110631 2013-02-22 12:48:46 -0800 ScrollingStateTree::rootStateNode() should be null-checked since it can be null 2013-02-22 13:40:42 -0800 1 1 1 Unclassified WebKit Layout and Rendering 528+ (Nightly build) Unspecified Unspecified RESOLVED FIXED P2 Normal --- 1 bdakin bdakin andersca bdakin cmarcelo hugo jamesr luiz sam simon.fraser thorton tonikitoo webkit.review.bot oldest_to_newest 839828 0 bdakin 2013-02-22 12:48:46 -0800 ScrollingStateTree::rootStateNode() can be null when you are navigating between pages. There are two places in the code that don't null-check it, and I believe that those spots are responsible for some non-reproducible crashes that we have reports of. I believe this patch will fix https://bugs.webkit.org/show_bug.cgi?id=110509 which corresponds to <rdar://problem/12519348> and also <rdar://problem/13233090>. The offsets in those crashes do appear to be attempts at accessing setShouldUpdateScrollLayerPositionOnMainThread() and children() respectively on a null ScrollingStateNode. 839833 1 189808 bdakin 2013-02-22 12:51:15 -0800 Created attachment 189808 Patch 839883 2 bdakin 2013-02-22 13:40:06 -0800 Thanks! http://trac.webkit.org/changeset/143785 839885 3 bdakin 2013-02-22 13:40:42 -0800 *** Bug 110509 has been marked as a duplicate of this bug. *** 189808 2013-02-22 12:51:15 -0800 2013-02-22 13:27:00 -0800 Patch for-review.txt text/plain 2089 bdakin SW5kZXg6IFNvdXJjZS9XZWJDb3JlL0NoYW5nZUxvZwo9PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09Ci0tLSBTb3VyY2UvV2Vi Q29yZS9DaGFuZ2VMb2cJKHJldmlzaW9uIDE0Mzc4MCkKKysrIFNvdXJjZS9XZWJDb3JlL0NoYW5n ZUxvZwkod29ya2luZyBjb3B5KQpAQCAtMSwzICsxLDE4IEBACisyMDEzLTAyLTIyICBCZXRoIERh a2luICA8YmRha2luQGFwcGxlLmNvbT4KKworICAgICAgICBTY3JvbGxpbmdTdGF0ZVRyZWU6OnJv b3RTdGF0ZU5vZGUoKSBzaG91bGQgYmUgbnVsbC1jaGVja2VkIHNpbmNlIGl0IGNhbiBiZSBudWxs CisgICAgICAgIGh0dHBzOi8vYnVncy53ZWJraXQub3JnL3Nob3dfYnVnLmNnaT9pZD0xMTA2MzEK KworICAgICAgICBSZXZpZXdlZCBieSBOT0JPRFkgKE9PUFMhKS4KKworICAgICAgICBUaGlzIGlz IGEgc3BlY3VsYXRpdmUgZml4IGZvciA8cmRhcjovL3Byb2JsZW0vMTMyMzMwOTA+IGFuZCAKKyAg