156984 – REGRESSION(r199964): Crashes with guard malloc

RESOLVED FIXED 156984

REGRESSION(r199964): Crashes with guard malloc

https://bugs.webkit.org/show_bug.cgi?id=156984

Summary REGRESSION(r199964): Crashes with guard malloc

Antti Koivisto

Reported 2016-04-25 09:31:00 PDT

Accessing deleted RenderStyle. CRASHING TEST: css1/pseudo/firstline.html Global Trace Buffer (reverse chronological seconds): 3.899656 CFNetwork 0x00007fff86a88553 TCP Conn 0x1836f6e00 event 1. err: 0 3.918368 CFNetwork 0x00007fff869f8f4b TCP Conn 0x1836f6e00 started 5.136279 CFNetwork 0x00007fff86b86ed7 Explicitly setting CF cookie storage singleton 5.138031 CFNetwork 0x00007fff86bbd8ad Explicitly setting cookie storage singleton Thread 0 Crashed:: Dispatch queue: com.apple.main-thread 0 com.apple.WebCore 0x000000010428a251 WebCore::RenderBlock::minLineHeightForReplacedRenderer(bool, WebCore::LayoutUnit) const + 65 1 com.apple.WebCore 0x000000010364669c WebCore::LineWidth::updateAvailableWidth(WebCore::LayoutUnit) + 60 2 com.apple.WebCore 0x000000010415deff WebCore::LineBreaker::nextLineBreak(WebCore::BidiResolverWithIsolate<WebCore::InlineIterator, WebCore::BidiRun, WebCore::BidiIsolatedRun>&, WebCore::LineInfo&, WebCore::LineLayoutState&, WebCore::RenderTextInfo&, WebCore::FloatingObject*, unsigned int, WTF::Vector<WebCore::WordMeasurement, 64ul, WTF::CrashOnOverflow, 16ul>&) + 207 3 com.apple.WebCore 0x00000001042a674e WebCore::RenderBlockFlow::layoutRunsAndFloatsInRange(WebCore::LineLayoutState&, WebCore::BidiResolverWithIsolate<WebCore::InlineIterator, WebCore::BidiRun, WebCore::BidiIsolatedRun>&, WebCore::InlineIterator const&, WebCore::BidiStatus const&, unsigned int) + 862 4 com.apple.WebCore 0x00000001042a4cc0 WebCore::RenderBlockFlow::layoutRunsAndFloats(WebCore::LineLayoutState&, bool) + 1200 5 com.apple.WebCore 0x00000001042a9485 WebCore::RenderBlockFlow::layoutLineBoxes(bool, WebCore::LayoutUnit&, WebCore::LayoutUnit&) + 1845 6 com.apple.WebCore 0x0000000104294c12 WebCore::RenderBlockFlow::layoutBlock(bool, WebCore::LayoutUnit) + 946 7 com.apple.WebCore 0x00000001035e2346 WebCore::RenderBlock::layout() + 54 8 com.apple.WebCore 0x00000001042969d3 WebCore::RenderBlockFlow::layoutBlockChild(WebCore::RenderBox&, WebCore::RenderBlockFlow::MarginInfo&, WebCore::LayoutUnit&, WebCore::LayoutUnit&) + 883 9 com.apple.WebCore 0x00000001042958ec WebCore::RenderBlockFlow::layoutBlockChildren(bool, WebCore::LayoutUnit&) + 508 10 com.apple.WebCore 0x0000000104294bfa WebCore::RenderBlockFlow::layoutBlock(bool, WebCore::LayoutUnit) + 922 11 com.apple.WebCore 0x00000001035e2346 WebCore::RenderBlock::layout() + 54 12 com.apple.WebCore 0x00000001042969d3 WebCore::RenderBlockFlow::layoutBlockChild(WebCore::RenderBox&, WebCore::RenderBlockFlow::MarginInfo&, WebCore::LayoutUnit&, WebCore::LayoutUnit&) + 883 13 com.apple.WebCore 0x00000001042958ec WebCore::RenderBlockFlow::layoutBlockChildren(bool, WebCore::LayoutUnit&) + 508 14 com.apple.WebCore 0x0000000104294bfa WebCore::RenderBlockFlow::layoutBlock(bool, WebCore::LayoutUnit) + 922 15 com.apple.WebCore 0x00000001035e2346 WebCore::RenderBlock::layout() + 54 16 com.apple.WebCore 0x00000001042969d3 WebCore::RenderBlockFlow::layoutBlockChild(WebCore::RenderBox&, WebCore::RenderBlockFlow::MarginInfo&, WebCore::LayoutUnit&, WebCore::LayoutUnit&) + 883 17 com.apple.WebCore 0x00000001042958ec WebCore::RenderBlockFlow::layoutBlockChildren(bool, WebCore::LayoutUnit&) + 508 18 com.apple.WebCore 0x0000000104294bfa WebCore::RenderBlockFlow::layoutBlock(bool, WebCore::LayoutUnit) + 922 19 com.apple.WebCore 0x00000001035e2346 WebCore::RenderBlock::layout() + 54 20 com.apple.WebCore 0x00000001035e21bd