Bug 133500 - Regression(r169547): Crash in WebCore::styleForFirstLetter() while loading http://thenextweb.com/apple/2014/02/21/apple-confirms-acquired-testflight-creator-burstly/
Summary: Regression(r169547): Crash in WebCore::styleForFirstLetter() while loading ht...
Status: RESOLVED FIXED
Alias: None
Product: WebKit
Classification: Unclassified
Component: CSS (show other bugs)
Version: 528+ (Nightly build)
Hardware: Unspecified Unspecified
: P2 Normal
Assignee: Benjamin Poulain
URL: http://thenextweb.com/apple/2014/02/2...
Keywords: InRadar
Depends on:
Blocks:
 
Reported: 2014-06-03 20:54 PDT by zalan
Modified: 2014-06-04 15:09 PDT (History)
9 users (show)

See Also:


Attachments
Patch (7.50 KB, patch)
2014-06-04 14:37 PDT, Benjamin Poulain
no flags Details | Formatted Diff | Diff

Note You need to log in before you can comment on or make changes to this bug.
Description zalan 2014-06-03 20:54:06 PDT
WebKit crashes while loading http://thenextweb.com/apple/2014/02/21/apple-confirms-acquired-testflight-creator-burstly/ 

Exception Type:  EXC_BAD_ACCESS (SIGSEGV)
Exception Codes: KERN_INVALID_ADDRESS at 0x0000000000000058

