Issue 551638 in chromium: Inspected page crashes after inspecting a link tag

1 view
Skip to first unread message

chro...@googlecode.com

unread,
Nov 4, 2015, 5:38:48 PM11/4/15
to chromi...@chromium.org
Status: Assigned
Owner: le...@chromium.org
Labels: Type-Bug Pri-1 OS-Linux

New issue 551638 by lushni...@chromium.org: Inspected page crashes after
inspecting a link tag
https://code.google.com/p/chromium/issues/detail?id=551638

1. Goto www.google.com
2. Find any link tag on the page, right click -> inspect element

Actual: the inspected page crashes.

I've bisected this down to https://codereview.chromium.org/1192983003

@leviw, could you please take a look?

--
You received this message because this project is configured to send all
issue notifications to this address.
You may adjust your notification preferences at:
https://code.google.com/hosting/settings

chro...@googlecode.com

unread,
Nov 4, 2015, 5:50:48 PM11/4/15
to chromi...@chromium.org

Comment #1 on issue 551638 by le...@chromium.org: Inspected page crashes
Given this doesn't occur on Canary, I'm going to assume you're talking
about an assertion on Debug builds?

chro...@googlecode.com

unread,
Nov 4, 2015, 7:01:24 PM11/4/15
to chromi...@chromium.org

Comment #2 on issue 551638 by dgo...@chromium.org: Inspected page crashes
This happened to me today on the release build without dcheck_always_on.

chro...@googlecode.com

unread,
Nov 4, 2015, 7:11:23 PM11/4/15
to chromi...@chromium.org

Comment #3 on issue 551638 by le...@chromium.org: Inspected page crashes
dgozman@, do you have a crash id?

chro...@googlecode.com

unread,
Nov 4, 2015, 7:16:06 PM11/4/15
to chromi...@chromium.org
Updates:
Cc: dgo...@chromium.org tim...@chromium.org

Comment #4 on issue 551638 by le...@chromium.org: Inspected page crashes
I see us hitting the following assert:

We're hitting this assert:

