[Webkit-unassigned] [Bug 60231] New: REGRESSION(73385): Crash in WebCore::RenderBlock::marginBeforeForChild

bugzilla-daemon at webkit.org bugzilla-daemon at webkit.org
Wed May 4 17:01:31 PDT 2011


https://bugs.webkit.org/show_bug.cgi?id=60231

           Summary: REGRESSION(73385): Crash in
                    WebCore::RenderBlock::marginBeforeForChild
           Product: WebKit
           Version: 528+ (Nightly build)
          Platform: Unspecified
               URL: http://gossipcenter.com/lindsay-lohan/lindsay-lohan-ha
                    s-she-dodged-her-jail-sentence-502374
        OS/Version: Unspecified
            Status: NEW
          Severity: Normal
          Priority: P2
         Component: Layout and Rendering
        AssignedTo: webkit-unassigned at lists.webkit.org
        ReportedBy: jamesr at chromium.org
                CC: hyatt at apple.com, mitz at webkit.org,
                    simon.fraser at apple.com, kerz at chromium.org


Originally reported as http://code.google.com/p/chromium/issues/detail?id=81468

Visit the URL in the bug link, let the page load, the mouse over the picture of Lindsay Lohan, then move your mouse out.  Boom!  Stack:

Exception Type:  EXC_BAD_ACCESS (SIGSEGV)
Exception Codes: KERN_INVALID_ADDRESS at 0x0000000000000530
Crashed Thread:  0  Dispatch queue: com.apple.main-thread

