Bug 149287 - Null dereference loading Blink layout test editing/apply-inline-style-to-element-with-no-renderer-crash.html
Summary: Null dereference loading Blink layout test editing/apply-inline-style-to-elem...
Status: RESOLVED FIXED
Alias: None
Product: WebKit
Classification: Unclassified
Component: HTML Editing (show other bugs)
Version: WebKit Nightly Build
Hardware: Unspecified Unspecified
: P2 Normal
Assignee: Jiewen Tan
URL:
Keywords: BlinkMergeCandidate, HasReduction, InRadar
Depends on:
Blocks:
 
Reported: 2015-09-17 14:22 PDT by Jon Honeycutt
Modified: 2016-01-12 12:11 PST (History)
5 users (show)

See Also:

Attachments
crashing test (932 bytes, text/html)
2015-09-17 14:22 PDT, Jon Honeycutt 		no flags Details
Real Test Case (1.44 KB, text/html)
2015-11-18 12:00 PST, Jiewen Tan 		no flags Details
Patch (3.30 KB, patch)
2016-01-12 11:05 PST, Jiewen Tan 		no flags Details | Formatted Diff | Diff
Patch (3.33 KB, patch)
2016-01-12 11:23 PST, Jiewen Tan 		no flags Details | Formatted Diff | Diff
Show Obsolete (1) View All Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Jon Honeycutt 2015-09-17 14:22:57 PDT 
Created attachment 261421 [details]
crashing test

Null dereference loading Blink layout test editing/apply-inline-style-to-element-with-no-renderer-crash.html.

Stack trace:

Crashed Thread:        0  Dispatch queue: com.apple.main-thread

Exception Type:        EXC_BAD_ACCESS (SIGSEGV)
Exception Codes:       KERN_INVALID_ADDRESS at 0x0000000000000014
Exception Note:        EXC_CORPSE_NOTIFY

VM Regions Near 0x14:
--> 
    __TEXT                 000000010f487000-000000010f489000 [    8K] r-x/rwx SM=COW  /Users/USER/*/WebKit.framework/Versions/A/XPCServices/com.apple.WebKit.WebContent.Development.xpc/Contents/MacOS/com.apple.WebKit.WebContent.Development

Application Specific Information:
CRASHING TEST: temp-tests/editing/apply-inline-style-to-element-with-no-renderer-crash.html

Global Trace Buffer (reverse chronological seconds):
8.903358     CFNetwork                 	0x00007fff88d43b97 Explicitly setting CF cookie storage singleton
8.903729     CFNetwork                 	0x00007fff88d8f211 Explicitly setting cookie storage singleton