../../third_party/WebKit/Source/core/css/CSSProperty.cpp(43) :
blink::CSSPropertyID blink::StylePropertyMetadata::shorthandID() const
1 0x126b04f63 blink::StylePropertyMetadata::shorthandID() const
2 0x126c11f8b blink::StylePropertySet::PropertyReference::shorthandID()
const
3 0x126c0fae2
blink::StylePropertySet::getPropertyShorthand(blink::CSSPropertyID) const
4 0x126bd5b53
blink::AbstractPropertySetCSSStyleDeclaration::getPropertyShorthand(WTF::String
const&)
5 0x1271a0f0e blink::InspectorStyle::styleWithProperties()
6 0x1271a08ff blink::InspectorStyle::buildObjectForStyle()
7 0x1271a2036
blink::InspectorStyleSheetBase::buildObjectForStyle(blink::CSSStyleDeclaration*)
8 0x1271a7b88
blink::InspectorStyleSheet::buildObjectForRuleWithoutMedia(blink::CSSStyleRule*)
9 0x1270c6a6f
blink::InspectorCSSAgent::buildObjectForRule(blink::CSSStyleRule*)
10 0x1270c220c
blink::InspectorCSSAgent::buildArrayForMatchedRuleList(blink::CSSRuleList*,
blink::Element*, blink::PseudoId)
11 0x1270c18c9
blink::InspectorCSSAgent::getMatchedStylesForNode(WTF::String*, int,
WTF::RefPtr<blink::TypeBuilder::CSS::CSSStyle>&,
WTF::RefPtr<blink::TypeBuilder::CSS::CSSStyle>&,
WTF::RefPtr<blink::TypeBuilder::Array<blink::TypeBuilder::CSS::RuleMatch>
>&,
WTF::RefPtr<blink::TypeBuilder::Array<blink::TypeBuilder::CSS::PseudoElementMatches>
>&,
WTF::RefPtr<blink::TypeBuilder::Array<blink::TypeBuilder::CSS::InheritedStyleEntry>
>&)
12 0x1270c29f9 non-virtual thunk to
blink::InspectorCSSAgent::getMatchedStylesForNode(WTF::String*, int,
WTF::RefPtr<blink::TypeBuilder::CSS::CSSStyle>&,
WTF::RefPtr<blink::TypeBuilder::CSS::CSSStyle>&,
WTF::RefPtr<blink::TypeBuilder::Array<blink::TypeBuilder::CSS::RuleMatch>
>&,
WTF::RefPtr<blink::TypeBuilder::Array<blink::TypeBuilder::CSS::PseudoElementMatches>
>&,
WTF::RefPtr<blink::TypeBuilder::Array<blink::TypeBuilder::CSS::InheritedStyleEntry>
>&)
13 0x1264f529c
blink::InspectorBackendDispatcherImpl::CSS_getMatchedStylesForNode(int,
blink::JSONObject*, blink::JSONArray*)
14 0x126509514 blink::InspectorBackendDispatcherImpl::dispatch(WTF::String
const&)
15 0x1123ef168
blink::WebDevToolsAgentImpl::dispatchMessageFromFrontend(WTF::String const&)
16 0x1123eef4f
blink::WebDevToolsAgentImpl::dispatchOnInspectorBackend(blink::WebString
const&)
17 0x117d86f56
content::DevToolsAgent::OnDispatchOnInspectorBackend(std::__1::basic_string<char,
std::__1::char_traits<char>, std::__1::allocator<char> > const&)
18 0x117d8b567 void base::DispatchToMethodImpl<content::DevToolsAgent,
void (content::DevToolsAgent::*)(std::__1::basic_string<char,
std::__1::char_traits<char>, std::__1::allocator<char> > const&),
std::__1::basic_string<char, std::__1::char_traits<char>,
std::__1::allocator<char> >, 0ul>(content::DevToolsAgent*, void
(content::DevToolsAgent::*)(std::__1::basic_string<char,
std::__1::char_traits<char>, std::__1::allocator<char> > const&),
base::Tuple<std::__1::basic_string<char, std::__1::char_traits<char>,
std::__1::allocator<char> > > const&, base::IndexSequence<0ul>)
19 0x117d8b493 void base::DispatchToMethod<content::DevToolsAgent, void
(content::DevToolsAgent::*)(std::__1::basic_string<char,
std::__1::char_traits<char>, std::__1::allocator<char> > const&),
std::__1::basic_string<char, std::__1::char_traits<char>,
std::__1::allocator<char> > >(content::DevToolsAgent*, void
(content::DevToolsAgent::*)(std::__1::basic_string<char,
std::__1::char_traits<char>, std::__1::allocator<char> > const&),
base::Tuple<std::__1::basic_string<char, std::__1::char_traits<char>,
std::__1::allocator<char> > > const&)
20 0x117d894d8 bool
DevToolsAgentMsg_DispatchOnInspectorBackend::Dispatch<content::DevToolsAgent,
content::DevToolsAgent, void, void
(content::DevToolsAgent::*)(std::__1::basic_string<char,
std::__1::char_traits<char>, std::__1::allocator<char> >
const&)>(IPC::Message const*, content::DevToolsAgent*,
content::DevToolsAgent*, void*, void
(content::DevToolsAgent::*)(std::__1::basic_string<char,
std::__1::char_traits<char>, std::__1::allocator<char> > const&))
21 0x117d86a31 content::DevToolsAgent::OnMessageReceived(IPC::Message
const&)
22 0x117f4a4ee content::RenderFrameImpl::OnMessageReceived(IPC::Message
const&)
23 0x117c524a9 content::MessageRouter::RouteMessage(IPC::Message const&)
24 0x11752c06e
content::ChildThreadImpl::ChildThreadMessageRouter::RouteMessage(IPC::Message
const&)
25 0x117c5240c content::MessageRouter::OnMessageReceived(IPC::Message
const&)
26 0x11752fae3 content::ChildThreadImpl::OnMessageReceived(IPC::Message
const&)
27 0x1212c4a35 IPC::ChannelProxy::Context::OnDispatchMessage(IPC::Message
const&)
28 0x1212cc2ef base::internal::RunnableAdapter<void
(IPC::ChannelProxy::Context::*)(IPC::Message
const&)>::Run(IPC::ChannelProxy::Context*, IPC::Message const&)
29 0x1212cc11f base::internal::InvokeHelper<false, void,
base::internal::RunnableAdapter<void
(IPC::ChannelProxy::Context::*)(IPC::Message const&)>,
base::internal::TypeList<IPC::ChannelProxy::Context* const&, IPC::Message
const&> >::MakeItSo(base::internal::RunnableAdapter<void
(IPC::ChannelProxy::Context::*)(IPC::Message const&)>,
IPC::ChannelProxy::Context* const&, IPC::Message const&)
30 0x1212cc0af base::internal::Invoker<base::IndexSequence<0ul, 1ul>,
base::internal::BindState<base::internal::RunnableAdapter<void
(IPC::ChannelProxy::Context::*)(IPC::Message const&)>, void
(IPC::ChannelProxy::Context*, IPC::Message const&),
base::internal::TypeList<IPC::ChannelProxy::Context*, IPC::Message> >,
base::internal::TypeList<base::internal::UnwrapTraits<IPC::ChannelProxy::Context*>,
base::internal::UnwrapTraits<IPC::Message> >,
base::internal::InvokeHelper<false, void,
base::internal::RunnableAdapter<void
(IPC::ChannelProxy::Context::*)(IPC::Message const&)>,
base::internal::TypeList<IPC::ChannelProxy::Context* const&, IPC::Message
const&> >, void ()>::Run(base::internal::BindStateBase*)
31 0x10e5ad36f base::Callback<void ()>::Run() const
Segmentation fault: 11

