Bug 81868 – REGRESSION(r98542): crash when MatchedStyleDeclarationCache is resized

• Status: RESOLVED
• Resolution: CONFIGURATION CHANGED
• Component: CSS

[Mike Lawther]

As reported in http://code.google.com/p/chromium/issues/detail?id=103653:

We've been seeing crashes in Chrome with stacks like:

0x001270c2]	WebCore::RenderStyle::~RenderStyle()
0x0030b8db]	WebCore::CSSStyleSelector::MatchedStyleDeclarationCacheItem::operator=(WebCore::CSSStyleSelector::MatchedStyleDeclarationCacheItem const &)
hashtable.h:969]	WTF::HashTable<unsigned int,std::pair<unsigned int,WebCore::CSSStyleSelector::MatchedStyleDeclarationCacheItem>,WTF::PairFirstExtractor<std::pair<unsigned int,WebCore::CSSStyleSelector::MatchedStyleDeclarationCacheItem> >,WTF::IntHash<unsigned int>,WTF::PairHashTraits<WTF::HashTraits<unsigned int>,WTF::HashTraits<WebCore::CSSStyleSelector::MatchedStyleDeclarationCacheItem> >,WTF::HashTraits<unsigned int> >::rehash(int)
hashtable.h:739]	WTF::HashTable<unsigned int,std::pair<unsigned int,WebCore::CSSStyleSelector::MatchedStyleDeclarationCacheItem>,WTF::PairFirstExtractor<std::pair<unsigned int,WebCore::CSSStyleSelector::MatchedStyleDeclarationCacheItem> >,WTF::IntHash<unsigned int>,WTF::PairHashTraits<WTF::HashTraits<unsigned int>,WTF::HashTraits<WebCore::CSSStyleSelector::MatchedStyleDeclarationCacheItem> >,WTF::HashTraits<unsigned int> >::add<WTF::HashMapTranslator<WTF::PairHashTraits<WTF::HashTraits<unsigned int>,WTF::HashTraits<WebCore::CSSStyleSelector::MatchedStyleDeclarationCacheItem> >,WTF::IntHash<unsigned int> >,unsigned int,WebCore::CSSStyleSelector::MatchedStyleDeclarationCacheItem>(unsigned int const &,WebCore::CSSStyleSelector::MatchedStyleDeclarationCacheItem const &)
cssstyleselector.cpp:2624]	WebCore::CSSStyleSelector::addToMatchedDeclarationCache(WebCore::RenderStyle const *,WebCore::RenderStyle const *,unsigned int,WebCore::CSSStyleSelector::MatchResult const &)
cssstyleselector.cpp:2717]	WebCore::CSSStyleSelector::applyMatchedDeclarations(WebCore::CSSStyleSelector::MatchResult const &)
cssstyleselector.cpp:1524]	WebCore::CSSStyleSelector::styleForElement(WebCore::Element *,WebCore::RenderStyle *,bool,bool,WebCore::RenderRegion *)
element.cpp:1037]	WebCore::Element::styleForRenderer()
element.cpp:1061]	WebCore::Element::recalcStyle(WebCore::Node::StyleChange)
element.cpp:1138]	WebCore::Element::recalcStyle(WebCore::Node::StyleChange)
element.cpp:1138]	WebCore::Element::recalcStyle(WebCore::Node::StyleChange)

It appears that the MatchedDeclarationCache gets resized, and while the MatchedStyleDeclarationCacheItems are being copied over (http://trac.webkit.org/browser/trunk/Source/JavaScriptCore/wtf/HashTable.h#L970), something goes wrong in a RenderStyle destructor.

These crashes go as far back as Nov 2011, and started happening around the time http://trac.webkit.org/changeset/98542 went in.

