11010 2006-09-24 13:29:10 -0700 REGRESSION: Repro crash in <script> onload event dispatch 2006-12-20 03:03:56 -0800 1 1 1 Unclassified WebKit New Bugs 420+ Mac OS X 10.4 RESOLVED FIXED http://apartmentcities.com/Apartments/map.asp?apt=12606 HasReduction, InRadar, Regression P1 Normal --- 1 mitz webkit-unassigned ap ddkilzer miles_b oldest_to_newest 56365 0 mitz 2006-09-24 13:29:10 -0700 This is what I get going to the above URL with TOT: EXC_BAD_ACCESS (0x0001) KERN_PROTECTION_FAILURE (0x0002) at 0x003a0033 Thread 0 Crashed: 0 WebCore::TreeShared<WebCore::Node>::ref() + 32 (Shared.h:51) 1 WebCore::EventTargetNode::dispatchGenericEvent(WTF::PassRefPtr<WebCore::Event>, int&, bool) + 304 (EventTargetNode.cpp:179) 2 WebCore::EventTargetNode::dispatchEvent(WTF::PassRefPtr<WebCore::Event>, int&, bool) + 348 (EventTargetNode.cpp:292) 3 WebCore::EventTargetNode::dispatchHTMLEvent(WebCore::AtomicString const&, bool, bool) + 172 (EventTargetNode.cpp:481) 4 WebCore::HTMLScriptElement::notifyFinished(WebCore::CachedResource*) + 244 (HTMLScriptElement.cpp:155) 5 WebCore::CachedScript::checkNotify() + 112 (CachedScript.cpp:108) 6 WebCore::CachedScript::data(WTF::Vector<char, (unsigned long)0>&, bool) + 184 (CachedScript.cpp:100) 7 WebCore::Loader::receivedAllData(WebCore::ResourceLoader*, NSData*) + 464 (loader.cpp:138) 8 -[WebCoreResourceLoaderImp finishJobAndHandle:] + 180 (WebCoreResourceLoaderImp.mm:98) 9 -[WebCoreResourceLoaderImp finishWithData:] + 196 (WebCoreResourceLoaderImp.mm:130) ... 56405 1 mitz 2006-09-24 23:33:49 -0700 The problem appears to be a script that deletes its own <script> element. Looks like the fix is for HTMLScriptElement::notifyFinished() to protect itself with a ref()/deref() (it will also be cleaner to change the cs->deref(this) to m_cachedScript->deref(this) only if m_cachedScript is still non-0). Other callers to HTMLScriptElement::evaluateScript() appear to be safe, since it's the last thing they call. 56431 2 10758 mitz 2006-09-25 09:18:00 -0700 Created attachment 10758 Reduction (will crash) Crashes run-webkit-tests immediately, in Safari you need to reload to get the crash (might be a good junk/bad junk thing). 46638 3 slewis 2006-11-06 21:53:37 -0800 radar 4701860 41943 4 mitz 2006-12-15 02:01:40 -0800 *** Bug 11837 has been marked as a duplicate of this bug. *** 41089 5 mitz 2006-12-19 22:36:48 -0800 Fixed (completely independently of this Bugzilla bug) by Anders in r18335. 41097 6 ddkilzer 2006-12-20 03:03:56 -0800 (In reply to comment #3) > radar 4701860 Per r18335, also: <rdar://problem/4726407> [9A255] Crash in WebCore::EventTargetNode::dispatchEvent http://trac.webkit.org/projects/webkit/changeset/18335 10758 2006-09-25 09:18:00 -0700 2006-09-25 09:18:00 -0700 Reduction (will crash) deleted-script-crash.html text/html 306 mitz PGJvZHk+CjxzY3JpcHQgaWQ9InNjcHQiPjwvc2NyaXB0PgpSZWxvYWQgdG8gY3Jhc2guCjxzY3Jp cHQ+CiAgICB2YXIgc2NwdCA9IGRvY3VtZW50LmdldEVsZW1lbnRCeUlkKCdzY3B0Jyk7CiAgICBz Y3B0Lm9ubG9hZCA9ICJmYWxzZSI7CiAgICBzY3B0LnNyYyA9ICJkYXRhOnRleHQvamF2YXNjcmlw dCxzY3B0LnBhcmVudE5vZGUucmVtb3ZlQ2hpbGQoc2NwdCk7IHNjcHQgPSBudWxsOyB6ID0gbmV3 IEFycmF5KCk7IGZvciAoaSA9IDA7IGkgPCAxMDAwOyBpKyspIHpbaV0gPSBuZXcgT2JqZWN0KCk7 IjsKPC9zY3JpcHQ+CjwvYm9keT4K