chro...@googlecode.com

unread,
Nov 4, 2015, 11:51:33 PM11/4/15
to chromi...@chromium.org

Comment #6 on issue 551638 by tim...@chromium.org: Inspected page crashes
Probably we should clear m_currentShorthand for the case where we parse
text-decoration as a non-shorthand. We should really finish up the text
decoration properties and ship the thing -_-

chro...@googlecode.com

unread,
Nov 5, 2015, 11:16:20 AM11/5/15
to chromi...@chromium.org
Updates:
Cc: durga.be...@chromium.org a...@chromium.org kavv...@chromium.org
nyerrami...@chromium.org ashej...@chromium.org

Comment #7 on issue 551638 by rob.b...@samsung.com: Inspected page crashes
Issue 551748 has been merged into this issue.

chro...@googlecode.com

unread,
Nov 5, 2015, 12:50:43 PM11/5/15
to chromi...@chromium.org
Updates:
Labels: hasTestcase

Comment #8 on issue 551638 by manoranj...@chromium.org: Inspected page
(No comment was entered for this change.)

chro...@googlecode.com

unread,
Nov 5, 2015, 1:02:37 PM11/5/15
to chromi...@chromium.org
Updates:
Cc: tin...@chromium.org
Labels: -Type-Bug Type-Bug-Regression M-48 ReleaseBlock-Dev

Comment #9 on issue 551638 by manoranj...@chromium.org: Inspected page
This is a top#1 renderer crash across All platforms.

https://crash.corp.google.com/browse?q=product.name%3D%27Chrome_Mac%27%20AND%20product.version%3D%2748.0.2555.0%27%20AND%20custom_data.ChromeCrashProto.ptype%3D%27renderer%27

Could someone please look into this on priority?

Thank you!

chro...@googlecode.com

unread,
Nov 5, 2015, 1:08:38 PM11/5/15
to chromi...@chromium.org
Updates:
Cc: gov...@chromium.org

Comment #10 on issue 551638 by tin...@google.com: Inspected page crashes
(No comment was entered for this change.)

chro...@googlecode.com

unread,
Nov 5, 2015, 4:02:30 PM11/5/15
to chromi...@chromium.org

Comment #16 on issue 551638 by rob.b...@samsung.com: Inspected page crashes
#15 far easier to grab my fix https://codereview.chromium.org/1422363007/ .

chro...@googlecode.com

unread,
Nov 5, 2015, 4:25:29 PM11/5/15
to chromi...@chromium.org

Comment #17 on issue 551638 by micha...@chromium.org: Inspected page
It's easy enough to do two reverts. Instead of the temp hack fix there's
time to look into a proper fix.

chro...@googlecode.com

unread,
Nov 5, 2015, 4:44:27 PM11/5/15
to chromi...@chromium.org

Comment #18 on issue 551638 by bugd...@chromium.org: Inspected page
crashes after inspecting a link tag
https://code.google.com/p/chromium/issues/detail?id=551638#c18

The following revision refers to this bug:

https://chromium.googlesource.com/chromium/src.git/+/4bae7285907b6ca814aa7dac4e20e29972c5e755

commit 4bae7285907b6ca814aa7dac4e20e29972c5e755
Author: michaeln <mich...@chromium.org>
Date: Thu Nov 05 21:07:21 2015

Revert of Parse outline shorthand in CSSPropertyParser with CSSParserTokens
(patchset #5 id:80001 of https://codereview.chromium.org/1406343008/ )

Reason for revert:
Reverting in order to revert a suspected top crasher. See the bug for
details.

BUG=551638

Original issue's description:
> Parse outline shorthand in CSSPropertyParser with CSSParserTokens

> Move outline shorthand property handling from
> LegacyCSSPropertyParser into CSSPropertyParser. Also
> move its related longhands.

