Bug 98993 - WebCore::RenderBlock::determineStartPosition crash
Summary: WebCore::RenderBlock::determineStartPosition crash
Status: RESOLVED FIXED
Alias: None
Product: WebKit
Classification: Unclassified
Component: Layout and Rendering (show other bugs)
Version: 528+ (Nightly build)
Hardware: Unspecified Unspecified
: P2 Normal
Assignee: Nobody
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2012-10-10 22:19 PDT by Mike Lawther
Modified: 2012-11-25 23:46 PST (History)
5 users (show)

See Also:


Attachments
Patch (4.70 KB, patch)
2012-10-16 02:15 PDT, Takashi Sakamoto
no flags Details | Formatted Diff | Diff
Patch (4.67 KB, patch)
2012-10-16 20:27 PDT, Takashi Sakamoto
no flags Details | Formatted Diff | Diff

Note You need to log in before you can comment on or make changes to this bug.
Description Mike Lawther 2012-10-10 22:19:55 PDT
As reported in http://crbug.com/123440.

Repro:
-----
<body style="position:absolute;">
<foo style="white-space:pre-wrap;">
<ul style="zoom:1866;"></ul>
<sup>
<foo id="root">
a<foo style="position:fixed;"></foo><foo><label id="node">
a</label>
</foo>
</foo></sup></foo>
</body>
<script type="text/javascript">
document.body.offsetTop;
root.appendChild(node);
</script>
-----

Crashes with NULL deref at:

0012ec24 030380b5 chrome_1c30000!WebCore::RenderBlock::determineStartPosition(class WebCore::LineLayoutState * layoutState = 0x0012ed88, class WebCore::BidiResolver<WebCore::InlineIterator,WebCore::BidiRun> * resolver = 0x0012ec68)+0x18b [c:\b\build\slave\win\build\src\third_party\webkit\source\webcore\rendering\renderblocklinelayout.cpp @ 1632]
0012ed6c 0303869c chrome_1c30000!WebCore::RenderBlock::layoutRunsAndFloats(class WebCore::LineLayoutState * layoutState = 0x0012ed88, bool hasInlineChild = true)+0x35 [c:\b\build\slave\win\build\src\third_party\webkit\source\webcore\rendering\renderblocklinelayout.cpp @ 1162]
[....]
Comment 1 Alexey Proskuryakov 2012-10-11 13:28:47 PDT
Affects Safari 6.0.1 and ToT.
Comment 2 Takashi Sakamoto 2012-10-16 02:15:02 PDT
Created attachment 168896 [details]
Patch
Comment 3 mitz 2012-10-16 08:10:29 PDT
Comment on attachment 168896 [details]
Patch

Shouldn't removing the line break object in the scenario you're describing dirty the line?

Can you simplify the test? It is not clear which style properties are significant to the bug and whether the node has to be moved or merely removed.
Comment 4 Takashi Sakamoto 2012-10-16 20:27:29 PDT
Created attachment 169080 [details]
Patch
Comment 5 Takashi Sakamoto 2012-10-16 20:57:02 PDT
(In reply to comment #3)

Thank you for reviewing.

I updated the condition, because the comment says:

                     // The previous line didn't break cleanly or broke at a newline
                     // that has been deleted, so treat it as dirty too.

I think, this would match the case:"The previous line broke at a newline that has been deleted."

> (From update of attachment 168896 [details])
> Shouldn't removing the line break object in the scenario you're describing dirty the line?

Removing the line break object is caused by Node::detach(). So, I think, it is a little difficult to avoid removing, because render objects related to the line break might be destroyed. 

#0  WebCore::RootInlineBox::childRemoved (this=0x7fffeaa96a98,  box=0x7fffea924b58)
#1  0x0000000001ea359c in WebCore::InlineFlowBox::removeChild (this=0x7fffea924a38, child=0x7fffea924b58)
#2  0x0000000001ea0b73 in WebCore::InlineBox::remove (this=0x7fffea924b58)
#3  0x0000000001f8c85d in WebCore::RenderInline::willBeDestroyed (this=0x7fffea8fdeb8)
#4  0x0000000001ffce75 in WebCore::RenderObject::destroy (this=0x7fffea8fdeb8)
#5  0x0000000001ffcd7d in WebCore::RenderObject::destroyAndCleanupAnonymousWrappers (this=0x7fffea8fdeb8)
#6  0x00000000010acaa2 in WebCore::Node::detach (this=0x7fffeaa05200)


> Can you simplify the test? It is not clear which style properties are significant to the bug and whether the node has to be moved or merely removed.

I see. I updated the test.

Best regards,
Takashi Sakamoto
Comment 6 Brent Fulgham 2012-11-25 23:38:12 PST
Comment on attachment 169080 [details]
Patch

Looks good. R=me.
Comment 7 WebKit Review Bot 2012-11-25 23:46:25 PST
Comment on attachment 169080 [details]
Patch

Clearing flags on attachment: 169080

Committed r135684: <http://trac.webkit.org/changeset/135684>
Comment 8 WebKit Review Bot 2012-11-25 23:46:29 PST
All reviewed patches have been landed.  Closing bug.