Bug 28012 - WML causes crash on Slashdot.org main page
Summary: WML causes crash on Slashdot.org main page
Status: RESOLVED FIXED
Alias: None
Product: WebKit
Classification: Unclassified
Component: Layout and Rendering (show other bugs)
Version: 528+ (Nightly build)
Hardware: PC All
: P2 Normal
Assignee: George Staikos
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2009-08-05 00:44 PDT by red47514f7
Modified: 2009-08-15 17:17 PDT (History)
4 users (show)

See Also:


Attachments
Reduction for slashdot.org crash (261 bytes, text/html)
2009-08-07 02:04 PDT, red47514f7
no flags Details
Patch and testcase to fix the bug (2.40 KB, patch)
2009-08-15 16:47 PDT, George Staikos
jmalonzo: review+
Details | Formatted Diff | Diff

Note You need to log in before you can comment on or make changes to this bug.
Description red47514f7 2009-08-05 00:44:43 PDT
If I wget http://slashdot.org/ and just open it in a WebKit-based browser, everything is OK; of course, JavaScript loaded by relative URLs is not working.
If I open http://slashdot.org/ in a webkit browser built against latest nightly (I tried two different browsers - uzbl and midori, both have the same regression when the same browser code is linked against too fresh WebKit instead of slightly older one), I see the Slashdot scripts composing a page, for a brief moment I even see nearly-complete rendering and then browser crashes.
Comment 1 red47514f7 2009-08-05 06:27:05 PDT
Maybe I misclassified the bug because disabling one CSS file ( http://c.fsdn.com/sd/idlecore-tidied.css?T_2_5_0_266b ) fixes the problem. 

Bug was first filed when r46770 was fresh nightly. It appeared a few days earlier.

gdb reports WebCore::RenderFieldset::findLegend 

Full backtrace minus paths and application part:

#0  0xb7a0b9bf in WebCore::RenderFieldset::findLegend ()
#1  0xb7a0c83d in WebCore::RenderFieldset::calcPrefWidths ()
#2  0xb79f6d9b in WebCore::RenderBox::minPrefWidth ()
#3  0xb7a003d3 in WebCore::RenderBox::calcWidth ()
#4  0xb79e8cba in WebCore::RenderBlock::layoutBlock ()
#5  0xb79d6b18 in WebCore::RenderBlock::layout ()
#6  0xb79e865b in WebCore::RenderBlock::layoutBlockChildren ()
#7  0xb79e9311 in WebCore::RenderBlock::layoutBlock ()
#8  0xb79d6b18 in WebCore::RenderBlock::layout ()
#9  0xb79e865b in WebCore::RenderBlock::layoutBlockChildren ()
#10 0xb79e9311 in WebCore::RenderBlock::layoutBlock ()
#11 0xb79d6b18 in WebCore::RenderBlock::layout ()
#12 0xb79e865b in WebCore::RenderBlock::layoutBlockChildren ()
#13 0xb79e9311 in WebCore::RenderBlock::layoutBlock ()
#14 0xb79d6b18 in WebCore::RenderBlock::layout ()
#15 0xb79e865b in WebCore::RenderBlock::layoutBlockChildren ()
#16 0xb79e9311 in WebCore::RenderBlock::layoutBlock ()
#17 0xb79d6b18 in WebCore::RenderBlock::layout ()
#18 0xb79d896c in WebCore::RenderBlock::insertFloatingObject ()
#19 0xb79e3377 in WebCore::RenderBlock::handleFloatingChild ()
#20 0xb79e6313 in WebCore::RenderBlock::handleSpecialChild ()
#21 0xb79e84b9 in WebCore::RenderBlock::layoutBlockChildren ()
#22 0xb79e9311 in WebCore::RenderBlock::layoutBlock ()
#23 0xb79d6b18 in WebCore::RenderBlock::layout ()
#24 0xb79e865b in WebCore::RenderBlock::layoutBlockChildren ()
#25 0xb79e9311 in WebCore::RenderBlock::layoutBlock ()
#26 0xb79d6b18 in WebCore::RenderBlock::layout ()
#27 0xb79e865b in WebCore::RenderBlock::layoutBlockChildren ()
#28 0xb79e9311 in WebCore::RenderBlock::layoutBlock ()
#29 0xb79d6b18 in WebCore::RenderBlock::layout ()
#30 0xb79e865b in WebCore::RenderBlock::layoutBlockChildren ()
#31 0xb79e9311 in WebCore::RenderBlock::layoutBlock ()
#32 0xb79d6b18 in WebCore::RenderBlock::layout ()
#33 0xb79e865b in WebCore::RenderBlock::layoutBlockChildren ()
#34 0xb79e9311 in WebCore::RenderBlock::layoutBlock ()
#35 0xb79d6b18 in WebCore::RenderBlock::layout ()
#36 0xb7a6ff17 in WebCore::RenderView::layout ()
#37 0xb7932682 in WebCore::FrameView::layout ()
#38 0xb773c250 in WebCore::Document::updateLayout ()
#39 0xb774f5d9 in WebCore::Document::updateLayoutIgnorePendingStylesheets ()
#40 0xb76b684b in WebCore::CSSComputedStyleDeclaration::getPropertyCSSValue ()
#41 0xb76bcf98 in WebCore::CSSComputedStyleDeclaration::getPropertyCSSValue ()
#42 0xb76b5446 in WebCore::CSSComputedStyleDeclaration::getPropertyValue ()
#43 0xb76f6353 in WebCore::CSSStyleDeclaration::getPropertyValue ()
#44 0xb7cb66c4 in WebCore::jsCSSStyleDeclarationPrototypeFunctionGetPropertyValue ()
Comment 2 red47514f7 2009-08-05 23:09:33 PDT
Still crashes in r46809 nightly (just in case..)
Comment 3 red47514f7 2009-08-07 02:01:59 PDT
Simple reduction (derived from slashdot.org). <form> tag can be added if you wish so.

<html> 
  <head> 
    <style>
      label{display:block;}
    </style>
  </head>
  <body>
        <fieldset>
	<label></label>
	  a
        </fieldset> 
  </body>
</html>
Comment 4 red47514f7 2009-08-07 02:04:22 PDT
Created attachment 34261 [details]
Reduction for slashdot.org crash

<form> tag around <fieldset> is omitted for brevity. It would make no difference.
Comment 5 red47514f7 2009-08-07 03:32:36 PDT
Further investigating: it only ocurs when WML support was enabled during the build.
Comment 6 Jan Alonzo 2009-08-15 14:10:42 PDT
CC'ing Nikolas as he knows more about  WML.
Comment 7 George Staikos 2009-08-15 14:42:46 PDT
I believe this is a regression of a bug that was fixed before.  It's platform independent.
Comment 8 George Staikos 2009-08-15 16:47:03 PDT
Created attachment 34908 [details]
Patch and testcase to fix the bug
Comment 9 George Staikos 2009-08-15 16:59:32 PDT
Bug # can be added when landing.  It's in my local tree.
Comment 10 Jan Alonzo 2009-08-15 17:05:17 PDT
(In reply to comment #9)
> Bug # can be added when landing.  It's in my local tree.

Looks ok. r=me.
Comment 11 George Staikos 2009-08-15 17:17:19 PDT
Checked in r47329