Bug 177908 - RenderBlockFlow::appendRunsForObject() needs a stack check since it recurses.
Summary: RenderBlockFlow::appendRunsForObject() needs a stack check since it recurses.
Alias: None
Product: WebKit
Classification: Unclassified
Component: Layout and Rendering (show other bugs)
Version: WebKit Nightly Build
Hardware: Unspecified Unspecified
: P2 Normal
Assignee: zalan
Keywords: InRadar
Depends on:
Reported: 2017-10-04 17:49 PDT by Mark Lam
Modified: 2017-10-04 19:10 PDT (History)
4 users (show)

See Also:

proposed patch. (6.01 KB, patch)
2017-10-04 18:49 PDT, Mark Lam
no flags Details | Formatted Diff | Diff

Note You need to log in before you can comment on or make changes to this bug.
Description Mark Lam 2017-10-04 17:49:53 PDT
Comment 1 Mark Lam 2017-10-04 17:51:06 PDT
Patch coming soon.
Comment 2 Mark Lam 2017-10-04 18:49:08 PDT
Created attachment 322759 [details]
proposed patch.
Comment 3 zalan 2017-10-04 19:01:32 PDT
Comment on attachment 322759 [details]
proposed patch.

View in context: https://bugs.webkit.org/attachment.cgi?id=322759&action=review

> Source/WebCore/ChangeLog:13
> +        No new tests because the issue is difficult to reproduce.  It was identified from
> +        an ASan build crash report that shows that there was a stack overflow, and the
> +        crash stack has RenderBlockFlow::appendRunsForObject() recursing on itself
> +        thereby filling up the stack.  Though it's hard to come up with a test, the issue
> +        is obvious and easy to fix.

It is reproducible? If so I'd rather fix the actual problem than adding a workaround. appendRunsForObject is meant to stabilize so while having this stack limit fixes the stack overflow issue, it does not address the root cause.