17672 2008-03-04 15:27:34 -0800 Reproducible SVG Crash when acid3-test-77.html timing dependency is fixed 2012-07-20 08:43:10 -0700 1 1 1 Unclassified WebKit SVG 528+ (Nightly build) Mac OS X 10.5 RESOLVED WORKSFORME InRadar, NeedsReduction P1 Normal --- 1 zimmermann webkit-unassigned ap bdakin ddkilzer eric hyatt ismail koivisto oliver schenney webkit oldest_to_newest 72749 0 zimmermann 2008-03-04 15:27:34 -0800 acid3-test-77.html loads 'resources/Acid3Font-loader.svg' through HTMLIFrameElement. This file defines a <font> element which references 'resources/Acid3Font.svg' names as 'ACID3svgfont'. Furthermore it contains a <text font-family="ACID3svgfont'>X</text> element which is supposed to force us loading the font and delay sending the onload event. As the onload event is immediately fired now (as the load hasn't been kicked before the first layout happens), we're using a window.setTimeout("executeTest()", 150) hack instead of calling the function directly. Davids idea was to add <script>document.documentElement.offsetWidth;</script> to that document, and see wheter it fixes the onload send delay. Though it currently crashs us deep in SVGRootInlineBox. Fix both issues. 74112 1 eric 2008-03-17 10:02:32 -0700 Since this is a repro crash, it should be a P1, no? Now we just need to create an example crashing test case. 74185 2 eric 2008-03-17 16:01:49 -0700 http://paste.lisp.org/display/57519 is supposedly a crashlog for this crash. 75143 3 eric 2008-03-25 13:07:02 -0700 ahha! This could be a test case for bug 17902! *** This bug has been marked as a duplicate of 17902 *** 75149 4 eric 2008-03-25 14:07:36 -0700 I was wrong, this is not a dupe. 75150 5 20040 eric 2008-03-25 14:09:10 -0700 Created attachment 20040 patch which shows the crash (code change is not required, only test change) 75205 6 darin 2008-03-25 16:19:19 -0700 Does this affect the real Acid3 or only the modified copy we have in our LayoutTests directory? 75207 7 eric 2008-03-25 16:27:50 -0700 bug 17902 affects the real acid3, but this crash does not (to my knowledge). This crash is reproducible in TOT however (if you modify the test case as described above). 75401 8 darin 2008-03-26 19:59:28 -0700 Removing this from the list blocking bug 17064, since it's not an Acid3 bug. 75852 9 eric 2008-03-30 13:30:59 -0700 CCing hyatt, since he had to leave #webkit before I could actually send him the bug link. 84075 10 ddkilzer 2008-06-22 12:41:51 -0700 Running svg/custom/acid3-test-77.html with a debug build of WebKit r34722 causes an assertion failure as well: ASSERTION FAILED: !HashTranslator::equal(KeyTraits::emptyValue(), key) (/path/to/WebKit/WebKitBuild/Debug/JavaScriptCore.framework/PrivateHeaders/HashTable.h:444 void WTF::HashTable<Key, Value, Extractor, HashFunctions, Traits, KeyTraits>::checkKey(const T&) [with T = UChar, HashTranslator = WTF::IdentityHashTranslator<UChar, std::pair<UChar, WTF::RefPtr<WebCore::GlyphMapNode> >, WTF::IntHash<unsigned int> >, Key = UChar, Value = std::pair<UChar, WTF::RefPtr<WebCore::GlyphMapNode> >, Extractor = WTF::PairFirstExtractor<std::pair<UChar, WTF::RefPtr<WebCore::GlyphMapNode> > >, HashFunctions = WTF::IntHash<unsigned int>, Traits = WTF::PairHashTraits<WTF::HashTraits<UChar>, WTF::HashTraits<WTF::RefPtr<WebCore::GlyphMapNode> > >, KeyTraits = WTF::HashTraits<UChar>]) Back trace: Exception: EXC_BAD_ACCESS (0x0001) Codes: KERN_INVALID_ADDRESS (0x0001) at 0xbbadbeef Thread 0 Crashed: 0 com.apple.WebCore 0x01fd2490 void WTF::HashTable<unsigned short, std::pair<unsigned short, WTF::RefPtr<WebCore::GlyphMapNode> >, WTF::PairFirstExtractor<std::pair<unsigned short, WTF::RefPtr<WebCore::GlyphMapNode> > >, WTF::IntHash<unsigned>, WTF::PairHashTraits<WTF::HashTraits<unsigned short>, WTF::HashTraits<WTF::RefPtr<WebCore::GlyphMapNode> > >, WTF::HashTraits<unsigned short> >::checkKey<unsigned short, WTF::IdentityHashTranslator<unsigned short, std::pair<unsigned short, WTF::RefPtr<WebCore::GlyphMapNode> >, WTF::IntHash<unsigned> > >(unsigned short const&) + 116 (HashTable.h:444) 1 com.apple.WebCore 0x01fd2584 std::pair<unsigned short, WTF::RefPtr<WebCore::GlyphMapNode> >* WTF::HashTable<unsigned short, std::pair<unsigned short, WTF::RefPtr<WebCore::GlyphMapNode> >, WTF::PairFirstExtractor<std::pair<unsigned short, WTF::RefPtr<WebCore::GlyphMapNode> > >, WTF::IntHash<unsigned>, WTF::PairHashTraits<WTF::HashTraits<unsigned short>, WTF::HashTraits<WTF::RefPtr<WebCore::GlyphMapNode> > >, WTF::HashTraits<unsigned short> >::lookup<unsigned short, WTF::IdentityHashTranslator<unsigned short, std::pair<unsigned short, WTF::RefPtr<WebCore::GlyphMapNode> >, WTF::IntHash<unsigned> > >(unsigned short const&) + 40 (HashTable.h:460) 2 com.apple.WebCore 0x01fd26c4 WTF::HashTable<unsigned short, std::pair<unsigned short, WTF::RefPtr<WebCore::GlyphMapNode> >, WTF::PairFirstExtractor<std::pair<unsigned short, WTF::RefPtr<WebCore::GlyphMapNode> > >, WTF::IntHash<unsigned>, WTF::PairHashTraits<WTF::HashTraits<unsigned short>, WTF::HashTraits<WTF::RefPtr<WebCore::GlyphMapNode> > >, WTF::HashTraits<unsigned short> >::lookup(unsigned short const&) + 40 (HashTable.h:331) 3 com.apple.WebCore 0x01fd2710 WTF::HashMap<unsigned short, WTF::RefPtr<WebCore::GlyphMapNode>, WTF::IntHash<unsigned>, WTF::HashTraits<unsigned short>, WTF::HashTraits<WTF::RefPtr<WebCore::GlyphMapNode> > >::get(unsigned short const&) const + 48 (HashMap.h:208) 4 com.apple.WebCore 0x01fd27cc WebCore::SVGGlyphMap::get(WebCore::String const&, WTF::Vector<WebCore::SVGGlyphIdentifier, (unsigned long)0>&) + 104 (SVGGlyphMap.h:85) 5 com.apple.WebCore 0x0183df4c WebCore::SVGFontElement::getGlyphIdentifiersForString(WebCore::String const&, WTF::Vector<WebCore::SVGGlyphIdentifier, (unsigned long)0>&) const + 64 (SVGFontElement.cpp:238) 6 com.apple.WebCore 0x01fd605c WebCore::SVGTextRunWalker<WebCore::SVGTextRunWalkerMeasuredLengthData>::walk(WebCore::TextRun const&, bool, WebCore::String const&, int, int) + 716 (SVGFont.cpp:280) 7 com.apple.WebCore 