Thread 0 Crashed:: Dispatch queue: com.apple.main-thread
0   com.apple.WebCore             	0x0000000117226b05 WebCore::ApplyStyleCommand::applyInlineStyle(WebCore::EditingStyle*) + 1141 (Node.h:638)
1   com.apple.WebCore             	0x00000001172240fd WebCore::ApplyStyleCommand::doApply() + 173 (PassRefPtr.h:41)
2   com.apple.WebCore             	0x00000001172d8216 WebCore::CompositeEditCommand::apply() + 102 (ScopedEventQueue.h:71)
3   com.apple.WebCore             	0x00000001174fbbfb WebCore::Editor::applyStyle(WTF::RefPtr<WebCore::EditingStyle>&&, WebCore::EditAction) + 107 (StdLibExtras.h:366)
4   com.apple.WebCore             	0x000000011750e2a3 WebCore::applyCommandToFrame(WebCore::Frame&, WebCore::EditorCommandSource, WebCore::EditAction, WTF::Ref<WebCore::EditingStyle>&&) + 51 (StdLibExtras.h:366)
5   com.apple.WebCore             	0x000000011750e37b WebCore::executeToggleStyle(WebCore::Frame&, WebCore::EditorCommandSource, WebCore::EditAction, WebCore::CSSPropertyID, char const*, char const*) + 123 (EditorCommand.cpp:140)
6   com.apple.WebCore             	0x000000011750a876 WebCore::Editor::Command::execute(WTF::String const&, WebCore::Event*) const + 182 (EditorCommand.cpp:1704)
7   com.apple.WebCore             	0x0000000117443c36 WebCore::Document::execCommand(WTF::String const&, bool, WTF::String const&) + 214 (Document.cpp:4666)
8   com.apple.WebCore             	0x000000011785a074 WebCore::jsDocumentPrototypeFunctionExecCommand(JSC::ExecState*) + 420 (JSCJSValue.h:499)
9   ???                           	0x000058533ce01028 0 + 97114526847016
10  com.apple.JavaScriptCore      	0x0000000116bb676f llint_entry + 22696
11  com.apple.JavaScriptCore      	0x0000000116bb0ce4 vmEntryToJavaScript + 299
12  com.apple.JavaScriptCore      	0x0000000116a712d9 JSC::JITCode::execute(JSC::VM*, JSC::ProtoCallFrame*) + 169 (JITCode.cpp:82)
13  com.apple.JavaScriptCore      	0x0000000116a57d12 JSC::Interpreter::executeCall(JSC::ExecState*, JSC::JSObject*, JSC::CallType, JSC::CallData const&, JSC::JSValue, JSC::ArgList const&) + 450 (Interpreter.cpp:1008)
14  com.apple.JavaScriptCore      	0x00000001167238b7 JSC::call(JSC::ExecState*, JSC::JSValue, JSC::CallType, JSC::CallData const&, JSC::JSValue, JSC::ArgList const&, WTF::NakedPtr<JSC::Exception>&) + 71 (MarkedBlock.h:241)
15  com.apple.WebCore             	0x00000001178defa4 WebCore::JSEventListener::handleEvent(WebCore::ScriptExecutionContext*, WebCore::Event*) + 996 (JSMainThreadExecState.h:56)
16  com.apple.WebCore             	0x00000001175454db WebCore::EventTarget::fireEventListeners(WebCore::Event*, WebCore::EventTargetData*, WTF::Vector<WebCore::RegisteredEventListener, 1ul, WTF::CrashOnOverflow, 16ul>&) + 635 (InspectorInstrumentation.h:285)
17  com.apple.WebCore             	0x00000001175451a0 WebCore::EventTarget::fireEventListeners(WebCore::Event*) + 224 (EventTarget.cpp:208)
18  com.apple.WebCore             	0x00000001174d1bf4 WebCore::DOMWindow::dispatchEvent(WTF::PassRefPtr<WebCore::Event>, WTF::PassRefPtr<WebCore::EventTarget>) + 260 (DOMWindow.cpp:1900)
19  com.apple.WebCore             	0x00000001174d730b WebCore::DOMWindow::dispatchLoadEvent() + 347 (StdLibExtras.h:366)
20  com.apple.WebCore             	0x000000011743a294 WebCore::Document::implicitClose() + 324 (Document.cpp:4077)
21  com.apple.WebCore             	0x00000001175c7003 WebCore::FrameLoader::checkCompleted() + 275 (FrameLoader.cpp:839)
22  com.apple.WebCore             	0x00000001175c595b WebCore::FrameLoader::finishedParsing() + 123 (FrameLoader.cpp:760)
23  com.apple.WebCore             	0x0000000117445281 WebCore::Document::finishedParsing() + 417 (Frame.h:377)
24  com.apple.WebCore             	0x0000000117671e05 WebCore::HTMLDocumentParser::prepareToStopParsing() + 165 (RefCounted.h:99)
25  com.apple.WebCore             	0x000000011747569a WebCore::DocumentWriter::end() + 58 (StdLibExtras.h:366)