[Mike Lawther]

The issue reported in http://code.google.com/p/chromium/issues/detail?id=103653 seems related - 

0x02851797	 [chrome.dll	 + 0x00c21797]	WebCore::DataRef<WebCore::SVGRenderStyle>::~DataRef<WebCore::SVGRenderStyle>()
0x0273cdf1	 [chrome.dll	 + 0x00b0cdf1]	WebCore::RenderStyle::`scalar deleting destructor'(unsigned int)
0x028c4273	 [chrome.dll	 - refptr.h:116	WTF::RefPtr<WebCore::RenderStyle>::operator=(WTF::RefPtr<WebCore::RenderStyle> const &)
0x028c3fc0	 [chrome.dll	 + 0x00c93fc0]	WebCore::CSSStyleSelector::MatchedStyleDeclarationCacheItem::operator=(WebCore::CSSStyleSelector::MatchedStyleDeclarationCacheItem const &)
0x028c446c	 [chrome.dll	 - hashtable.h:767	WTF::HashTable<unsigned int,std::pair<unsigned int,WebCore::CSSStyleSelector::MatchedStyleDeclarationCacheItem>,WTF::PairFirstExtractor<std::pair<unsigned int,WebCore::CSSStyleSelector::MatchedStyleDeclarationCacheItem> >,WTF::IntHash<unsigned int>,WTF::PairHashTraits<WTF::HashTraits<unsigned int>,WTF::HashTraits<WebCore::CSSStyleSelector::MatchedStyleDeclarationCacheItem> >,WTF::HashTraits<unsigned int> >::reinsert(std::pair<unsigned int,WebCore::CSSStyleSelector::MatchedStyleDeclarationCacheItem> &)
0x028c4110	 [chrome.dll	 - hashtable.h:909	WTF::HashTable<unsigned int,std::pair<unsigned int,WebCore::CSSStyleSelector::MatchedStyleDeclarationCacheItem>,WTF::PairFirstExtractor<std::pair<unsigned int,WebCore::CSSStyleSelector::MatchedStyleDeclarationCacheItem> >,WTF::IntHash<unsigned int>,WTF::PairHashTraits<WTF::HashTraits<unsigned int>,WTF::HashTraits<WebCore::CSSStyleSelector::MatchedStyleDeclarationCacheItem> >,WTF::HashTraits<unsigned int> >::expand()
0x028c3e4c	 [chrome.dll	 - hashtable.h:701	WTF::HashTable<unsigned int,std::pair<unsigned int,WebCore::CSSStyleSelector::MatchedStyleDeclarationCacheItem>,WTF::PairFirstExtractor<std::pair<unsigned int,WebCore::CSSStyleSelector::MatchedStyleDeclarationCacheItem> >,WTF::IntHash<unsigned int>,WTF::PairHashTraits<WTF::HashTraits<unsigned int>,WTF::HashTraits<WebCore::CSSStyleSelector::MatchedStyleDeclarationCacheItem> >,WTF::HashTraits<unsigned int> >::add<unsigned int,WebCore::CSSStyleSelector::MatchedStyleDeclarationCacheItem,WTF::HashMapTranslator<std::pair<unsigned int,WebCore::CSSStyleSelector::MatchedStyleDeclarationCacheItem>,WTF::PairHashTraits<WTF::HashTraits<unsigned int>,WTF::HashTraits<WebCore::CSSStyleSelector::MatchedStyleDeclarationCacheItem> >,WTF::IntHash<unsigned int> > >(unsigned int const &,WebCore::CSSStyleSelector::MatchedStyleDeclarationCacheItem const &)
0x028bbba9	 [chrome.dll	 - cssstyleselector.cpp:2228	WebCore::CSSStyleSelector::addToMatchedDeclarationCache(WebCore::RenderStyle const *,unsigned int,WebCore::CSSStyleSelector::MatchResult const &)
0x028bbe22	 [chrome.dll	 - cssstyleselector.cpp:2300	WebCore::CSSStyleSelector::applyMatchedDeclarations(WebCore::CSSStyleSelector::MatchResult const &)
0x028b9d41	 [chrome.dll	 - cssstyleselector.cpp:1249	WebCore::CSSStyleSelector::styleForElement(WebCore::Element *,WebCore::RenderStyle *,bool,bool)

[Brent Fulgham]

This code has been significantly refactored since this patch was proposed. There doesn't seem to be any action we can take here.

[Radar WebKit Bug Importer]

<rdar://problem/96977515>