0x018400b4 WebCore::floatWidthOfSubStringUsingSVGFont(WebCore::Font const*, WebCore::TextRun const&, int, int, int, int&, WebCore::String&) + 680 (SVGFont.cpp:416) 8 com.apple.WebCore 0x01840340 WebCore::Font::floatWidthUsingSVGFont(WebCore::TextRun const&, int, int&, WebCore::String&) const + 84 (SVGFont.cpp:433) 9 com.apple.WebCore 0x013f5f48 WebCore::Font::floatWidth(WebCore::TextRun const&, int, int&, WebCore::String&) const + 104 (Font.cpp:718) 10 com.apple.WebCore 0x01728af4 WebCore::SVGInlineTextBox::calculateGlyphWidth(WebCore::RenderStyle*, int, int, int&, WebCore::String&) const + 268 (SVGInlineTextBox.cpp:80) 11 com.apple.WebCore 0x01f4ed1c WebCore::SVGInlineTextBoxQueryWalker::chunkPortionCallback(WebCore::SVGInlineTextBox*, int, WebCore::AffineTransform const&, WebCore::SVGChar* const&, WebCore::SVGChar* const&) + 1288 (SVGTextContentElement.cpp:202) 12 com.apple.WebCore 0x01f4e168 WebCore::SVGTextChunkWalker<WebCore::SVGInlineTextBoxQueryWalker>::operator()(WebCore::SVGInlineTextBox*, int, WebCore::AffineTransform const&, WebCore::SVGChar* const&, WebCore::SVGChar* const&) + 188 (SVGCharacterLayoutInfo.h:342) 13 com.apple.WebCore 0x0177755c WebCore::SVGRootInlineBox::walkTextChunks(WebCore::SVGTextChunkWalkerBase*, WebCore::SVGInlineTextBox const*) + 900 (SVGRootInlineBox.cpp:1686) 14 com.apple.WebCore 0x0178b2e4 WebCore::executeTextQuery(WebCore::SVGTextContentElement const*, WebCore::SVGInlineTextBoxQueryWalker::QueryMode, long, long, WebCore::FloatPoint) + 468 (SVGTextContentElement.cpp:363) 15 com.apple.WebCore 0x0178bb58 WebCore::SVGTextContentElement::getEndPositionOfChar(long, int&) const + 196 (SVGTextContentElement.cpp:429) 16 com.apple.WebCore 0x0159e4f4 WebCore::jsSVGTextContentElementPrototypeFunctionGetEndPositionOfChar(KJS::ExecState*, KJS::JSObject*, KJS::ArgList const&) + 200 (JSSVGTextContentElement.cpp:315) 17 com.apple.JavaScriptCore 0x0100c3f0 KJS::PrototypeFunction::callAsFunction(KJS::ExecState*, KJS::JSObject*, KJS::ArgList const&) + 68 (JSFunction.cpp:731) 18 com.apple.JavaScriptCore 0x01078ae4 KJS::Machine::privateExecute(KJS::Machine::ExecutionFlag, KJS::ExecState*, KJS::RegisterFile*, KJS::Register*, KJS::ScopeChainNode*, KJS::CodeBlock*, KJS::JSValue**) + 23892 (Machine.cpp:2122) 19 com.apple.JavaScriptCore 0x0107a3a4 KJS::Machine::execute(KJS::EvalNode*, KJS::ExecState*, KJS::JSObject*, KJS::RegisterFile*, int, KJS::ScopeChainNode*, KJS::JSValue**) + 1108 (Machine.cpp:799) 20 com.apple.JavaScriptCore 0x0107a750 KJS::callEval(KJS::ExecState*, KJS::JSObject*, KJS::ScopeChainNode*, KJS::RegisterFile*, KJS::Register*, int, int, KJS::JSValue*&) + 740 (Machine.cpp:461) 21 com.apple.JavaScriptCore 0x010785ec KJS::Machine::privateExecute(KJS::Machine::ExecutionFlag, KJS::ExecState*, KJS::RegisterFile*, KJS::Register*, KJS::ScopeChainNode*, KJS::CodeBlock*, KJS::JSValue**) + 22620 (Machine.cpp:2004) 22 com.apple.JavaScriptCore 0x0107ae90 