Thread 0 Crashed:: Dispatch queue: com.apple.main-thread
0   com.apple.WebCore             	0x00000001074e24b1 WebCore::styleForFirstLetter(WebCore::RenderObject*, WebCore::RenderObject*) + 113
1   com.apple.WebCore             	0x00000001074e24f6 WebCore::RenderBlock::createFirstLetterRenderer(WebCore::RenderObject*, WebCore::RenderText*) + 38
2   com.apple.WebCore             	0x0000000106a6ecb6 WebCore::RenderBlock::updateFirstLetter() + 150
3   com.apple.WebCore             	0x0000000106a6e9c6 WebCore::RenderBlock::layout() + 38
4   com.apple.WebCore             	0x00000001074eaa75 WebCore::RenderBlockFlow::layoutBlockChild(WebCore::RenderBox&, WebCore::RenderBlockFlow::MarginInfo&, WebCore::LayoutUnit&, WebCore::LayoutUnit&) + 725
5   com.apple.WebCore             	0x00000001074e9bda WebCore::RenderBlockFlow::layoutBlockChildren(bool, WebCore::LayoutUnit&) + 442
6   com.apple.WebCore             	0x00000001074e8fe8 WebCore::RenderBlockFlow::layoutBlock(bool, WebCore::LayoutUnit) + 728
7   com.apple.WebCore             	0x0000000106a6e9d6 WebCore::RenderBlock::layout() + 54
8   com.apple.WebCore             	0x00000001074eaa75 WebCore::RenderBlockFlow::layoutBlockChild(WebCore::RenderBox&, WebCore::RenderBlockFlow::MarginInfo&, WebCore::LayoutUnit&, WebCore::LayoutUnit&) + 725
9   com.apple.WebCore             	0x00000001074e9bda WebCore::RenderBlockFlow::layoutBlockChildren(bool, WebCore::LayoutUnit&) + 442
10  com.apple.WebCore             	0x00000001074e8fe8 WebCore::RenderBlockFlow::layoutBlock(bool, WebCore::LayoutUnit) + 728
11  com.apple.WebCore             	0x0000000106a6e9d6 WebCore::RenderBlock::layout() + 54
12  com.apple.WebCore             	0x00000001074eaa75 WebCore::RenderBlockFlow::layoutBlockChild(WebCore::RenderBox&, WebCore::RenderBlockFlow::MarginInfo&, WebCore::LayoutUnit&, WebCore::LayoutUnit&) + 725
13  com.apple.WebCore             	0x00000001074e9bda WebCore::RenderBlockFlow::layoutBlockChildren(bool, WebCore::LayoutUnit&) + 442
14  com.apple.WebCore             	0x00000001074e8fe8 WebCore::RenderBlockFlow::layoutBlock(bool, WebCore::LayoutUnit) + 728
15  com.apple.WebCore             	0x0000000106a6e9d6 WebCore::RenderBlock::layout() + 54
16  com.apple.WebCore             	0x00000001074eaa75 WebCore::RenderBlockFlow::layoutBlockChild(WebCore::RenderBox&, WebCore::RenderBlockFlow::MarginInfo&, WebCore::LayoutUnit&, WebCore::LayoutUnit&) + 725
17  com.apple.WebCore             	0x00000001074e9bda WebCore::RenderBlockFlow::layoutBlockChildren(bool, WebCore::LayoutUnit&) + 442
18  com.apple.WebCore             	0x00000001074e8fe8 WebCore::RenderBlockFlow::layoutBlock(bool, WebCore::LayoutUnit) + 728
19  com.apple.WebCore             	0x0000000106a6e9d6 WebCore::RenderBlock::layout() + 54
20  com.apple.WebCore             	0x00000001074eaa75 WebCore::RenderBlockFlow::layoutBlockChild(WebCore::RenderBox&, WebCore::RenderBlockFlow::MarginInfo&, WebCore::LayoutUnit&, WebCore::LayoutUnit&) + 725
21  com.apple.WebCore             	0x00000001074e9bda WebCore::RenderBlockFlow::layoutBlockChildren(bool, WebCore::LayoutUnit&) + 442
22  com.apple.WebCore             	0x00000001074e8fe8 WebCore::RenderBlockFlow::layoutBlock(bool, WebCore::LayoutUnit) + 728
23  com.apple.WebCore             	0x0000000106a6e9d6 WebCore::RenderBlock::layout() + 54
24  com.apple.WebCore             	0x00000001074eaa75 WebCore::RenderBlockFlow::layoutBlockChild(WebCore::RenderBox&, WebCore::RenderBlockFlow::MarginInfo&, WebCore::LayoutUnit&, WebCore::LayoutUnit&) + 725
25  com.apple.WebCore             	0x00000001074e9bda WebCore::RenderBlockFlow::layoutBlockChildren(bool, WebCore::LayoutUnit&) + 442
26  com.apple.WebCore             	0x00000001074e8fe8 WebCore::RenderBlockFlow::layoutBlock(bool, WebCore::LayoutUnit) + 728
27  com.apple.WebCore             	0x0000000106a6e9d6 WebCore::RenderBlock::layout() + 54
28  com.apple.WebCore             	0x00000001074eaa75 WebCore::RenderBlockFlow::layoutBlockChild(WebCore::RenderBox&, WebCore::RenderBlockFlow::MarginInfo&, WebCore::LayoutUnit&, WebCore::LayoutUnit&) + 725
29  com.apple.WebCore             	0x00000001074e9bda WebCore::RenderBlockFlow::layoutBlockChildren(bool, WebCore::LayoutUnit&) + 442
30  com.apple.WebCore             	0x00000001074e8fe8 WebCore::RenderBlockFlow::layoutBlock(bool, WebCore::LayoutUnit) + 728
31  com.apple.WebCore             	0x0000000106a6e9d6 WebCore::RenderBlock::layout() + 54
32  com.apple.WebCore             	0x00000001074eaa75 WebCore::RenderBlockFlow::layoutBlockChild(WebCore::RenderBox&, WebCore::RenderBlockFlow::MarginInfo&, WebCore::LayoutUnit&, WebCore::LayoutUnit&) + 725
