Bug 8452 - mangleme(0x58c22e11): Random crashes
Summary: mangleme(0x58c22e11): Random crashes
Status: RESOLVED FIXED
Alias: None
Product: WebKit
Classification: Unclassified
Component: New Bugs (show other bugs)
Version: 420+
Hardware: Macintosh OS X 10.4
: P1 Normal
Assignee: Nobody
URL:
Keywords: NeedsReduction
Depends on:
Blocks:
 
Reported: 2006-04-17 22:07 PDT by Alexey Proskuryakov
Modified: 2006-04-25 14:20 PDT (History)
1 user (show)

See Also:


Attachments
test case (55.75 KB, application/octet-stream)
2006-04-17 22:34 PDT, Alexey Proskuryakov
no flags Details
Reduced test case (18 bytes, text/html)
2006-04-18 09:32 PDT, mitz
no flags Details
One way to fix this (1.03 KB, patch)
2006-04-18 10:03 PDT, mitz
no flags Details | Formatted Diff | Diff
Patch, including layout test and change log (4.97 KB, patch)
2006-04-24 10:08 PDT, mitz
darin: review+
Details | Formatted Diff | Diff

Note You need to log in before you can comment on or make changes to this bug.
Description Alexey Proskuryakov 2006-04-17 22:07:27 PDT
run-mangleme-tests 0x58c22e11 
or download and open the attached file (if uses a refresh, so opening form Bugzilla won't work). Crashes reliably, but in a different place each time. 

Using run-mangleme-tests with --guard-malloc could perhaps help to isolate the problem.
Comment 1 Alexey Proskuryakov 2006-04-17 22:34:42 PDT
Created attachment 7793 [details]
test case
Comment 2 mitz 2006-04-18 09:32:52 PDT
Created attachment 7802 [details]
Reduced test case

Memory smashing happens at render_frames.cpp:303 when the column- (or row-)length array is empty:
                gridLayout[gridLen - 1] += remainingLen[k];
Comment 3 mitz 2006-04-18 10:03:54 PDT
Created attachment 7804 [details]
One way to fix this
Comment 4 Darin Adler 2006-04-21 22:14:46 PDT
Comment on attachment 7804 [details]
One way to fix this

Seems to me that for an empty length array we should return len of 0, not 1. But returning 0 from toLengthArray does seem like a good idea when the string is empty.

On the other hand, we could just change if (grid) to if (grid && gridLen) and leave toLengthArray alone, I think.
Comment 5 mitz 2006-04-23 11:07:36 PDT
(In reply to comment #4)
> Seems to me that for an empty length array we should return len of 0, not 1.

Returning 1 makes WebKit match Firefox and WinIE's behavior when the cols (rows) attribute is an empty string, which is to make one column (row), and leaves everything in the state it would be if the attribute wasn't specified at all.

> On the other hand, we could just change if (grid) to if (grid && gridLen) and
> leave toLengthArray alone, I think.

That alone would not fix the compatibility issue.
Comment 6 mitz 2006-04-24 10:08:59 PDT
Created attachment 7942 [details]
Patch, including layout test and change log

Please see also my previous comment. I don't think you can test for the memory smasher.
Comment 7 Darin Adler 2006-04-24 20:37:50 PDT
Comment on attachment 7942 [details]
Patch, including layout test and change log

OK. I'm convinced. r=me