Bug 90820 - REGRESSION: Infinite loop in document.elementFromPoint
Summary: REGRESSION: Infinite loop in document.elementFromPoint
Status: RESOLVED FIXED
Alias: None
Product: WebKit
Classification: Unclassified
Component: SVG (show other bugs)
Version: 528+ (Nightly build)
Hardware: Unspecified Unspecified
: P1 Normal
Assignee: Shinya Kawanaka
URL:
Keywords: Regression
Depends on:
Blocks:
 
Reported: 2012-07-09 14:11 PDT by Philip Rogers
Modified: 2012-07-17 10:05 PDT (History)
6 users (show)

See Also:

Attachments
Testcase (903 bytes, text/html)
2012-07-09 14:11 PDT, Philip Rogers 		no flags Details
Patch (4.01 KB, patch)
2012-07-12 23:55 PDT, Shinya Kawanaka 		no flags Details | Formatted Diff | Diff
Archive of layout-test-results from gce-cr-linux-04 (347.17 KB, application/zip)
2012-07-13 00:26 PDT, WebKit Review Bot 		no flags Details
Rebased ToT (4.03 KB, patch)
2012-07-16 18:19 PDT, Shinya Kawanaka 		no flags Details | Formatted Diff | Diff
Show Obsolete (1) View All Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Philip Rogers 2012-07-09 14:11:17 PDT 
Created attachment 151315 [details]
Testcase

In writing a perf test (https://bugs.webkit.org/show_bug.cgi?id=90811) I found a bug where we infinite loop when calling document.elementFromPoint on a <use>'d element in SVG. In the attached testcase you should see:
About to call document.elementFromPoint(100,100)... 3... 2... 1... Done!

But you actually see:
About to call document.elementFromPoint(100,100)... 3... 2... 1...
and the browser hangs.

A quick look through trac hints at a regression from r118319 but that's just a guess.
Comment 1 Nikolas Zimmermann 2012-07-10 06:03:59 PDT 
Never heard about document.elementFromPoint before, its untested for SVG and likely to be broken.
Comment 2 Philip Rogers 2012-07-10 17:02:10 PDT 
(In reply to comment #1)
> Never heard about document.elementFromPoint before, its untested for SVG and likely to be broken.

Sure we do! elementFromPoint just calls through the nodeAtFloatPoint codepaths; lots of tests there. What we don't have is tests of this on <use> or <symbol> though, which is how this regressed.
Comment 3 Shinya Kawanaka 2012-07-12 23:16:54 PDT 
Hi, I found this issue accidentally. Let me check it...
Comment 4 Shinya Kawanaka 2012-07-12 23:55:11 PDT 
Created attachment 152163 [details]
Patch
Comment 5 Shinya Kawanaka 2012-07-12 23:55:48 PDT 
I hope this patch will pass the tests...
Comment 6 WebKit Review Bot 2012-07-13 00:26:24 PDT 
Comment on attachment 152163 [details]
Patch

Attachment 152163 [details] did not pass chromium-ews (chromium-xvfb):
Output: http://queues.webkit.org/results/13207953

New failing tests:
http/tests/w3c/webperf/approved/navigation-timing/html/test_performance_attributes_exist_in_object.html
Comment 7 WebKit Review Bot 2012-07-13 00:26:27 PDT 
Created attachment 152169 [details]
Archive of layout-test-results from gce-cr-linux-04

The attached test failures were seen while running run-webkit-tests on the chromium-ews.
Bot: gce-cr-linux-04  Port: <class 'webkitpy.common.config.ports.ChromiumXVFBPort'>  Platform: Linux-2.6.39-gcg-201203291735-x86_64-with-Ubuntu-10.04-lucid
Comment 8 Shinya Kawanaka 2012-07-13 00:34:42 PDT 
Comment on attachment 152163 [details]
Patch

I don't think this failure is related to my patch.
Comment 9 Shinya Kawanaka 2012-07-16 18:19:28 PDT 
Created attachment 152671 [details]
Rebased ToT
Comment 10 Shinya Kawanaka 2012-07-16 21:55:03 PDT 
zimmerman, could you review this?
Comment 11 Nikolas Zimmermann 2012-07-17 00:01:25 PDT 
Comment on attachment 152671 [details]
Rebased ToT

Great catch. r=me!
Comment 12 Shinya Kawanaka 2012-07-17 01:11:20 PDT 
(In reply to comment #11)
> (From update of attachment 152671 [details])
> Great catch. r=me!

Thanks for reviewing!
Comment 13 WebKit Review Bot 2012-07-17 01:37:55 PDT 
Comment on attachment 152671 [details]
Rebased ToT

Clearing flags on attachment: 152671

Committed r122825: <http://trac.webkit.org/changeset/122825>
Comment 14 WebKit Review Bot 2012-07-17 01:38:00 PDT 
All reviewed patches have been landed.  Closing bug.
Comment 15 Philip Rogers 2012-07-17 10:05:34 PDT 
(In reply to comment #14)
> All reviewed patches have been landed.  Closing bug.

Thanks for the quick fix Shinya! You rock :)