26  com.apple.WebCore             	0x000000011745d9ec WebCore::DocumentLoader::finishedLoading(double) + 268 (ResourceErrorBase.h:42)
27  com.apple.WebCore             	0x000000011728e179 WebCore::CachedResource::checkNotify() + 153 (CachedResourceClientWalker.h:51)
28  com.apple.WebCore             	0x000000011728a433 WebCore::CachedRawResource::finishLoading(WebCore::SharedBuffer*) + 227 (CachedRawResource.cpp:104)
29  com.apple.WebCore             	0x0000000118005501 WebCore::SubresourceLoader::didFinishLoading(double) + 1153 (ResourceLoader.h:154)
30  com.apple.WebKit              	0x0000000115b4b98d WebKit::WebResourceLoader::didReceiveWebResourceLoaderMessage(IPC::Connection&, IPC::MessageDecoder&) + 561 (HandleMessage.h:16)
31  com.apple.WebKit              	0x00000001159251f1 IPC::Connection::dispatchMessage(std::__1::unique_ptr<IPC::MessageDecoder, std::__1::default_delete<IPC::MessageDecoder> >) + 127 (memory:2636)
32  com.apple.WebKit              	0x0000000115927b4a IPC::Connection::dispatchOneMessage() + 126 (memory:2656)
33  com.apple.JavaScriptCore      	0x0000000116d69985 WTF::RunLoop::performWork() + 437 (functional:1742)
34  com.apple.JavaScriptCore      	0x0000000116d69d32 WTF::RunLoop::performWork(void*) + 34 (RunLoopCF.cpp:39)
35  com.apple.CoreFoundation      	0x00007fff949e2c01 __CFRUNLOOP_IS_CALLING_OUT_TO_A_SOURCE0_PERFORM_FUNCTION__ + 17
36  com.apple.CoreFoundation      	0x00007fff949d4b1c __CFRunLoopDoSources0 + 556
37  com.apple.CoreFoundation      	0x00007fff949d403f __CFRunLoopRun + 927
38  com.apple.CoreFoundation      	0x00007fff949d3a38 CFRunLoopRunSpecific + 296
39  com.apple.HIToolbox           	0x00007fff88e673bd RunCurrentEventLoopInMode + 235
40  com.apple.HIToolbox           	0x00007fff88e67153 ReceiveNextEventCommon + 432
41  com.apple.HIToolbox           	0x00007fff88e66f93 _BlockUntilNextEventMatchingListInModeWithFilter + 71
42  com.apple.AppKit              	0x00007fff870b81e7 _DPSNextEvent + 1076
43  com.apple.AppKit              	0x00007fff8748490d -[NSApplication _nextEventMatchingEventMask:untilDate:inMode:dequeue:] + 454
44  com.apple.AppKit              	0x00007fff870ae0b8 -[NSApplication run] + 682
45  com.apple.AppKit              	0x00007fff87030396 NSApplicationMain + 1176
46  libxpc.dylib                  	0x00007fff8c70ff70 _xpc_objc_main + 793
47  libxpc.dylib                  	0x00007fff8c7116bf xpc_main + 494
48  com.apple.WebKit.WebContent.Development	0x000000010f488424 main + 409 (XPCServiceMain.Development.mm:187)
49  libdyld.dylib                 	0x00007fff93aa15ad start + 1
Comment 1 Radar WebKit Bug Importer 2015-09-17 14:23:17 PDT 
<rdar://problem/22746217>
Comment 2 Jiewen Tan 2015-10-27 12:30:04 PDT 
The test case is from Bug 132103.
Comment 3 Jiewen Tan 2015-11-18 12:00:13 PST 
Created attachment 265768 [details]
Real Test Case
Comment 4 Brent Fulgham 2016-01-08 17:07:03 PST 
We can no longer reproduce this crash on current WebKit. We believe the underlying cause of this bug was fixed during other work this cycle, but I cannot identify what that change is.
Comment 5 Brent Fulgham 2016-01-11 11:16:51 PST 
Reopening. This test case needs to be part of WebKit.
Comment 6 Brent Fulgham 2016-01-11 11:17:35 PST 
Never mind -- I missed the part where the test was part of another bug.
Comment 7 Jiewen Tan 2016-01-12 11:05:08 PST 
Reopening to attach new patch.
Comment 8 Jiewen Tan 2016-01-12 11:05:10 PST 
Created attachment 268784 [details]
Patch
Comment 9 Jiewen Tan 2016-01-12 11:23:26 PST 
Created attachment 268786 [details]
Patch
Comment 10 Brent Fulgham 2016-01-12 11:39:32 PST 
Comment on attachment 268786 [details]
Patch

r=me.
Comment 11 WebKit Commit Bot 2016-01-12 12:11:18 PST 
Comment on attachment 268786 [details]
Patch

Clearing flags on attachment: 268786

Committed r194916: <http://trac.webkit.org/changeset/194916>
Comment 12 WebKit Commit Bot 2016-01-12 12:11:21 PST 
All reviewed patches have been landed.  Closing bug.