33  com.apple.WebCore             	0x00000001074e9bda WebCore::RenderBlockFlow::layoutBlockChildren(bool, WebCore::LayoutUnit&) + 442
34  com.apple.WebCore             	0x00000001074e8fe8 WebCore::RenderBlockFlow::layoutBlock(bool, WebCore::LayoutUnit) + 728
35  com.apple.WebCore             	0x0000000106a6e9d6 WebCore::RenderBlock::layout() + 54
36  com.apple.WebCore             	0x00000001074eaa75 WebCore::RenderBlockFlow::layoutBlockChild(WebCore::RenderBox&, WebCore::RenderBlockFlow::MarginInfo&, WebCore::LayoutUnit&, WebCore::LayoutUnit&) + 725
37  com.apple.WebCore             	0x00000001074e9bda WebCore::RenderBlockFlow::layoutBlockChildren(bool, WebCore::LayoutUnit&) + 442
38  com.apple.WebCore             	0x00000001074e8fe8 WebCore::RenderBlockFlow::layoutBlock(bool, WebCore::LayoutUnit) + 728
39  com.apple.WebCore             	0x0000000106a6e9d6 WebCore::RenderBlock::layout() + 54
40  com.apple.WebCore             	0x00000001074eaa75 WebCore::RenderBlockFlow::layoutBlockChild(WebCore::RenderBox&, WebCore::RenderBlockFlow::MarginInfo&, WebCore::LayoutUnit&, WebCore::LayoutUnit&) + 725
41  com.apple.WebCore             	0x00000001074e9bda WebCore::RenderBlockFlow::layoutBlockChildren(bool, WebCore::LayoutUnit&) + 442
42  com.apple.WebCore             	0x00000001074e8fe8 WebCore::RenderBlockFlow::layoutBlock(bool, WebCore::LayoutUnit) + 728
43  com.apple.WebCore             	0x0000000106a6e9d6 WebCore::RenderBlock::layout() + 54
44  com.apple.WebCore             	0x00000001074eaa75 WebCore::RenderBlockFlow::layoutBlockChild(WebCore::RenderBox&, WebCore::RenderBlockFlow::MarginInfo&, WebCore::LayoutUnit&, WebCore::LayoutUnit&) + 725
45  com.apple.WebCore             	0x00000001074e9bda WebCore::RenderBlockFlow::layoutBlockChildren(bool, WebCore::LayoutUnit&) + 442
46  com.apple.WebCore             	0x00000001074e8fe8 WebCore::RenderBlockFlow::layoutBlock(bool, WebCore::LayoutUnit) + 728
47  com.apple.WebCore             	0x0000000106a6e9d6 WebCore::RenderBlock::layout() + 54
48  com.apple.WebCore             	0x00000001074eaa75 WebCore::RenderBlockFlow::layoutBlockChild(WebCore::RenderBox&, WebCore::RenderBlockFlow::MarginInfo&, WebCore::LayoutUnit&, WebCore::LayoutUnit&) + 725
49  com.apple.WebCore             	0x00000001074e9bda WebCore::RenderBlockFlow::layoutBlockChildren(bool, WebCore::LayoutUnit&) + 442
50  com.apple.WebCore             	0x00000001074e8fe8 WebCore::RenderBlockFlow::layoutBlock(bool, WebCore::LayoutUnit) + 728
51  com.apple.WebCore             	0x0000000106a6e9d6 WebCore::RenderBlock::layout() + 54
52  com.apple.WebCore             	0x0000000106a6e835 WebCore::RenderView::layout() + 725
53  com.apple.WebCore             	0x0000000106a69e1c WebCore::FrameView::layout(bool) + 1996
54  com.apple.WebCore             	0x0000000106b071ff WebCore::Document::updateLayout() + 175
55  com.apple.WebCore             	0x0000000106e785d6 WebCore::Document::updateLayoutIgnorePendingStylesheets(WebCore::Document::RunPostLayoutTasks) + 262
56  com.apple.WebCore             	0x0000000106ba884d WebCore::Element::clientHeight() + 29
57  com.apple.WebCore             	0x00000001071797c6 WebCore::jsElementClientHeight(JSC::ExecState*, JSC::JSObject*, long long, JSC::PropertyName) + 166
58  com.apple.JavaScriptCore      	0x0000000108345f34 JSC::JSValue::get(JSC::ExecState*, JSC::PropertyName, JSC::PropertySlot&) const + 532
59  com.apple.JavaScriptCore      	0x00000001084c38f1 llint_slow_path_get_by_id + 273
60  com.apple.JavaScriptCore      	0x00000001086a2fb1 llint_entry + 10037
61  com.apple.JavaScriptCore      	0x00000001086a614c llint_entry + 22736
62  com.apple.JavaScriptCore      	0x00000001086a614c llint_entry + 22736
63  com.apple.JavaScriptCore      	0x00000001086a614c llint_entry + 22736
64  com.apple.JavaScriptCore      	0x00000001086a614c llint_entry + 22736
65  com.apple.JavaScriptCore      	0x00000001086a614c llint_entry + 22736
66  com.apple.JavaScriptCore      	0x00000001086a064d callToJavaScript + 321
67  com.apple.JavaScriptCore      	0x0000000108635563 JSC::JITCode::execute(JSC::VM*, JSC::ProtoCallFrame*) + 35
68  com.apple.JavaScriptCore      	0x000000010830942b JSC::Interpreter::execute(JSC::ProgramExecutable*, JSC::ExecState*, JSC::JSObject*) + 4747
69  com.apple.JavaScriptCore      	0x0000000108307fc8 JSC::evaluate(JSC::ExecState*, JSC::SourceCode const&, JSC::JSValue, JSC::JSValue*) + 488
70  com.apple.WebCore             	0x00000001075cfa00 WebCore::ScriptController::evaluateInWorld(WebCore::ScriptSourceCode const&, WebCore::DOMWrapperWorld&) + 304
