Bug 73116 - Crash in BidiRunList<Run>::replaceRunWithRuns with an empty bdi element
Summary: Crash in BidiRunList<Run>::replaceRunWithRuns with an empty bdi element
Status: RESOLVED FIXED
Alias: None
Product: WebKit
Classification: Unclassified
Component: Layout and Rendering (show other bugs)
Version: 528+ (Nightly build)
Hardware: Unspecified Unspecified
: P2 Normal
Assignee: Ryosuke Niwa
URL:
Keywords:
: 71737 (view as bug list)
Depends on:
Blocks: 63903
  Show dependency treegraph
 
Reported: 2011-11-25 00:02 PST by Ryosuke Niwa
Modified: 2011-11-25 12:21 PST (History)
9 users (show)

See Also:


Attachments
demo (67 bytes, text/html)
2011-11-25 00:03 PST, Ryosuke Niwa
no flags Details
fixes the failure (3.15 KB, patch)
2011-11-25 01:59 PST, Ryosuke Niwa
no flags Details | Formatted Diff | Diff

Note You need to log in before you can comment on or make changes to this bug.
Description Ryosuke Niwa 2011-11-25 00:02:51 PST
Open:
<!DOCTYPE html>
<html>
<body>
<keygen>
<bdi></bdi>
</body>
</html>

then we hit:

ASSERTION FAILED: newRuns.runCount()
/Users/rniwa/webkit/Source/WebCore/platform/text/BidiRunList.h(146) : void WebCore::BidiRunList<Run>::replaceRunWithRuns(Run*, WebCore::BidiRunList<Run>&) [with Run = WebCore::BidiRun]
1   0x1034d0df7 WebCore::BidiRunList<WebCore::BidiRun>::replaceRunWithRuns(WebCore::BidiRun*, WebCore::BidiRunList<WebCore::BidiRun>&)
2   0x1034bfb43 WebCore::constructBidiRuns(WebCore::BidiResolver<WebCore::InlineIterator, WebCore::BidiRun>&, WebCore::BidiRunList<WebCore::BidiRun>&, WebCore::InlineIterator const&, WebCore::VisualDirectionOverride, bool)
3   0x1034c4832 WebCore::RenderBlock::layoutRunsAndFloatsInRange(WebCore::LineLayoutState&, WebCore::BidiResolver<WebCore::InlineIterator, WebCore::BidiRun>&, WebCore::InlineIterator const&, WebCore::BidiStatus const&, unsigned int)
4   0x1034c5459 WebCore::RenderBlock::layoutRunsAndFloats(WebCore::LineLayoutState&, bool)
5   0x1034c5999 WebCore::RenderBlock::layoutInlineChildren(bool, int&, int&)
6   0x10349a3ae WebCore::RenderBlock::layoutBlock(bool, int, WebCore::RenderBlock::BlockLayoutPass)
7   0x10348e45d WebCore::RenderBlock::layout()
8   0x103497e62 WebCore::RenderBlock::layoutBlockChild(WebCore::RenderBox*, WebCore::RenderBlock::MarginInfo&, int&, int&)
9   0x103498e12 WebCore::RenderBlock::layoutBlockChildren(bool, int&)
10  0x10349a3c7 WebCore::RenderBlock::layoutBlock(bool, int, WebCore::RenderBlock::BlockLayoutPass)
11  0x10348e45d WebCore::RenderBlock::layout()
12  0x103497e62 WebCore::RenderBlock::layoutBlockChild(WebCore::RenderBox*, WebCore::RenderBlock::MarginInfo&, int&, int&)
13  0x103498e12 WebCore::RenderBlock::layoutBlockChildren(bool, int&)
14  0x10349a3c7 WebCore::RenderBlock::layoutBlock(bool, int, WebCore::RenderBlock::BlockLayoutPass)
15  0x10348e45d WebCore::RenderBlock::layout()
16  0x10363b4a0 WebCore::RenderView::layout()
17  0x102d4b6e2 WebCore::FrameView::layout(bool)
18  0x102b52ff3 WebCore::Document::implicitClose()
19  0x102d28549 WebCore::FrameLoader::checkCallImplicitClose()
20  0x102d2bde8 WebCore::FrameLoader::checkCompleted()
21  0x102d2c664 WebCore::FrameLoader::finishedParsing()
22  0x102b54b6c WebCore::Document::finishedParsing()
23  0x102e6afaa WebCore::HTMLTreeBuilder::finished()
24  0x102de9798 WebCore::HTMLDocumentParser::end()
25  0x102de988d WebCore::HTMLDocumentParser::attemptToRunDeferredScriptsAndEnd()
26  0x102deb399 WebCore::HTMLDocumentParser::prepareToStopParsing()
27  0x102de9454 WebCore::HTMLDocumentParser::attemptToEnd()
28  0x102de96ec WebCore::HTMLDocumentParser::finish()
29  0x102b923fe WebCore::DocumentWriter::endIfNotLoadingMainResource()
30  0x102b92445 WebCore::DocumentWriter::end()
31  0x102b7bd1b WebCore::DocumentLoader::finishedLoading()
Comment 1 Ryosuke Niwa 2011-11-25 00:03:06 PST
Created attachment 116572 [details]
demo
Comment 2 Ryosuke Niwa 2011-11-25 00:04:19 PST
Also see the bug 71737.
Comment 3 Ryosuke Niwa 2011-11-25 00:56:30 PST
Apparently this is nothing to do with keygen. We just need some text rendered on the page and an empty bdi element.
Comment 4 Ryosuke Niwa 2011-11-25 01:48:56 PST
Just realized that this actually crashes WebKit :(
Comment 5 Ryosuke Niwa 2011-11-25 01:59:00 PST
Created attachment 116583 [details]
fixes the failure
Comment 6 Eric Seidel (no email) 2011-11-25 11:09:44 PST
Comment on attachment 116583 [details]
fixes the failure

Thanks!
Comment 7 WebKit Review Bot 2011-11-25 12:21:23 PST
Comment on attachment 116583 [details]
fixes the failure

Clearing flags on attachment: 116583

Committed r101180: <http://trac.webkit.org/changeset/101180>
Comment 8 WebKit Review Bot 2011-11-25 12:21:29 PST
All reviewed patches have been landed.  Closing bug.
Comment 9 Ryosuke Niwa 2011-11-25 12:21:45 PST
*** Bug 71737 has been marked as a duplicate of this bug. ***