ICAgICAgPHJkYXI6Ly9wcm9ibGVtLzEyNTE5MzQ4Pi4gSXQgaXMgdG90YWxseSBwb3NzaWJsZSBm b3Igcm9vdFN0YXRlTm9kZSgpIHRvIGJlIG51bGwsIAorICAgICAgICBzbyB3ZSBzaG91bGQgbnVs bC1jaGVjayBpdC4KKworICAgICAgICAqIHBhZ2Uvc2Nyb2xsaW5nL21hYy9TY3JvbGxpbmdDb29y ZGluYXRvck1hYy5tbToKKyAgICAgICAgKFdlYkNvcmU6OlNjcm9sbGluZ0Nvb3JkaW5hdG9yTWFj OjpzZXRTaG91bGRVcGRhdGVTY3JvbGxMYXllclBvc2l0aW9uT25NYWluVGhyZWFkKToKKyAgICAg ICAgKFdlYkNvcmU6OlNjcm9sbGluZ0Nvb3JkaW5hdG9yTWFjOjpzeW5jQ2hpbGRQb3NpdGlvbnMp OgorCiAyMDEzLTAyLTIyICBSeW9zdWtlIE5pd2EgIDxybml3YUB3ZWJraXQub3JnPgogCiAgICAg ICAgIEJpbmRpbmcgdGVzdHMgcmViYXNlbGluZSBhZnRlciByMTQzNzM3LgpJbmRleDogU291cmNl L1dlYkNvcmUvcGFnZS9zY3JvbGxpbmcvbWFjL1Njcm9sbGluZ0Nvb3JkaW5hdG9yTWFjLm1tCj09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT0KLS0tIFNvdXJjZS9XZWJDb3JlL3BhZ2Uvc2Nyb2xsaW5nL21hYy9TY3JvbGxpbmdD b29yZGluYXRvck1hYy5tbQkocmV2aXNpb24gMTQzNzUyKQorKysgU291cmNlL1dlYkNvcmUvcGFn ZS9zY3JvbGxpbmcvbWFjL1Njcm9sbGluZ0Nvb3JkaW5hdG9yTWFjLm1tCSh3b3JraW5nIGNvcHkp CkBAIC0zMTQsNiArMzE0LDkgQEAgdm9pZCBTY3JvbGxpbmdDb29yZGluYXRvck1hYzo6c2V0V2hl ZWxFdgogCiB2b2lkIFNjcm9sbGluZ0Nvb3JkaW5hdG9yTWFjOjpzZXRTaG91bGRVcGRhdGVTY3Jv bGxMYXllclBvc2l0aW9uT25NYWluVGhyZWFkKE1haW5UaHJlYWRTY3JvbGxpbmdSZWFzb25zIHJl YXNvbnMpCiB7CisgICAgaWYgKCFtX3Njcm9sbGluZ1N0YXRlVHJlZS0+cm9vdFN0YXRlTm9kZSgp KQorICAgICAgICByZXR1cm47CisKICAgICAvLyBUaGUgRnJhbWVWaWV3J3MgR3JhcGhpY3NMYXll ciBpcyBsaWtlbHkgdG8gYmUgb3V0LW9mLXN5bmNoIHdpdGggdGhlIFBsYXRmb3JtTGF5ZXIKICAg ICAvLyBhdCB0aGlzIHBvaW50LiBTbyB3ZSdsbCB1cGRhdGUgaXQgYmVmb3JlIHdlIHN3aXRjaCBi YWNrIHRvIG1haW4gdGhyZWFkIHNjcm9sbGluZwogICAgIC8vIGluIG9yZGVyIHRvIGF2b2lkIGxh eWVyIHBvc2l0aW9uaW5nIGJ1Z3MuCkBAIC0zNDAsNiArMzQzLDkgQEAgdm9pZCBTY3JvbGxpbmdD b29yZGluYXRvck1hYzo6dXBkYXRlTWFpbgogCiB2b2lkIFNjcm9sbGluZ0Nvb3JkaW5hdG9yTWFj OjpzeW5jQ2hpbGRQb3NpdGlvbnMoY29uc3QgTGF5b3V0UmVjdCYgdmlld3BvcnRSZWN0KQogewor ICAgIGlmICghbV9zY3JvbGxpbmdTdGF0ZVRyZWUtPnJvb3RTdGF0ZU5vZGUoKSkKKyAgICAgICAg cmV0dXJuOworCiAgICAgVmVjdG9yPE93blB0cjxTY3JvbGxpbmdTdGF0ZU5vZGU+ID4qIGNoaWxk cmVuID0gbV9zY3JvbGxpbmdTdGF0ZVRyZWUtPnJvb3RTdGF0ZU5vZGUoKS0+Y2hpbGRyZW4oKTsK ICAgICBpZiAoIWNoaWxkcmVuKQogICAgICAgICByZXR1cm47Cg==