 MB, application/zip) 2016-09-02 16:20 PDT, Build Bot	no flags	Details
View All Add attachment proposed patch, testcase, etc.

Brent Fulgham

Comment 1 2016-08-03 13:08:52 PDT

This is still reproducible in r204037.

Radar WebKit Bug Importer

Comment 2 2016-08-03 13:09:15 PDT

<rdar://problem/27684121>

zalan

Comment 3 2016-09-02 14:47:27 PDT

Created attachment 287818 [details] Patch

Build Bot

Comment 4 2016-09-02 16:20:39 PDT

Comment on attachment 287818 [details] Patch Attachment 287818 [details] did not pass ios-sim-ews (ios-simulator-wk2): Output: http://webkit-queues.webkit.org/results/1996704 New failing tests: fast/scrolling/ios/scrollTo-at-page-load.html

Build Bot

Comment 5 2016-09-02 16:20:44 PDT

Created attachment 287831 [details] Archive of layout-test-results from ews122 for ios-simulator-elcapitan-wk2 The attached test failures were seen while running run-webkit-tests on the ios-sim-ews. Bot: ews122 Port: ios-simulator-elcapitan-wk2 Platform: Mac OS X 10.11.5

WebKit Commit Bot

Comment 6 2016-09-02 16:37:07 PDT

Comment on attachment 287818 [details] Patch Clearing flags on attachment: 287818 Committed r205384: <http://trac.webkit.org/changeset/205384>

WebKit Commit Bot

Comment 7 2016-09-02 16:37:12 PDT

All reviewed patches have been landed. Closing bug.

Note You need to log in before you can comment on or make changes to this bug.

Status RESOLVED

Resolution FIXED

Priority P2

Severity Normal

Classification Unclassified

Version 528+ (Nightly build)

Hardware Unspecified

OS Unspecified

Product WebKit

Component CSS

Assignee

zalan

Reported

2013-10-25 06:36 PDT

Modified

2016-09-02 16:37 PDT History

CC List

10 users Show

URL

Keywords InRadar

Depends on

Blocks

116980

Dependencies

tree graph