> BUG=499780

> Committed: https://crrev.com/3447a99f8dce411d4e07c55e6b81dd2068a50390
> Cr-Commit-Position: refs/heads/master@{#358065}

TBR=tim...@chromium.org,rob....@samsung.com
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=499780

Review URL: https://codereview.chromium.org/1419143008

Cr-Commit-Position: refs/heads/master@{#358127}

[modify]
http://crrev.com/4bae7285907b6ca814aa7dac4e20e29972c5e755/third_party/WebKit/Source/core/css/parser/CSSPropertyParser.cpp
[modify]
http://crrev.com/4bae7285907b6ca814aa7dac4e20e29972c5e755/third_party/WebKit/Source/core/css/parser/LegacyCSSPropertyParser.cpp

chro...@googlecode.com

unread,
Nov 5, 2015, 6:38:04 PM11/5/15
to chromi...@chromium.org
Updates:
Cc: matthewy...@chromium.org josa...@chromium.org

Comment #21 on issue 551638 by song...@chromium.org: Inspected page crashes
(No comment was entered for this change.)

chro...@googlecode.com

unread,
Nov 5, 2015, 6:44:05 PM11/5/15
to chromi...@chromium.org

Comment #22 on issue 551638 by song...@chromium.org: Inspected page crashes
Reproducible in Chrome 48.0.2555.0/ CrOS 7614.0.0-daisy_skate

chro...@googlecode.com

unread,
Nov 5, 2015, 10:15:40 PM11/5/15
to chromi...@chromium.org

Comment #23 on issue 551638 by bugd...@chromium.org: Inspected page
crashes after inspecting a link tag
https://code.google.com/p/chromium/issues/detail?id=551638#c23

The following revision refers to this bug:

https://chromium.googlesource.com/chromium/src.git/+/aba3cd0fad04fb412eeba2f93f1760242349bcee

commit aba3cd0fad04fb412eeba2f93f1760242349bcee
Author: rob.buis <rob....@samsung.com>
Date: Fri Nov 06 02:05:42 2015

Parse text-decoration shorthand in CSSPropertyParser with CSSParserTokens

Move text-decoration shorthand property handling from
LegacyCSSPropertyParser into CSSPropertyParser. Also
move its related longhands.

This patch adds a generic consumeShorthandGreedily that can be
used to convert other shorthands.

Finally the patch refuses duplicate keyword entries for text-decoration-line
(like "blink blink") and adds tests for this to text-decoration-line.html.

BUG=499780, 551638

Review URL: https://codereview.chromium.org/1405273005

Cr-Commit-Position: refs/heads/master@{#358232}

[modify]
http://crrev.com/aba3cd0fad04fb412eeba2f93f1760242349bcee/third_party/WebKit/LayoutTests/fast/css/getComputedStyle/getComputedStyle-text-decoration-expected.txt
[modify]
http://crrev.com/aba3cd0fad04fb412eeba2f93f1760242349bcee/third_party/WebKit/LayoutTests/fast/css3-text/css3-text-decoration/text-decoration-line-expected.html
[modify]
http://crrev.com/aba3cd0fad04fb412eeba2f93f1760242349bcee/third_party/WebKit/LayoutTests/fast/css3-text/css3-text-decoration/text-decoration-line.html
[modify]
http://crrev.com/aba3cd0fad04fb412eeba2f93f1760242349bcee/third_party/WebKit/Source/core/css/parser/CSSPropertyParser.cpp
[modify]
http://crrev.com/aba3cd0fad04fb412eeba2f93f1760242349bcee/third_party/WebKit/Source/core/css/parser/CSSPropertyParser.h
[modify]
http://crrev.com/aba3cd0fad04fb412eeba2f93f1760242349bcee/third_party/WebKit/Source/core/css/parser/LegacyCSSPropertyParser.cpp

chro...@googlecode.com

unread,
Nov 6, 2015, 6:29:02 AM11/6/15
to chromi...@chromium.org

Comment #24 on issue 551638 by pecin...@gmail.com: Inspected page crashes
Canary here, started to happen today. First I could not see any styles
while inspecting, reset devtools and this started to happen.

chro...@googlecode.com

unread,
Nov 9, 2015, 4:19:00 AM11/9/15
to chromi...@chromium.org

Comment #25 on issue 551638 by durga.be...@chromium.org: Inspected page
Issue 552389 has been merged into this issue.
Reply all
Reply to author
Forward
0 new messages