KJS::Machine::execute(KJS::ProgramNode*, KJS::ExecState*, KJS::ScopeChainNode*, KJS::JSObject*, KJS::RegisterFileStack*, KJS::JSValue**) + 580 (Machine.cpp:669) 23 com.apple.JavaScriptCore 0x01064de8 KJS::Interpreter::evaluate(KJS::ExecState*, KJS::ScopeChain&, KJS::UString const&, int, WTF::PassRefPtr<KJS::SourceProvider>, KJS::JSValue*) + 476 (interpreter.cpp:82) 24 com.apple.WebCore 0x0182cd08 WebCore::ScriptController::evaluate(WebCore::String const&, int, WebCore::String const&) + 340 (ScriptController.cpp:90) 25 com.apple.WebCore 0x01421fa8 WebCore::FrameLoader::executeScript(WebCore::String const&, int, WebCore::String const&) + 228 (FrameLoader.cpp:783) 26 com.apple.WebCore 0x01422068 WebCore::FrameLoader::executeScript(WebCore::String const&, bool) + 108 (FrameLoader.cpp:772) 27 com.apple.WebCore 0x017a2cb8 WebCore::ScheduledAction::execute(WebCore::JSDOMWindowShell*) + 1036 (ScheduledAction.cpp:92) 28 com.apple.WebCore 0x0186acbc WebCore::JSDOMWindowBase::timerFired(WebCore::DOMWindowTimer*) + 528 (JSDOMWindowBase.cpp:1280) 29 com.apple.WebCore 0x0186ad60 WebCore::DOMWindowTimer::fired() + 72 (JSDOMWindowBase.cpp:1313) 30 com.apple.WebCore 0x017e0780 WebCore::TimerBase::fireTimers(double, WTF::Vector<WebCore::TimerBase*, (unsigned long)0> const&) + 240 (Timer.cpp:350) 31 com.apple.WebCore 0x017e0860 WebCore::TimerBase::sharedTimerFired() + 132 (Timer.cpp:370) 32 com.apple.WebCore 0x017b82f0 WebCore::timerFired(__CFRunLoopTimer*, void*) + 140 (SharedTimerMac.mm:85) 33 com.apple.CoreFoundation 0x907f2370 __CFRunLoopDoTimer + 184 34 com.apple.CoreFoundation 0x907dece8 __CFRunLoopRun + 1680 35 com.apple.CoreFoundation 0x907de29c CFRunLoopRunSpecific + 268 36 com.apple.HIToolbox 0x9329fb20 RunCurrentEventLoopInMode + 264 37 com.apple.HIToolbox 0x9329f1b4 ReceiveNextEventCommon + 380 38 com.apple.HIToolbox 0x9329f020 BlockUntilNextEventMatchingListInMode + 96 39 com.apple.AppKit 0x937a5874 _DPSNextEvent + 384 40 com.apple.AppKit 0x937a5538 -[NSApplication nextEventMatchingMask:untilDate:inMode:dequeue:] + 116 41 com.apple.Safari 0x000095e0 0x1000 + 34272 42 com.apple.AppKit 0x937a1a7c -[NSApplication run] + 472 43 com.apple.AppKit 0x93892598 NSApplicationMain + 452 44 com.apple.Safari 0x0009bad4 0x1000 + 633556 45 com.apple.Safari 0x000022fc 0x1000 + 4860 84076 11 ddkilzer 2008-06-22 12:42:50 -0700 <rdar://problem/6026695> 86515 12 oliver 2008-07-20 17:02:31 -0700 Can anyone still repro this? i've tried to no avail for 15 minutes now... 86516 13 ddkilzer 2008-07-20 17:07:48 -0700 (In reply to comment #12) > Can anyone still repro this? i've tried to no avail for 15 minutes now... I'll try at work again tomorrow. 86525 14 ddkilzer 2008-07-20 22:00:58 -0700 (In reply to comment #12) > Can anyone still repro this? i've tried to no avail for 15 minutes now... The buildbot still sees it: http://build.webkit.org/results/trunk-mac-intel-debug/4608/results.html 674602 15 schenney 2012-07-20 08:43:10 -0700 Closing this bug because the acid3-test-77 file does not appear in an TestExpectations and is only Skipped for qt-4.8. 