[LayoutNG] Memory benchmark crashes in LayoutNGListMarker::TextAlternative |
||
Issue description
__str_ = "[259418:259483:1011/150608.549456:FATAL:layout_text.h(479)] Security DCHECK failed: !object || (object->IsText()). \n", '\000' <repeats 74 times>,
"
(rr)
#10 0x00007fbdd8caf75b in blink::LayoutNGListMarker::TextAlternative (this=0x6b81c6d9b08) at ../../third_party/blink/renderer/core/layout/ng/list/layout_ng_list_marker.cc:69
69 return ToLayoutText(FirstChild())->GetText();
(rr) p FirstChild()
$3 = (blink::LayoutNGListMarkerImage *) 0x6b81c64fd58
,
Oct 12
I have a patch for.that in https://chromium-review.googlesource.com/c/chromium/src/+/1277550
,
Oct 12
The following revision refers to this bug: https://chromium.googlesource.com/chromium/src.git/+/3351035f64c042f9e027240f1ab4eb7f97f1dce3 commit 3351035f64c042f9e027240f1ab4eb7f97f1dce3 Author: Koji Ishii <kojii@chromium.org> Date: Fri Oct 12 19:54:32 2018 [LayoutNG] Fix crash in LayoutNGListMarker::TextAlternative This patch fixes LayoutNGListMarker::TextAlternative to not to rely on it has LayoutText child. This can happen if the list marker is an image marker (for bullet lists) or the function was called before layout completes. LayoutListMarker always computes from its list item. LayoutNG took a shortcut because we store the result in its LayoutText child, but cases where we don't store was missed. AXLayoutObject::TextAlternative() calls this function. Bug: 894691 Cq-Include-Trybots: luci.chromium.try:linux_layout_tests_layout_ng Change-Id: I6c13c6f00920702e17188858d15c674d38698dfb Reviewed-on: https://chromium-review.googlesource.com/c/1277132 Commit-Queue: Christian Biesinger <cbiesinger@chromium.org> Reviewed-by: Christian Biesinger <cbiesinger@chromium.org> Reviewed-by: cathie chen <cathiechen@tencent.com> Cr-Commit-Position: refs/heads/master@{#599327} [modify] https://crrev.com/3351035f64c042f9e027240f1ab4eb7f97f1dce3/third_party/blink/renderer/core/layout/ng/list/layout_ng_list_item.cc [modify] https://crrev.com/3351035f64c042f9e027240f1ab4eb7f97f1dce3/third_party/blink/renderer/core/layout/ng/list/layout_ng_list_item.h [modify] https://crrev.com/3351035f64c042f9e027240f1ab4eb7f97f1dce3/third_party/blink/renderer/core/layout/ng/list/layout_ng_list_marker.cc
,
Oct 29
|
||
►
Sign in to add a comment |
||
Comment 1 by kojii@chromium.org
, Oct 12