Bug 15887 – REGRESSION (r27576): Crash in RenderStyle::affectedByHoverRules clicking link on Digg

• Status: RESOLVED
• Resolution: FIXED
• Component: CSS

[Matt Lilek]

Go to <http://digg.com/> and click a link -> BOOM.  See <http://trac.webkit.org/projects/webkit/changeset/27576>.

Thread 0 Crashed:
0   com.apple.WebCore             	0x01ce0829 WebCore::RenderStyle::affectedByHoverRules() const + 9 (RenderStyle.h:1529)
1   com.apple.WebCore             	0x01d95464 WebCore::Element::recalcStyle(WebCore::Node::StyleChange) + 630 (Element.cpp:729)
2   com.apple.WebCore             	0x01d95680 WebCore::Element::recalcStyle(WebCore::Node::StyleChange) + 1170 (Element.cpp:761)
3   com.apple.WebCore             	0x01d95680 WebCore::Element::recalcStyle(WebCore::Node::StyleChange) + 1170 (Element.cpp:761)
4   com.apple.WebCore             	0x01d95680 WebCore::Element::recalcStyle(WebCore::Node::StyleChange) + 1170 (Element.cpp:761)
5   com.apple.WebCore             	0x01d6b69d WebCore::Document::recalcStyle(WebCore::Node::StyleChange) + 1257 (Document.cpp:1095)
6   com.apple.WebCore             	0x01d6122b WebCore::Document::updateRendering() + 49 (Document.cpp:1120)
7   com.apple.WebCore             	0x01d632c7 WebCore::Document::updateDocumentsRendering() + 57 (Document.cpp:1127)
8   com.apple.WebCore             	0x0226f324 WebCore::JSAbstractEventListener::handleEvent(WebCore::Event*, bool) + 1450 (kjs_events.cpp:143)
9   com.apple.WebCore             	0x01da5b39 WebCore::EventTargetNode::handleLocalEvents(WebCore::Event*, bool) + 357 (EventTargetNode.cpp:167)
10  com.apple.WebCore             	0x01da5339 WebCore::EventTargetNode::dispatchGenericEvent(WTF::PassRefPtr<WebCore::Event>, int&, bool) + 1387 (EventTargetNode.cpp:241)
11  com.apple.WebCore             	0x01da5ffe WebCore::EventTargetNode::dispatchEvent(WTF::PassRefPtr<WebCore::Event>, int&, bool, WebCore::EventTarget*) + 330 (EventTargetNode.cpp:309)
12  com.apple.WebCore             	0x01da607b WebCore::EventTargetNode::dispatchEvent(WTF::PassRefPtr<WebCore::Event>, int&, bool) + 75 (EventTargetNode.cpp:293)
13  com.apple.WebCore             	0x01da6d37 WebCore::EventTargetNode::dispatchMouseEvent(WebCore::AtomicString const&, int, int, int, int, int, int, bool, bool, bool, bool, bool, WebCore::Node*, WTF::PassRefPtr<WebCore::Event>) + 699 (EventTargetNode.cpp:481)
14  com.apple.WebCore             	0x01da748b WebCore::EventTargetNode::dispatchMouseEvent(WebCore::PlatformMouseEvent const&, WebCore::AtomicString const&, int, WebCore::Node*) + 497 (EventTargetNode.cpp:398)
15  com.apple.WebCore             	0x01d9dd51 WebCore::EventHandler::dispatchMouseEvent(WebCore::AtomicString const&, WebCore::Node*, bool, int, WebCore::PlatformMouseEvent const&, bool) + 147 (EventHandler.cpp:1235)
16  com.apple.WebCore             	0x01d9e5a4 WebCore::EventHandler::handleMouseReleaseEvent(WebCore::PlatformMouseEvent const&) + 894 (EventHandler.cpp:1066)
17  com.apple.WebCore             	0x01da2d7d WebCore::EventHandler::mouseUp(NSEvent*) + 435 (EventHandlerMac.mm:523)
18  com.apple.WebKit              	0x001ca914 -[WebHTMLView mouseUp:] + 274 (WebHTMLView.mm:3224)
19  com.apple.AppKit              	0x92072e39 -[NSWindow sendEvent:] + 5520
20  com.apple.Safari              	0x000329d3 0x1000 + 203219
21  com.apple.AppKit              	0x9203fa2c -[NSApplication sendEvent:] + 2766
22  com.apple.Safari              	0x000324a8 0x1000 + 201896
23  com.apple.AppKit              	0x91f9d705 -[NSApplication run] + 847
24  com.apple.AppKit              	0x91f6a9ba NSApplicationMain + 574
25  com.apple.Safari              	0x00002876 0x1000 + 6262

[Matt Lilek]

...or just load GMail, no clicking necessary.

Sorry about that!
Fixed in <http://trac.webkit.org/projects/webkit/changeset/27579>.