Thread 0 Crashed:  Dispatch queue: com.apple.main-thread
0   com.apple.WebCore                 0x0000000101678fbc WebCore::RenderBlock::marginBeforeForChild(WebCore::RenderBoxModelObject*) const + 44
1   com.apple.WebCore                 0x000000010167f201 WebCore::RenderBlock::addOverflowFromFloats() + 81
2   com.apple.WebCore                 0x000000010167f2fb WebCore::RenderBlock::computeOverflow(int, bool) + 91
3   com.apple.WebCore                 0x0000000101692b09 WebCore::RenderBlock::layoutBlock(bool, int) + 1865
4   com.apple.WebCore                 0x0000000101679a85 WebCore::RenderBlock::layout() + 37
5   com.apple.WebCore                 0x000000010168f00c WebCore::RenderBlock::layoutBlockChild(WebCore::RenderBox*, WebCore::RenderBlock::MarginInfo&, int&, int&) + 540
6   com.apple.WebCore                 0x0000000101692376 WebCore::RenderBlock::layoutBlockChildren(bool, int&) + 678
7   com.apple.WebCore                 0x00000001016931f2 WebCore::RenderBlock::layoutBlock(bool, int) + 3634
8   com.apple.WebCore                 0x0000000101679a85 WebCore::RenderBlock::layout() + 37
9   com.apple.WebCore                 0x000000010168f00c WebCore::RenderBlock::layoutBlockChild(WebCore::RenderBox*, WebCore::RenderBlock::MarginInfo&, int&, int&) + 540
10  com.apple.WebCore                 0x0000000101692376 WebCore::RenderBlock::layoutBlockChildren(bool, int&) + 678
11  com.apple.WebCore                 0x00000001016931f2 WebCore::RenderBlock::layoutBlock(bool, int) + 3634
12  com.apple.WebCore                 0x0000000101679a85 WebCore::RenderBlock::layout() + 37
13  com.apple.WebCore                 0x000000010168518d WebCore::RenderBlock::layoutPositionedObjects(bool) + 221
14  com.apple.WebCore                 0x0000000101685607 WebCore::RenderBlock::simplifiedLayout() + 631
15  com.apple.WebCore                 0x0000000101692da8 WebCore::RenderBlock::layoutBlock(bool, int) + 2536
16  com.apple.WebCore                 0x0000000101679a85 WebCore::RenderBlock::layout() + 37
17  com.apple.WebCore                 0x0000000101683d5e WebCore::RenderBlock::simplifiedNormalFlowLayout() + 638
18  com.apple.WebCore                 0x0000000101685614 WebCore::RenderBlock::simplifiedLayout() + 644
19  com.apple.WebCore                 0x0000000101692da8 WebCore::RenderBlock::layoutBlock(bool, int) + 2536
20  com.apple.WebCore                 0x0000000101679a85 WebCore::RenderBlock::layout() + 37
21  com.apple.WebCore                 0x0000000101683d5e WebCore::RenderBlock::simplifiedNormalFlowLayout() + 638
22  com.apple.WebCore                 0x0000000101685614 WebCore::RenderBlock::simplifiedLayout() + 644
23  com.apple.WebCore                 0x0000000101692da8 WebCore::RenderBlock::layoutBlock(bool, int) + 2536
24  com.apple.WebCore                 0x0000000101679a85 WebCore::RenderBlock::layout() + 37
25  com.apple.WebCore                 0x000000010168518d WebCore::RenderBlock::layoutPositionedObjects(bool) + 221
26  com.apple.WebCore                 0x0000000101685607 WebCore::RenderBlock::simplifiedLayout() + 631
27  com.apple.WebCore                 0x0000000101692da8 WebCore::RenderBlock::layoutBlock(bool, int) + 2536
28  com.apple.WebCore                 0x0000000101679a85 WebCore::RenderBlock::layout() + 37
29  com.apple.WebCore                 0x000000010168518d WebCore::RenderBlock::layoutPositionedObjects(bool) + 221
30  com.apple.WebCore                 0x0000000101685607 WebCore::RenderBlock::simplifiedLayout() + 631
31  com.apple.WebCore                 0x0000000101692da8 WebCore::RenderBlock::layoutBlock(bool, int) + 2536
32  com.apple.WebCore                 0x0000000101679a85 WebCore::RenderBlock::layout() + 37
33  com.apple.WebCore                 0x00000001017a86c2 WebCore::RenderView::layout() + 306
34  com.apple.WebCore                 0x0000000100fe63c0 WebCore::FrameView::layout(bool) + 1872
35  com.apple.WebCore                 0x000000010194b576 WebCore::ThreadTimers::sharedTimerFiredInternal() + 150
36  com.apple.WebCore                 0x0000000101826ea5 WebCore::timerFired(__CFRunLoopTimer*, void*) + 53
37  com.apple.CoreFoundation          0x00007fff82b94be8 __CFRunLoopRun + 6488
38  com.apple.CoreFoundation          0x00007fff82b92dbf CFRunLoopRunSpecific + 575
39  com.apple.HIToolbox               0x00007fff81ad17ee RunCurrentEventLoopInMode + 333
40  com.apple.HIToolbox               0x00007fff81ad15f3 ReceiveNextEventCommon + 310
41  com.apple.HIToolbox               0x00007fff81ad14ac BlockUntilNextEventMatchingListInMode + 59
42  com.apple.AppKit                  0x00007fff842f1e64 _DPSNextEvent + 718
43  com.apple.AppKit                  0x00007fff842f17a9 -[NSApplication nextEventMatchingMask:untilDate:inMode:dequeue:] + 155
44  com.apple.Safari                  0x0000000100015ff6 0x100000000 + 90102
45  com.apple.AppKit                  0x00007fff842b748b -[NSApplication run] + 395
46  com.apple.AppKit                  0x00007fff842b01a8 NSApplicationMain + 364
47  com.apple.Safari                  0x0000000100009f18 0x100000000 + 40728


I've partially reduced this down - the culprit seems to be some ad code that causes an add to animate into view on top of the image when the mouse enters, then animates out when the mouse leaves.  The javascript driving this animation is nontrivial and minimized (of course) so I haven't pinned down exactly what is leading up to the crash.  The page (and this ad) seem to work fine in Firefox.

-- 
Configure bugmail: https://bugs.webkit.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.



More information about the webkit-unassigned mailing list