123726 2013-11-04 01:54:57 -0800 ASSERTION FAILED: m_gaveUpReference in WTF::PassRef<WebCore::RenderStyle>::~PassRef 2013-11-04 04:39:08 -0800 1 1 1 Unclassified WebKit Layout and Rendering 528+ (Nightly build) Unspecified Unspecified RESOLVED FIXED P2 Normal --- 116980 1 rhodovan.u-szeged kling andersca commit-queue darin esprehn+autocc glenn kling koivisto kondapallykalyan noam oldest_to_newest 946582 0 215898 rhodovan.u-szeged 2013-11-04 01:54:57 -0800 Created attachment 215898 Test case The test: <table> <div> <form style="display: none"/> Backtrace: Program received signal SIGSEGV, Segmentation fault. 0x00007ffff5d19749 in WTFCrash () at /home/reni/Data/REPOS/webkit_sec/Source/WTF/wtf/Assertions.cpp:342 342 *(int *)(uintptr_t)0xbbadbeef = 0; (gdb) bt #0 0x00007ffff5d19749 in WTFCrash () at /home/reni/Data/REPOS/webkit_sec/Source/WTF/wtf/Assertions.cpp:342 #1 0x00007ffff1275c13 in WTF::PassRef<WebCore::RenderStyle>::~PassRef (this=0x7fffffffbf90, __in_chrg=<optimized out>) at /home/reni/Data/REPOS/webkit_sec/Source/WTF/wtf/PassRef.h:102 #2 0x00007ffff150724e in WebCore::HTMLElement::createRenderer (this=0x1225c20, style=...) at /home/reni/Data/REPOS/webkit_sec/Source/WebCore/html/HTMLElement.cpp:788 #3 0x00007ffff1da26f0 in WebCore::Style::createRendererIfNeeded (element=..., resolvedStyle=...) at /home/reni/Data/REPOS/webkit_sec/Source/WebCore/style/StyleResolveTree.cpp:240 #4 0x00007ffff1da33b6 in WebCore::Style::attachRenderTree (current=..., resolvedStyle=...) at /home/reni/Data/REPOS/webkit_sec/Source/WebCore/style/StyleResolveTree.cpp:478 #5 0x00007ffff1da44e6 in WebCore::Style::attachRenderTree (element=...) at /home/reni/Data/REPOS/webkit_sec/Source/WebCore/style/StyleResolveTree.cpp:832 #6 0x00007ffff15f67c2 in WebCore::executeTask (task=...) at /home/reni/Data/REPOS/webkit_sec/Source/WebCore/html/parser/HTMLConstructionSite.cpp:104 #7 0x00007ffff15f6b01 in WebCore::HTMLConstructionSite::executeQueuedTasks (this=0x93b678) at /home/reni/Data/REPOS/webkit_sec/Source/WebCore/html/parser/HTMLConstructionSite.cpp:150 #8 0x00007ffff1623442 in WebCore::HTMLTreeBuilder::constructTree (this=0x93b660, token=0x7fffffffc200) at /home/reni/Data/REPOS/webkit_sec/Source/WebCore/html/parser/HTMLTreeBuilder.cpp:368 #9 0x00007ffff15fe77c in WebCore::HTMLDocumentParser::constructTreeFromHTMLToken (this=0x106b880, rawToken=...) at /home/reni/Data/REPOS/webkit_sec/Source/WebCore/html/parser/HTMLDocumentParser.cpp:595 #10 0x00007ffff15fe3e7 in WebCore::HTMLDocumentParser::pumpTokenizer (this=0x106b880, mode=WebCore::HTMLDocumentParser::AllowYield) at /home/reni/Data/REPOS/webkit_sec/Source/WebCore/html/parser/HTMLDocumentParser.cpp:552 #11 0x00007ffff15fdbd7 in WebCore::HTMLDocumentParser::pumpTokenizerIfPossible (this=0x106b880, mode=WebCore::HTMLDocumentParser::AllowYield) at /home/reni/Data/REPOS/webkit_sec/Source/WebCore/html/parser/HTMLDocumentParser.cpp:236 #12 0x00007ffff15fecbd in WebCore::HTMLDocumentParser::append (this=0x106b880, inputSource=...) at /home/reni/Data/REPOS/webkit_sec/Source/WebCore/html/parser/HTMLDocumentParser.cpp:742 #13 0x00007ffff1303a96 in WebCore::DecodedDataDocumentParser::flush (this=0x106b880, writer=...) at /home/reni/Data/REPOS/webkit_sec/Source/WebCore/dom/DecodedDataDocumentParser.cpp:60 #14 0x00007ffff17701e1 in WebCore::DocumentWriter::end (this=0x1164020) at /home/reni/Data/REPOS/webkit_sec/Source/WebCore/loader/DocumentWriter.cpp:242 #15 0x00007ffff175da7a in WebCore::DocumentLoader::finishedLoading (this=0x1163f80, finishTime=0) at /home/reni/Data/REPOS/webkit_sec/Source/WebCore/loader/DocumentLoader.cpp:408 #16 0x00007ffff175d7e8 in WebCore::DocumentLoader::notifyFinished (this=0x1163f80, resource=0x1179fc0) at /home/reni/Data/REPOS/webkit_sec/Source/WebCore/loader/DocumentLoader.cpp:345 #17 0x00007ffff17f3d76 in WebCore::CachedResource::checkNotify (this=0x1179fc0) at /home/reni/Data/REPOS/webkit_sec/Source/WebCore/loader/cache/CachedResource.cpp:369 #18 0x00007ffff17f3e50 in WebCore::CachedResource::finishLoading (this=0x1179fc0) at /home/reni/Data/REPOS/webkit_sec/Source/WebCore/loader/cache/CachedResource.cpp:385 #19 0x00007ffff17f08aa in WebCore::CachedRawResource::finishLoading (this=0x1179fc0, data=0x1129c50) at /home/reni/Data/REPOS/webkit_sec/Source/WebCore/loader/cache/CachedRawResource.cpp:94 #20 0x00007ffff17ae630 in WebCore::SubresourceLoader::didFinishLoading (this=0x117a530, finishTime=0) at /home/reni/Data/REPOS/webkit_sec/Source/WebCore/loader/SubresourceLoader.cpp:283 #21 0x00007ffff17aa7d1 in WebCore::ResourceLoader::didFinishLoading (this=0x117a530, finishTime=0) at /home/reni/Data/REPOS/webkit_sec/Source/WebCore/loader/ResourceLoader.cpp:487 #22 0x00007ffff248228e in WebCore::readCallback (asyncResult=0x117f9b0, data=0x1179fa0) at /home/reni/Data/REPOS/webkit_sec/Source/WebCore/platform/network/soup/ResourceHandleSoup.cpp:1328 #23 0x00007fffe88b7bc9 in async_ready_callback_wrapper (source_object=0x670980, res=0x117f9b0, user_data=0x1179fa0) at ginputstream.c:530 #24 0x00007fffe88d9ccb in g_task_return_now (task=0x117f9b0) at gtask.c:1105 #25 complete_in_idle_cb (task=<optimized out>) at gtask.c:1114 #26 0x00007fffedfc7473 in g_main_dispatch (context=0x117f0a0) at gmain.c:3054 #27 g_main_context_dispatch (context=0x117f0a0) at gmain.c:3630 #28 0x00007ffff75c8aee in _ecore_glib_select__locked (ecore_timeout=0x117f0a0, efds=<optimized out>, wfds=<optimized out>, rfds=<optimized out>, ecore_fds=1, ctx=<optimized out>) at ecore_glib.c:171 #29 _ecore_glib_select (ecore_fds=1, rfds=<optimized out>, wfds=<optimized out>, efds=<optimized out>, ecore_timeout=0x117f0a0) at ecore_glib.c:205 #30 0x00007ffff75c2cb9 in _ecore_main_select (timeout=<optimized out>) at ecore_main.c:1466 #31 0x00007ffff75c3789 in _ecore_main_loop_iterate_internal (once_only=0) at ecore_main.c:1860 ---Type <return> to continue, or q <return> to quit--- #32 0x00007ffff75c3b47 in ecore_main_loop_begin () at ecore_main.c:956 #33 0x0000000000406dfa in main (argc=2, argv=0x7fffffffde68) at /home/reni/Data/REPOS/webkit_sec/Tools/EWebLauncher/main.c:1044 946617 1 215910 kling 2013-11-04 04:16:51 -0800 Created attachment 215910 Patch 946626 2 commit-queue 2013-11-04 04:38:18 -0800 The commit-queue encountered the following flaky tests while processing attachment 215910: webaudio/delaynode-maxdelay.html bug 123736 (authors: crogers@google.com, haraken@chromium.org, mark.lam@apple.com, and rniwa@webkit.org) The commit-queue is continuing to process your patch. 946627 3 215910 commit-queue 2013-11-04 04:39:06 -0800 Comment on attachment 215910 Patch Clearing flags on attachment: 215910 Committed r158570: <http://trac.webkit.org/changeset/158570> 946628 4 commit-queue 2013-11-04 04:39:08 -0800 All reviewed patches have been landed. Closing bug. 215898 2013-11-04 01:54:57 -0800 2013-11-04 01:54:57 -0800 Test case lastCrash.html text/html 43 rhodovan.u-szeged PHRhYmxlPgo8ZGl2Pgo8Zm9ybSBzdHlsZT0iZGlzcGxheTogbm9uZSIvPg== 215910 2013-11-04 04:16:51 -0800 2013-11-04 04:39:05 -0800 Patch bug-123726.diff text/plain 2938 kling ZGlmZiAtLWdpdCBhL0xheW91dFRlc3RzL0NoYW5nZUxvZyBiL0xheW91dFRlc3RzL0NoYW5nZUxv ZwppbmRleCAxOGQ2ZjMxLi40NjY0NmEwIDEwMDY0NAotLS0gYS9MYXlvdXRUZXN0cy9DaGFuZ2VM b2cKKysrIGIvTGF5b3V0VGVzdHMvQ2hhbmdlTG9nCkBAIC0xLDUgKzEsMTUgQEAKIDIwMTMtMTEt MDQgIEFuZHJlYXMgS2xpbmcgIDxha2xpbmdAYXBwbGUuY29tPgogCisgICAgICAgIFJFR1JFU1NJ T046IFJlbmRlclN0eWxlIGlzIGxlYWtlZCB3aGVuIG5vdCBjcmVhdGluZyByZW5kZXJlciBmb3Ig ZGlzcGxheTpub25lCisgICAgICAgIDxodHRwczovL3dlYmtpdC5vcmcvYi8xMjM3MjY+CisKKyAg ICAgICAgUmV2aWV3ZWQgYnkgTk9CT0RZIChPT1BTISkuCisKKyAgICAgICAgKiBmYXN0L2Nzcy9y ZW5kZXJzdHlsZS1sZWFrLXdpdGgtZGlzcGxheS1ub25lLWV4cGVjdGVkLnR4dDogQWRkZWQuCisg ICAgICAgICogZmFzdC9jc3MvcmVuZGVyc3R5bGUtbGVhay13aXRoLWRpc3BsYXktbm9uZS5odG1s OiBBZGRlZC4KKworMjAxMy0xMS0wNCAgQW5kcmVhcyBLbGluZyAgPGFrbGluZ0BhcHBsZS5jb20+ CisKICAgICAgICAgT3B0aW1pemUgYmFzZWxpbmVzOiBzdmcvem9vbQogCiAgICAgICAgIFVucmV2 aWV3ZWQ7IHJ1biAid2Via2l0LXBhdGNoIG9wdGltaXplLWJhc2VsaW5lcyBzdmcvem9vbSIKZGlm ZiAtLWdpdCBhL0xheW91dFRlc3RzL2Zhc3QvY3NzL3JlbmRlcnN0eWxlLWxlYWstd2l0aC1kaXNw bGF5LW5vbmUtZXhwZWN0ZWQudHh0IGIvTGF5b3V0VGVzdHMvZmFzdC9jc3MvcmVuZGVyc3R5bGUt bGVhay13aXRoLWRpc3BsYXktbm9uZS1leHBlY3RlZC50eHQKbmV3IGZpbGUgbW9kZSAxMDA2NDQK aW5kZXggMDAwMDAwMC4uZjdmZjI5YgotLS0gL2Rldi9udWxsCisrKyBiL0xheW91dFRlc3RzL2Zh