[Webkit-unassigned] [Bug 54740] New: chrome.dll!WebCore::RenderBlock::addFocusRingRects OOM (404d82428bd920c896c411920eae1898)

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=54740

           Summary: chrome.dll!WebCore::RenderBlock::addFocusRingRects OOM
                    (404d82428bd920c896c411920eae1898)
           Product: WebKit
           Version: 528+ (Nightly build)
          Platform: PC
        OS/Version: Windows Vista
            Status: NEW
          Severity: Normal
          Priority: P1
         Component: HTML Editing
        AssignedTo: webkit-unassigned at lists.webkit.org
        ReportedBy: skylined at chromium.org
                CC: rniwa at webkit.org


Created an attachment (id=82942)
 --> (https://bugs.webkit.org/attachment.cgi?id=82942&action=review)
Repro

Chromium: http://code.google.com/p/chromium/issues/detail?id=73400
This looks very much like a dup of issue 54734, in that it is also an OOM that appears to be caused by a loop in the node tree.

http://codesearch.google.com/codesearch/p?hl=en#OAMlx_jo-ck/src/third_party/WebKit/Source/WebCore/rendering/RenderInline.cpp&q=addFocusRingRects&exact_package=chromium&sa=N&cd=1&ct=rc
void RenderInline::addFocusRingRects(Vector<IntRect>& rects, int tx, int ty)
{
    for (InlineFlowBox* curr = firstLineBox(); curr; curr = curr->nextLineBox()) {
        RootInlineBox* root = curr->root();
        int top = max(root->lineTop(), curr->y());
        int bottom = min(root->lineBottom(), curr->y() + curr->logicalHeight());
        IntRect rect(tx + curr->x(), ty + top, curr->logicalWidth(), bottom - top);
        if (!rect.isEmpty())
            rects.append(rect);
    }

    for (RenderObject* curr = firstChild(); curr; curr = curr->nextSibling()) {
        if (!curr->isText() && !curr->isListMarker()) {
            FloatPoint pos(tx, ty);
            // FIXME: This doesn't work correctly with transforms.
            if (curr->hasLayer())
                pos = curr->localToAbsolute();
            else if (curr->isBox())
                pos.move(toRenderBox(curr)->x(), toRenderBox(curr)->y());
           curr->addFocusRingRects(rects, pos.x(), pos.y());
<snip>

id:             chrome.dll!WebCore::RenderBlock::addFocusRingRects OOM (404d82428bd920c896c411920eae1898)
description:    Cannot allocate enough memory in chrome.dll!WebCore::RenderBlock::addFocusRingRects
application:    Chromium 11.0.671.0
stack:          chrome.dll!WebCore::RenderBlock::addFocusRingRects
                chrome.dll!WebCore::RenderBlock::addFocusRingRects
                chrome.dll!WebCore::RenderBlock::addFocusRingRects
                chrome.dll!WebCore::RenderBlock::addFocusRingRects
                chrome.dll!WebCore::RenderBlock::addFocusRingRects
                chrome.dll!WebCore::RenderInline::addFocusRingRects
                chrome.dll!WebCore::RenderInline::addFocusRingRects
                chrome.dll!WebCore::RenderInline::addFocusRingRects
                chrome.dll!WebCore::RenderInline::addFocusRingRects
                chrome.dll!WebCore::RenderInline::addFocusRingRects
                chrome.dll!WebCore::RenderInline::addFocusRingRects
                chrome.dll!WebCore::RenderInline::addFocusRingRects
                chrome.dll!WebCore::RenderInline::addFocusRingRects
                chrome.dll!WebCore::RenderInline::addFocusRingRects
                chrome.dll!WebCore::RenderInline::addFocusRingRects
                chrome.dll!WebCore::RenderInline::addFocusRingRects
                chrome.dll!WebCore::RenderInline::addFocusRingRects
                chrome.dll!WebCore::RenderInline::addFocusRingRects
                chrome.dll!WebCore::RenderInline::addFocusRingRects
                chrome.dll!WebCore::RenderInline::addFocusRingRects
                chrome.dll!WebCore::RenderInline::addFocusRingRects
                chrome.dll!WebCore::RenderInline::addFocusRingRects
                chrome.dll!WebCore::RenderInline::addFocusRingRects
                chrome.dll!WebCore::RenderInline::addFocusRingRects
                chrome.dll!WebCore::RenderInline::addFocusRingRects
                chrome.dll!WebCore::RenderInline::addFocusRingRects
                chrome.dll!WebCore::RenderInline::addFocusRingRects
                chrome.dll!WebCore::RenderInline::addFocusRingRects
                chrome.dll!WebCore::RenderInline::addFocusRingRects
                chrome.dll!WebCore::RenderInline::addFocusRingRects
                chrome.dll!WebCore::RenderInline::addFocusRingRects
                chrome.dll!WebCore::RenderInline::addFocusRingRects
                chrome.dll!WebCore::RenderInline::addFocusRingRects
                chrome.dll!WebCore::RenderInline::addFocusRingRects
                chrome.dll!WebCore::RenderInline::addFocusRingRects
                chrome.dll!WebCore::RenderInline::addFocusRingRects
                chrome.dll!WebCore::RenderInline::addFocusRingRects
                chrome.dll!WebCore::RenderInline::addFocusRingRects
                chrome.dll!WebCore::RenderInline::addFocusRingRects
                chrome.dll!WebCore::RenderInline::addFocusRingRects
                chrome.dll!WebCore::RenderInline::addFocusRingRects
                chrome.dll!WebCore::RenderBlock::addFocusRingRects
                chrome.dll!WebCore::RenderBlock::addFocusRingRects
                chrome.dll!WebCore::RenderObject::absoluteFocusRingQuads
                chrome.dll!WebCore::AccessibilityRenderObject::boundingBoxRect
                chrome.dll!WebKit::WebAccessibilityObject::boundingBoxRect
                chrome.dll!webkit_glue::WebAccessibility::Init
                chrome.dll!webkit_glue::WebAccessibility::WebAccessibility
                chrome.dll!RenderView::SendPendingAccessibilityNotifications
                chrome.dll!MessageLoop::RunTask
                chrome.dll!MessageLoop::DoWork
                chrome.dll!base::MessagePumpDefault::Run
                chrome.dll!MessageLoop::RunInternal
                ...

-- 
Configure bugmail: https://bugs.webkit.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.