20040 2008-03-25 14:09:10 -0700 2010-06-10 15:46:55 -0700 patch which shows the crash (code change is not required, only test change) diff.patch text/plain 2075 eric ZGlmZiAtLWdpdCBhL0xheW91dFRlc3RzL3N2Zy9jdXN0b20vYWNpZDMtdGVzdC03Ny5odG1sIGIv TGF5b3V0VGVzdHMvc3ZnL2N1c3RvbS9hY2lkMy10ZXN0LTc3Lmh0bWwKaW5kZXggODdlZjZiMi4u ZjQxOGNiOSAxMDA2NDQKLS0tIGEvTGF5b3V0VGVzdHMvc3ZnL2N1c3RvbS9hY2lkMy10ZXN0LTc3 Lmh0bWwKKysrIGIvTGF5b3V0VGVzdHMvc3ZnL2N1c3RvbS9hY2lkMy10ZXN0LTc3Lmh0bWwKQEAg LTUxLDEwICs1MSw3IEBACiAgICAgdGV4dC50ZXh0Q29udGVudCA9ICJhYmMiOwogICAgIHRleHQu c2V0QXR0cmlidXRlKCJ5IiwgIjFlbSIpOwogICAgIHRleHQuc2V0QXR0cmlidXRlKCJmb250LXNp emUiLCAiNDAwMCIpOwotICAgIHdpbmRvdy5zZXRUaW1lb3V0KCJleGVjdXRlVGVzdCgpIiwgMTUw KTsKLSAgfQogICAgIAotICBmdW5jdGlvbiBleGVjdXRlVGVzdCgpIHsKICAgICAvLyBUaGUgZm9u dC1zaXplIDQwMDAgd2FzIGNob3NlbiBiZWNhdXNlIHRoYXQgbWF0Y2hlcyB0aGUgdW5pdHNQZXJF bSB2YWx1ZSBpbiB0aGUgc3ZnZm9udCwgCiAgICAgLy8gd2hpY2ggbWFrZXMgaXQgZWFzeSB0byBj aGVjayB0aGUgZ2x5cGggYWR2YW5jZXMgc2luY2UgdGhleSB3aWxsIHRoZW4gYmUgZXhhY3RseSB3 aGF0IHdhcyBzcGVjaWZpZWQgaW4gdGhlIHN2Z2ZvbnQuCiAgICAgc2hvdWxkQmUoInRleHQuZ2V0 TnVtYmVyT2ZDaGFycygpIiwgIjMiKTsKZGlmZiAtLWdpdCBhL0xheW91dFRlc3RzL3N2Zy9jdXN0 b20vcmVzb3VyY2VzL0FjaWQzRm9udC1sb2FkZXIuc3ZnIGIvTGF5b3V0VGVzdHMvc3ZnL2N1c3Rv bS9yZXNvdXJjZXMvQWNpZDNGb250LWxvYWRlci5zdmcKaW5kZXggY2I4ZTdkNC4uNmI5YTA4YiAx MDA2NDQKLS0tIGEvTGF5b3V0VGVzdHMvc3ZnL2N1c3RvbS9yZXNvdXJjZXMvQWNpZDNGb250LWxv YWRlci5zdmcKKysrIGIvTGF5b3V0VGVzdHMvc3ZnL2N1c3RvbS9yZXNvdXJjZXMvQWNpZDNGb250 LWxvYWRlci5zdmcKQEAgLTExLDYgKzExLDYgQEAKICAgICA8L2RlZnM+CiAgICAgPHRleHQ+WDwv dGV4dD4KIAotICAgIDwhLS0gQWRkaW5nIHRoaXMgcG9zc2libHkgZml4ZXMgdGhlIHByb2JsZW0g dGhhdCBhY2lkMy10ZXN0LTc3Lmh0bWwgaXMgdGltaW5nIGRlcGVuZGEgdGhvdWdoIGl0IGN1cnJl bnRseSBjcmFzaGVzIHVzCi0gICAgPHNjcmlwdD5kb2N1bWVudC5kb2N1bWVudEVsZW1lbnQub2Zm c2V0V2lkdGg7PC9zY3JpcHQ+IC0tPgorICAgIDwhLS0gRml4ZXMgdGhlIHByb2JsZW0gdGhhdCBh Y2lkMy10ZXN0LTc3Lmh0bWwgaXMgdGltaW5nIGRlcGVuZGVudCAtLT4KKyAgICA8c2NyaXB0PmRv Y3VtZW50LmRvY3VtZW50RWxlbWVudC5vZmZzZXRXaWR0aDs8L3NjcmlwdD4KIDwvc3ZnPgpkaWZm IC0tZ2l0IGEvV2ViQ29yZS9jc3MvQ1NTRm9udFNlbGVjdG9yLmNwcCBiL1dlYkNvcmUvY3NzL0NT U0ZvbnRTZWxlY3Rvci5jcHAKaW5kZXggZjhiYjkwMi4uN2ZlZTg3YSAxMDA2NDQKLS0tIGEvV2Vi Q29yZS9jc3MvQ1NTRm9udFNlbGVjdG9yLmNwcAorKysgYi9XZWJDb3JlL2Nzcy9DU1NGb250U2Vs ZWN0b3IuY3BwCkBAIC0yNzIsOCArMjcyLDEwIEBAIHZvaWQgQ1NTRm9udFNlbGVjdG9yOjpmb250 TG9hZGVkKENTU1NlZ21lbnRlZEZvbnRGYWNlKikKIHsKICAgICBpZiAobV9kb2N1bWVudC0+aW5Q YWdlQ2FjaGUoKSkKICAgICAgICAgcmV0dXJuOwotICAgIG1fZG9jdW1lbnQtPnJlY2FsY1N0eWxl KERvY3VtZW50OjpGb3JjZSk7Ci0gICAgbV9kb2N1bWVudC0+cmVuZGVyZXIoKS0+c2V0TmVlZHNM YXlvdXRBbmRQcmVmV2lkdGhzUmVjYWxjKCk7CisgICAgaWYgKG1fZG9jdW1lbnQtPnJlbmRlcmVy KCkpIHsKKyAgICAgICAgbV9kb2N1bWVudC0+cmVjYWxjU3R5bGUoRG9jdW1lbnQ6OkZvcmNlKTsK KyAgICAgICAgbV9kb2N1bWVudC0+cmVuZGVyZXIoKS0+c2V0TmVlZHNMYXlvdXRBbmRQcmVmV2lk dGhzUmVjYWxjKCk7CisgICAgfQogfQogCiBGb250RGF0YSogQ1NTRm9udFNlbGVjdG9yOjpnZXRG b250RGF0YShjb25zdCBGb250RGVzY3JpcHRpb24mIGZvbnREZXNjcmlwdGlvbiwgY29uc3QgQXRv bWljU3RyaW5nJiBmYW1pbHlOYW1lKQo=