New issue
Advanced search Search tips
Note: Color blocks (like or ) mean that a user may not be available. Tooltip shows the reason.

Issue 894691 link

Starred by 1 user

Issue metadata

Status: Fixed
Owner:
Closed: Oct 29
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: ----
Pri: 2
Type: Bug



Sign in to add a comment

[LayoutNG] Memory benchmark crashes in LayoutNGListMarker::TextAlternative

Project Member Reported by kojii@chromium.org, Oct 12

Issue description

     __str_ = "[259418:259483:1011/150608.549456:FATAL:layout_text.h(479)] Security DCHECK failed: !object || (object->IsText()). \n", '\000' <repeats 74 times>,
"
(rr)
#10 0x00007fbdd8caf75b in blink::LayoutNGListMarker::TextAlternative (this=0x6b81c6d9b08) at ../../third_party/blink/renderer/core/layout/ng/list/layout_ng_list_marker.cc:69
69      return ToLayoutText(FirstChild())->GetText();
(rr) p FirstChild()
$3 = (blink::LayoutNGListMarkerImage *) 0x6b81c64fd58
 
Doc for how to locally load a page from one of the perf benchmarks from Christian:
https://docs.google.com/document/d/17Rf5V8MIAVv5UZSAFfoloMT3UnF-L_cvA5_CaElSNjw/edit#
Project Member

Comment 3 by bugdroid1@chromium.org, Oct 12

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/3351035f64c042f9e027240f1ab4eb7f97f1dce3

commit 3351035f64c042f9e027240f1ab4eb7f97f1dce3
Author: Koji Ishii <kojii@chromium.org>
Date: Fri Oct 12 19:54:32 2018

[LayoutNG] Fix crash in LayoutNGListMarker::TextAlternative

This patch fixes LayoutNGListMarker::TextAlternative to not
to rely on it has LayoutText child. This can happen if the
list marker is an image marker (for bullet lists) or the
function was called before layout completes.

LayoutListMarker always computes from its list item. LayoutNG
took a shortcut because we store the result in its LayoutText
child, but cases where we don't store was missed.

AXLayoutObject::TextAlternative() calls this function.

Bug:  894691 
Cq-Include-Trybots: luci.chromium.try:linux_layout_tests_layout_ng
Change-Id: I6c13c6f00920702e17188858d15c674d38698dfb
Reviewed-on: https://chromium-review.googlesource.com/c/1277132
Commit-Queue: Christian Biesinger <cbiesinger@chromium.org>
Reviewed-by: Christian Biesinger <cbiesinger@chromium.org>
Reviewed-by: cathie chen <cathiechen@tencent.com>
Cr-Commit-Position: refs/heads/master@{#599327}
[modify] https://crrev.com/3351035f64c042f9e027240f1ab4eb7f97f1dce3/third_party/blink/renderer/core/layout/ng/list/layout_ng_list_item.cc
[modify] https://crrev.com/3351035f64c042f9e027240f1ab4eb7f97f1dce3/third_party/blink/renderer/core/layout/ng/list/layout_ng_list_item.h
[modify] https://crrev.com/3351035f64c042f9e027240f1ab4eb7f97f1dce3/third_party/blink/renderer/core/layout/ng/list/layout_ng_list_marker.cc

Status: Fixed (was: Assigned)

Sign in to add a comment