WebKit Bugzilla
New
Browse
Log In
×
Sign in with GitHub
or
Remember my login
Create Account
·
Forgot Password
Forgotten password account recovery
RESOLVED FIXED
64284
Crash in RenderBox::paintBoxDecorations when documentElement has no renderer
https://bugs.webkit.org/show_bug.cgi?id=64284
Summary
Crash in RenderBox::paintBoxDecorations when documentElement has no renderer
Berend-Jan Wever
Reported
2011-07-11 08:24:14 PDT
Chromium:
https://code.google.com/p/chromium/issues/detail?id=88926
<body onload="go()"></body> <script> function go() { document.open(); var oUElement = document.createElement("U"); oUElement.hidden=true; oUElement.innerHTML="<style>*{-webkit-border-before-style:groove}"; document.appendChild(oUElement); document.close(); } </script> (Adam, this is the bug I emailed you about before) The repro triggers an ASSERT in Document::setCompatibilityMode: webkit\source\webcore\dom\document.cpp void Document::setCompatibilityMode(CompatibilityMode mode) { if (m_compatibilityModeLocked || mode == m_compatibilityMode) return; ASSERT(!m_styleSheets->length()); bool wasInQuirksMode = inQuirksMode(); m_compatibilityMode = mode; if (inQuirksMode() != wasInQuirksMode) { // All user stylesheets have to reparse using the different mode. clearPageUserSheet(); clearPageGroupUserSheets(); } } The stylesheet specified in the innerHTML has been added, so m_styleSheets->length() == 1. This ASSERT does not seem to be obviously related to the eventual NULL ptr crash in RenderBox::paintBoxDecorations: webkit\source\webcore\rendering\renderbox.cpp void RenderBox::paintBoxDecorations(PaintInfo& paintInfo, const LayoutPoint& paintOffset) { <snip> // If we have a native theme appearance, paint that before painting our background. // The theme will tell us whether or not we should also paint the CSS background. bool themePainted = style()->hasAppearance() && !theme()->paint(this, paintInfo, paintRect); if (!themePainted) { if (isRoot()) paintRootBoxFillLayers(paintInfo); else if (!isBody() || document()->documentElement()->renderer()->hasBackground()) { <snip> } The last line results in an attempt to call "hasBackground" on the m_style property of a RenderObject. This property is NULL, so this leads to a NULL ptr crash.
Attachments
Proposed fix: NULL-check the documentElement's renderer.
(4.57 KB, patch)
2011-11-08 16:49 PST
,
Julien Chaffraix
no flags
Details
Formatted Diff
Diff
Same as previously but added the test to the test_expectations.txt as it ASSERT's in Debug.
(8.82 KB, patch)
2011-11-09 10:04 PST
,
Julien Chaffraix
no flags
Details
Formatted Diff
Diff
Fixed EFL Skipped file.
(8.84 KB, patch)
2011-11-09 11:49 PST
,
Julien Chaffraix
no flags
Details
Formatted Diff
Diff
Patch for landing
(7.96 KB, patch)
2011-12-14 08:55 PST
,
Julien Chaffraix
no flags
Details
Formatted Diff
Diff
Show Obsolete
(3)
View All
Add attachment
proposed patch, testcase, etc.
Julien Chaffraix
Comment 1
2011-09-26 17:40:42 PDT
The
Julien Chaffraix
Comment 2
2011-11-08 16:49:30 PST
Created
attachment 114174
[details]
Proposed fix: NULL-check the documentElement's renderer.
Julien Chaffraix
Comment 3
2011-11-09 10:04:24 PST
Created
attachment 114306
[details]
Same as previously but added the test to the test_expectations.txt as it ASSERT's in Debug.
Julien Chaffraix
Comment 4
2011-11-09 11:49:01 PST
Created
attachment 114332
[details]
Fixed EFL Skipped file.
Ryosuke Niwa
Comment 5
2011-12-08 16:32:55 PST
Comment on
attachment 114332
[details]
Fixed EFL Skipped file. View in context:
https://bugs.webkit.org/attachment.cgi?id=114332&action=review
> LayoutTests/fast/dynamic/crash-paint-no-documentElement-renderer.html:8 > + if (window.layoutTestController) > + layoutTestController.dumpAsText(true);
Why do we need a png?
Julien Chaffraix
Comment 6
2011-12-08 16:54:01 PST
Comment on
attachment 114332
[details]
Fixed EFL Skipped file. View in context:
https://bugs.webkit.org/attachment.cgi?id=114332&action=review
>> LayoutTests/fast/dynamic/crash-paint-no-documentElement-renderer.html:8 >> + layoutTestController.dumpAsText(true); > > Why do we need a png?
We need to make sure the painting code is called or we won't reproduce the crash. I don't think of any way to ensure that without dumping the png. However we really don't care about the image nor the render tree dump.
Ryosuke Niwa
Comment 7
2011-12-08 16:55:16 PST
(In reply to
comment #6
)
> We need to make sure the painting code is called or we won't reproduce the crash. I don't think of any way to ensure that without dumping the png. However we really don't care about the image nor the render tree dump.
I'm pretty certain painting code is exercised regardless of whether png image is generated or not.
Julien Chaffraix
Comment 8
2011-12-08 16:57:44 PST
(In reply to
comment #7
)
> (In reply to
comment #6
) > > We need to make sure the painting code is called or we won't reproduce the crash. I don't think of any way to ensure that without dumping the png. However we really don't care about the image nor the render tree dump. > > I'm pretty certain painting code is exercised regardless of whether png image is generated or not.
I will double check before landing and adapt the output accordingly.
Julien Chaffraix
Comment 9
2011-12-14 08:55:38 PST
Created
attachment 119226
[details]
Patch for landing
Julien Chaffraix
Comment 10
2011-12-14 08:58:55 PST
> > I'm pretty certain painting code is exercised regardless of whether png image is generated or not. > > I will double check before landing and adapt the output accordingly.
Ryosuke was right and I updated the test to dumpAsText() (no png).
WebKit Review Bot
Comment 11
2011-12-14 09:13:54 PST
Comment on
attachment 119226
[details]
Patch for landing Clearing flags on attachment: 119226 Committed
r102787
: <
http://trac.webkit.org/changeset/102787
>
WebKit Review Bot
Comment 12
2011-12-14 09:13:59 PST
All reviewed patches have been landed. Closing bug.
Berend-Jan Wever
Comment 13
2011-12-16 05:57:21 PST
***
Bug 51647
has been marked as a duplicate of this bug. ***
Note
You need to
log in
before you can comment on or make changes to this bug.
Top of Page
Format For Printing
XML
Clone This Bug