c3QvY3NzL3JlbmRlcnN0eWxlLWxlYWstd2l0aC1kaXNwbGF5LW5vbmUtZXhwZWN0ZWQudHh0CkBA IC0wLDAgKzEsMiBAQAorVGhpcyB0ZXN0IHBhc3NlcyBpZiBpdCBkb2VzIG5vdCBhc3NlcnQgaW4g YSBkZWJ1ZyBidWlsZC4KKwpkaWZmIC0tZ2l0IGEvTGF5b3V0VGVzdHMvZmFzdC9jc3MvcmVuZGVy c3R5bGUtbGVhay13aXRoLWRpc3BsYXktbm9uZS5odG1sIGIvTGF5b3V0VGVzdHMvZmFzdC9jc3Mv cmVuZGVyc3R5bGUtbGVhay13aXRoLWRpc3BsYXktbm9uZS5odG1sCm5ldyBmaWxlIG1vZGUgMTAw NjQ0CmluZGV4IDAwMDAwMDAuLjQ0MWRjYWYKLS0tIC9kZXYvbnVsbAorKysgYi9MYXlvdXRUZXN0 cy9mYXN0L2Nzcy9yZW5kZXJzdHlsZS1sZWFrLXdpdGgtZGlzcGxheS1ub25lLmh0bWwKQEAgLTAs MCArMSw4IEBACis8c2NyaXB0PgorICAgIGlmICh3aW5kb3cudGVzdFJ1bm5lcikKKyAgICAgICAg dGVzdFJ1bm5lci5kdW1wQXNUZXh0KCk7Cis8L3NjcmlwdD4KKzx0YWJsZT4KKzxkaXY+Cis8Zm9y bSBzdHlsZT0iZGlzcGxheTogbm9uZSIvPgorVGhpcyB0ZXN0IHBhc3NlcyBpZiBpdCBkb2VzIG5v dCBhc3NlcnQgaW4gYSBkZWJ1ZyBidWlsZC4KZGlmZiAtLWdpdCBhL1NvdXJjZS9XZWJDb3JlL0No YW5nZUxvZyBiL1NvdXJjZS9XZWJDb3JlL0NoYW5nZUxvZwppbmRleCA5MjAxYjFhLi5mODAxMjNm IDEwMDY0NAotLS0gYS9Tb3VyY2UvV2ViQ29yZS9DaGFuZ2VMb2cKKysrIGIvU291cmNlL1dlYkNv cmUvQ2hhbmdlTG9nCkBAIC0xLDUgKzEsMjAgQEAKIDIwMTMtMTEtMDQgIEFuZHJlYXMgS2xpbmcg IDxha2xpbmdAYXBwbGUuY29tPgogCisgICAgICAgIFJFR1JFU1NJT046IFJlbmRlclN0eWxlIGlz IGxlYWtlZCB3aGVuIG5vdCBjcmVhdGluZyByZW5kZXJlciBmb3IgZGlzcGxheTpub25lCisgICAg ICAgIDxodHRwczovL3dlYmtpdC5vcmcvYi8xMjM3MjY+CisKKyAgICAgICAgRXhwbGljaXRseSBk cm9wIHRoZSBSZW5kZXJTdHlsZSByZWZlcmVuY2UgaW4gUmVuZGVyRWxlbWVudDo6Y3JlYXRlRm9y CisgICAgICAgIGlmIHdlIGRlY2lkZSB0byBub3QgY3JlYXRlIGFueSByZW5kZXJlci4KKworICAg ICAgICBSZXZpZXdlZCBieSBOT0JPRFkgKE9PUFMhKS4KKworICAgICAgICBUZXN0OiBmYXN0L2Nz cy9yZW5kZXJzdHlsZS1sZWFrLXdpdGgtZGlzcGxheS1ub25lLmh0bWwKKworICAgICAgICAqIHJl bmRlcmluZy9SZW5kZXJFbGVtZW50LmNwcDoKKyAgICAgICAgKFdlYkNvcmU6OlJlbmRlckVsZW1l bnQ6OmNyZWF0ZUZvcik6CisKKzIwMTMtMTEtMDQgIEFuZHJlYXMgS2xpbmcgIDxha2xpbmdAYXBw bGUuY29tPgorCiAgICAgICAgIFNvbWUgbW9yZSBSZW5kZXJDaGlsZEl0ZXJhdG9yIGRlcGxveW1l bnQuCiAgICAgICAgIDxodHRwczovL3dlYmtpdC5vcmcvYi8xMjM3MzU+CiAKZGlmZiAtLWdpdCBh L1NvdXJjZS9XZWJDb3JlL3JlbmRlcmluZy9SZW5kZXJFbGVtZW50LmNwcCBiL1NvdXJjZS9XZWJD b3JlL3JlbmRlcmluZy9SZW5kZXJFbGVtZW50LmNwcAppbmRleCBiMTc0YWZjLi4yYWRhYzZlIDEw MDY0NAotLS0gYS9Tb3VyY2UvV2ViQ29yZS9yZW5kZXJpbmcvUmVuZGVyRWxlbWVudC5jcHAKKysr IGIvU291cmNlL1dlYkNvcmUvcmVuZGVyaW5nL1JlbmRlckVsZW1lbnQuY3BwCkBAIC0xNDksNyAr MTQ5LDggQEAgUmVuZGVyRWxlbWVudCogUmVuZGVyRWxlbWVudDo6Y3JlYXRlRm9yKEVsZW1lbnQm IGVsZW1lbnQsIFBhc3NSZWY8UmVuZGVyU3R5bGU+IHMKICAgICAgICAgcmV0dXJuIG5ldyBSZW5k ZXJSdWJ5VGV4dChlbGVtZW50LCBzdGQ6Om1vdmUoc3R5bGUpKTsKICAgICBzd2l0Y2ggKHN0eWxl LmdldCgpLmRpc3BsYXkoKSkgewogICAgIGNhc2UgTk9ORToKLSAgICAgICAgcmV0dXJuIDA7Cisg ICAgICAgIHN0eWxlLmRyb3BSZWYoKTsKKyAgICAgICAgcmV0dXJuIG51bGxwdHI7CiAgICAgY2Fz ZSBJTkxJTkU6CiAgICAgICAgIHJldHVybiBuZXcgUmVuZGVySW5saW5lKGVsZW1lbnQsIHN0ZDo6 bW92ZShzdHlsZSkpOwogICAgIGNhc2UgQkxPQ0s6Cg==