WebCore::RenderView::layout() + 765 21 com.apple.WebCore 0x00000001035df781 WebCore::FrameView::layout(bool) + 2993 22 com.apple.WebCore 0x00000001035de49a WebCore::Document::implicitClose() + 874 23 com.apple.WebCore 0x00000001035ddcd3 WebCore::FrameLoader::checkCompleted() + 275 24 com.apple.WebCore 0x00000001035dc9cb WebCore::FrameLoader::finishedParsing() + 123 25 com.apple.WebCore 0x00000001035db7a6 WebCore::Document::finishedParsing() + 390 26 com.apple.WebCore 0x00000001035b3f72 WebCore::HTMLDocumentParser::prepareToStopParsing() + 162 27 com.apple.WebCore 0x00000001035b2d2a WebCore::DocumentWriter::end() + 58 28 com.apple.WebCore 0x00000001035a490c WebCore::DocumentLoader::finishedLoading(double) + 268 29 com.apple.WebCore 0x000000010363a159 WebCore::CachedResource::checkNotify() + 153 30 com.apple.WebCore 0x00000001038f79c3 WebCore::CachedRawResource::finishLoading(WebCore::SharedBuffer*) + 227 31 com.apple.WebCore 0x0000000103639feb WebCore::SubresourceLoader::didFinishLoading(double) + 1163 32 com.apple.WebKit 0x00000001020a1af8 WebKit::WebResourceLoader::didReceiveWebResourceLoaderMessage(IPC::Connection&, IPC::MessageDecoder&) + 460 33 com.apple.WebKit 0x0000000101ef382d IPC::Connection::dispatchMessage(std::__1::unique_ptr<IPC::MessageDecoder, std::__1::default_delete<IPC::MessageDecoder> >) + 127 34 com.apple.WebKit 0x0000000101ef6196 IPC::Connection::dispatchOneMessage() + 126 35 com.apple.JavaScriptCore 0x0000000103285535 WTF::RunLoop::performWork() + 437 36 com.apple.JavaScriptCore 0x00000001032858e2 WTF::RunLoop::performWork(void*) + 34 37 com.apple.CoreFoundation 0x00007fff894d7881 __CFRUNLOOP_IS_CALLING_OUT_TO_A_SOURCE0_PERFORM_FUNCTION__ + 17 38 com.apple.CoreFoundation 0x00007fff894b6fbc __CFRunLoopDoSources0 + 556 39 com.apple.CoreFoundation 0x00007fff894b64df __CFRunLoopRun + 927 40 com.apple.CoreFoundation 0x00007fff894b5ed8 CFRunLoopRunSpecific + 296 41 com.apple.HIToolbox 0x00007fff8f6e1935 RunCurrentEventLoopInMode + 235 42 com.apple.HIToolbox 0x00007fff8f6e176f ReceiveNextEventCommon + 432 43 com.apple.HIToolbox 0x00007fff8f6e15af _BlockUntilNextEventMatchingListInModeWithFilter + 71 44 com.apple.AppKit 0x00007fff973b9efa _DPSNextEvent + 1067 45 com.apple.AppKit 0x00007fff973b932a -[NSApplication _nextEventMatchingEventMask:untilDate:inMode:dequeue:] + 454 46 com.apple.AppKit 0x00007fff973ade84 -[NSApplication run] + 682 47 com.apple.AppKit 0x00007fff9737746c NSApplicationMain + 1176 48 libxpc.dylib 0x00007fff90afa194 _xpc_objc_main + 795 49 libxpc.dylib 0x00007fff90af8bbe xpc_main + 494 50 com.apple.WebKit.WebContent 0x0000000101e377df 0x101e36000 + 6111 51 libdyld.dylib 0x00007fff82be85ad start + 1

Attachments
patch (5.03 KB, patch) 2016-04-25 09:35 PDT, Antti Koivisto	kling: review+	Details Formatted Diff Diff
View All Add attachment proposed patch, testcase, etc.

Antti Koivisto

Comment 1 2016-04-25 09:35:23 PDT

Created attachment 277255 [details] patch

Andreas Kling

Comment 2 2016-04-25 09:44:11 PDT

Comment on attachment 277255 [details] patch r=me

Antti Koivisto

Comment 3 2016-04-25 10:03:09 PDT

https://trac.webkit.org/r200031

Radar WebKit Bug Importer

Comment 4 2016-04-26 01:24:06 PDT

<rdar://problem/25926869>

Note You need to log in before you can comment on or make changes to this bug.

Status RESOLVED

Resolution FIXED

Priority P2

Severity Normal

Classification Unclassified

Version WebKit Nightly Build

Hardware Unspecified

OS Unspecified

Product WebKit

Component Layout and Rendering

Assignee

Nobody

Reported

2016-04-25 09:31 PDT

Modified

2016-04-26 01:24 PDT History

CC List

9 users Show

URL

Keywords InRadar

Depends on

Blocks