71  com.apple.WebCore             	0x0000000106aba3d9 WebCore::ScriptController::evaluate(WebCore::ScriptSourceCode const&) + 41
72  com.apple.WebCore             	0x0000000106aba26f WebCore::ScriptElement::executeScript(WebCore::ScriptSourceCode const&) + 447
73  com.apple.WebCore             	0x0000000106b0e2ea WebCore::HTMLScriptRunner::executePendingScriptAndDispatchEvent(WebCore::PendingScript&) + 234
74  com.apple.WebCore             	0x0000000106b0e1db WebCore::HTMLScriptRunner::executeParsingBlockingScript() + 267
75  com.apple.WebCore             	0x0000000106ad0a0f WebCore::HTMLScriptRunner::executeParsingBlockingScripts() + 95
76  com.apple.WebCore             	0x0000000106ab8994 WebCore::HTMLDocumentParser::runScriptsForPausedTreeBuilder() + 84
77  com.apple.WebCore             	0x0000000106a2a8f8 WebCore::HTMLDocumentParser::canTakeNextToken(WebCore::HTMLDocumentParser::SynchronousMode, WebCore::PumpSession&) + 88
78  com.apple.WebCore             	0x0000000106a299c1 WebCore::HTMLDocumentParser::pumpTokenizer(WebCore::HTMLDocumentParser::SynchronousMode) + 465
79  com.apple.WebCore             	0x0000000106b0ed79 WebCore::HTMLDocumentParser::resumeParsingAfterScriptExecution() + 121
80  com.apple.WebCore             	0x0000000106b92572 WebCore::HTMLDocumentParser::notifyFinished(WebCore::CachedResource*) + 82
81  com.apple.WebCore             	0x0000000106ad1bb6 WebCore::CachedResource::checkNotify() + 166
82  com.apple.WebCore             	0x0000000106ad18fc WebCore::SubresourceLoader::didFinishLoading(double) + 92
83  com.apple.WebKit              	0x000000010668235d WebKit::WebResourceLoader::didReceiveWebResourceLoaderMessage(IPC::Connection*, IPC::MessageDecoder&) + 549
84  com.apple.WebKit              	0x00000001065986dc WebKit::NetworkProcessConnection::didReceiveMessage(IPC::Connection*, IPC::MessageDecoder&) + 138
85  com.apple.WebKit              	0x0000000106548aaa IPC::Connection::dispatchMessage(std::__1::unique_ptr<IPC::MessageDecoder, std::__1::default_delete<IPC::MessageDecoder> >) + 94
86  com.apple.WebKit              	0x000000010654ac24 IPC::Connection::dispatchOneMessage() + 106
87  com.apple.JavaScriptCore      	0x000000010873c3a5 WTF::RunLoop::performWork() + 421
88  com.apple.JavaScriptCore      	0x000000010873ca82 WTF::RunLoop::performWork(void*) + 34
89  com.apple.CoreFoundation      	0x00007fff81de6731 __CFRUNLOOP_IS_CALLING_OUT_TO_A_SOURCE0_PERFORM_FUNCTION__ + 17
90  com.apple.CoreFoundation      	0x00007fff81dd7ea2 __CFRunLoopDoSources0 + 242
91  com.apple.CoreFoundation      	0x00007fff81dd762f __CFRunLoopRun + 831
92  com.apple.CoreFoundation      	0x00007fff81dd70b5 CFRunLoopRunSpecific + 309
93  com.apple.HIToolbox           	0x00007fff8cadea0d RunCurrentEventLoopInMode + 226
94  com.apple.HIToolbox           	0x00007fff8cade7b7 ReceiveNextEventCommon + 479
95  com.apple.HIToolbox           	0x00007fff8cade5bc _BlockUntilNextEventMatchingListInModeWithFilter + 65
96  com.apple.AppKit              	0x00007fff81ffa3de _DPSNextEvent + 1434
97  com.apple.AppKit              	0x00007fff81ff9a2b -[NSApplication nextEventMatchingMask:untilDate:inMode:dequeue:] + 122
98  com.apple.AppKit              	0x00007fff81fedb2c -[NSApplication run] + 553
99  com.apple.AppKit              	0x00007fff81fd8913 NSApplicationMain + 940
100 com.apple.XPCService          	0x00007fff8e282c0f _xpc_main + 385
101 libxpc.dylib                  	0x00007fff85720bde xpc_main + 399
102 com.apple.WebKit.WebContent.Development	0x00000001021fe630 0x1021fd000 + 5680
103 libdyld.dylib                 	0x00007fff87d1d5fd start + 1
Comment 1 Benjamin Poulain 2014-06-03 21:46:43 PDT
Ok, I have an idea of what is going on.

Some selector must have ::first-letter, but does not actually match. When matching the rightmost fragment, we set the FIRST_LETTER flag on the style.

When generating the blocks for layout, RenderBlock find that one block has FIRST_LETTER, and try to get its style. Since the selector does not actually match, the style never resolve and the code continue with a null style.
Comment 2 Benjamin Poulain 2014-06-04 14:37:12 PDT
Created attachment 232501 [details]
Patch
Comment 3 Benjamin Poulain 2014-06-04 14:37:49 PDT
<rdar://problem/17154371>
Comment 4 Benjamin Poulain 2014-06-04 15:09:11 PDT
Comment on attachment 232501 [details]
Patch

Clearing flags on attachment: 232501

Committed r169599: <http://trac.webkit.org/changeset/169599>
Comment 5 Benjamin Poulain 2014-06-04 15:09:17 PDT
All reviewed patches have been landed.  Closing bug.