156997 2016-04-25 14:49:51 -0700 Crash under WebCore::MutationObserver::deliverAllMutations() 2016-04-25 17:12:43 -0700 1 1 1 Unclassified WebKit DOM WebKit Nightly Build Unspecified Unspecified RESOLVED FIXED InRadar P2 Normal --- 1 cdumez cdumez commit-queue esprehn+autocc ggaren kangil.han rniwa sam webkit-bug-importer oldest_to_newest 1187070 0 cdumez 2016-04-25 14:49:51 -0700 Crash under WebCore::MutationObserver::deliverAllMutations(): Thread[0] EXC_BAD_ACCESS (SIGSEGV) (KERN_INVALID_ADDRESS at 0x00000000000000b0) [ 0] 0x00007fff84d4ddad WebCore`WebCore::MutationObserver::deliverAllMutations() [inlined] WTF::RefPtr<WebCore::MutationCallback>::operator->() const at ScriptExecutionContext.h:98 94 virtual void suspendActiveDOMObjects(ActiveDOMObject::ReasonForSuspension); 95 virtual void resumeActiveDOMObjects(ActiveDOMObject::ReasonForSuspension); 96 virtual void stopActiveDOMObjects(); 97 -> 98 bool activeDOMObjectsAreSuspended() const { return m_activeDOMObjectsAreSuspended; } 99 bool activeDOMObjectsAreStopped() const { return m_activeDOMObjectsAreStopped; } 100 101 // Called from the constructor and destructors of ActiveDOMObject. 102 void didCreateActiveDOMObject(ActiveDOMObject*); 0x00007fff84d4dda0: movq (%r15), %rax 0x00007fff84d4dda3: movq 0x8(%rax), %rdi 0x00007fff84d4dda7: movq (%rdi), %rax 0x00007fff84d4ddaa: callq *0x18(%rax) -> 0x00007fff84d4ddad: cmpb $0x0, 0xb0(%rax) 0x00007fff84d4ddb4: jne 0x139eb1 ; <+433> at MutationObserver.cpp:221 0x00007fff84d4ddba: cmpb $0x1, 0xed44ef(%rip) ; WebCore::suspendedMutationObservers()::suspendedObservers + 7 0x00007fff84d4ddc1: jne 0x139dd0 ; <+208> [inlined] WebCore::suspendedMutationObservers() + 15 at MutationObserver.cpp:225 0x00007fff84d4ddc3: movq 0xed44de(%rip), %rbx ; WebCore::suspendedMutationObservers()::suspendedObservers [ 0] 0x00007fff84d4ddad WebCore`WebCore::MutationObserver::deliverAllMutations() [inlined] WTF::Vector<WTF::RefPtr<WebCore::MutationObserver>, 0ul, WTF::CrashOnOverflow>::operator[](unsigned long) + 25 at MutationObserver.cpp:184 180 } 181 182 bool MutationObserver::canDeliver() 183 { -> 184 return !m_callback->scriptExecutionContext()->activeDOMObjectsAreSuspended(); 185 } 186 187 void MutationObserver::deliver() 188 { [ 0] 0x00007fff84d4dd94 WebCore`WebCore::MutationObserver::deliverAllMutations() + 148 at MutationObserver.cpp:222 218 if (!suspendedMutationObservers().isEmpty()) { 219 Vector<RefPtr<MutationObserver> > suspended; 220 copyToVector(suspendedMutationObservers(), suspended); 221 for (size_t i = 0; i < suspended.size(); ++i) { -> 222 if (!suspended[i]->canDeliver()) 223 continue; 224 225 suspendedMutationObservers().remove(suspended[i]); 226 activeMutationObservers().add(suspended[i]); [ 1] 0x00007fff84e393df WebCore`WebCore::JSMainThreadExecState::call(JSC::ExecState*, JSC::JSValue, JSC::CallType, JSC::CallData const&, JSC::JSValue, JSC::ArgList const&) [inlined] WebCore::JSMainThreadExecState::~JSMainThreadExecState() + 18 at JSMainThreadExecState.h:97 93 94 s_mainThreadState = m_previousState; 95 96 if (didExitJavaScript) -> 97 didLeaveScriptContext(); 98 } 99 100 private: 101 static JSC::ExecState* s_mainThreadState; 0x00007fff84e393d1: je 0x2253e2 ; <+178> [inlined] WebCore::JSMainThreadExecState::~JSMainThreadExecState() + 21 at JSMainThreadExecState.h:89 0x00007fff84e393d3: movq %r14, (%r15) 0x00007fff84e393d6: testq %r14, %r14 0x00007fff84e393d9: jne 0x2253e5 ; <+181> at JSMainThreadExecState.h:57 -> 0x00007fff84e393db: callq 0x13b9a0 ; WebCore::JSMainThreadExecState::didLeaveScriptContext at JSMainThreadExecState.cpp:39 0x00007fff84e393e0: jmp 0x2253e5 ; <+181> at JSMainThreadExecState.h:57 0x00007fff84e393e2: movq %r14, (%r15) 0x00007fff84e393e5: movq %rbx, %rax 0x00007fff84e393e8: addq $0x18, %rsp [ 1] 0x00007fff84e393cd WebCore`WebCore::JSMainThreadExecState::call(JSC::ExecState*, JSC::JSValue, JSC::CallType, JSC::CallData const&, JSC::JSValue, JSC::ArgList const&) [inlined] WebCore::JSMainThreadExecState::~JSMainThreadExecState() at JSMainThreadExecState.h:89 [ 1] 0x00007fff84e393cd WebCore`WebCore::JSMainThreadExecState::call(JSC::ExecState*, JSC::JSValue, JSC::CallType, JSC::CallData const&, JSC::JSValue, JSC::ArgList const&) + 157 at JSMainThreadExecState.h:57 [ 2] 0x00007fff84e7db51 WebCore`WebCore::ScheduledAction::executeFunctionInContext(JSC::JSGlobalObject*, JSC::JSValue, WebCore::ScriptExecutionContext*) + 449 at ScheduledAction.cpp:111 0x00007fff84e7db3c: leaq -0x48(%rbp), %rcx 0x00007fff84e7db40: leaq -0xc0(%rbp), %r9 0x00007fff84e7db47: movq %rbx, %rdi 0x00007fff84e7db4a: movl %r13d, %edx -> 0x00007fff84e7db4d: callq 0x225330 ; WebCore::JSMainThreadExecState::call at JSMainThreadExecState.h:51 0x00007fff84e7db52: jmp 0x269b81 ; <+497> [inlined] WebCore::InspectorInstrumentation::hasFrontends() at InspectorInstrumentation.h:853 0x00007fff84e7db54: movq -0x58(%rbp), %rax 0x00007fff84e7db58: movq %rax, -0xd0(%rbp) 0x00007fff84e7db5f: movl -0xa0(%rbp), %eax 1187071 1 cdumez 2016-04-25 14:50:25 -0700 rdar://problem/16542323 1187082 2 277284 cdumez 2016-04-25 15:27:42 -0700 Created attachment 277284 Patch 1187133 3 277284 commit-queue 2016-04-25 17:12:38 -0700 Comment on attachment 277284 Patch Clearing flags on attachment: 277284 Committed r200062: <http://trac.webkit.org/changeset/200062> 1187134 4 commit-queue 2016-04-25 17:12:43 -0700 All reviewed patches have been landed. Closing bug. 277284 2016-04-25 15:27:42 -0700 2016-04-25 17:12:38 -0700 Patch bug-156997-20160425152810.patch text/plain 3804 cdumez U3VidmVyc2lvbiBSZXZpc2lvbjogMjAwMDQzCmRpZmYgLS1naXQgYS9Tb3VyY2UvV2ViQ29yZS9D aGFuZ2VMb2cgYi9Tb3VyY2UvV2ViQ29yZS9DaGFuZ2VMb2cKaW5kZXggZGRhNjRmMjA0MzA1M2Vi YWIxYmY5NjllOGVkYjZmYzFhZTQ2MTc1My4uZDIyMGNmYjgyNDI4OGZlNWEwYmIzYzkyNWNjNWUz Yzg3YTM4YzI4YyAxMDA2NDQKLS0tIGEvU291cmNlL1dlYkNvcmUvQ2hhbmdlTG9nCisrKyBiL1Nv dXJjZS9XZWJDb3JlL0NoYW5nZUxvZwpAQCAtMSwzICsxLDI5IEBACisyMDE2LTA0LTI1ICBDaHJp cyBEdW1leiAgPGNkdW1lekBhcHBsZS5jb20+CisKKyAgICAgICAgQ3Jhc2ggdW5kZXIgV2ViQ29y ZTo6TXV0YXRpb25PYnNlcnZlcjo6ZGVsaXZlckFsbE11dGF0aW9ucygpCisgICAgICAgIGh0dHBz Oi8vYnVncy53ZWJraXQub3JnL3Nob3dfYnVnLmNnaT9pZD0xNTY5OTcKKyAgICAgICAgPHJkYXI6 Ly9wcm9ibGVtLzE2NTQyMzIzPgorCisgICAgICAgIFJldmlld2VkIGJ5IE5PQk9EWSAoT09QUyEp LgorCisgICAgICAgIFRoZSBjcmFzaCB0cmFjZXMgaW5kaWNhdGUgdGhhdCB3ZSBtYXkgZGVyZWZl bmNlIGEgbnVsbCBwb2ludGVyIHdoZW4KKyAgICAgICAgZGVyZWZlcmVuY2luZyBNdXRhdGlvbkNh bGxiYWNrOjpzY3JpcHRFeGVjdXRhdGlvbkNvbnRleHQoKSBpbgorICAgICAgICBNdXRhdGlvbk9i c2VydmVyOjpjYW5EZWxpdmVyKCkuIFRoaXMgY2FuIGhhcHBlbiB3aGVuIHRoZSBzY3JpcHQKKyAg ICAgICAgZXhlY3V0aW9uIGNvbnRleHQgZ2V0cyBkZXN0cm95ZWQgYXMgYSBKU011dGF0aW9uQ2Fs bGJhY2sgaXMgYW4KKyAgICAgICAgQWN0aXZlRE9NT2JqZWN0LCB3aGljaCBpcyBhIENvbnRleHRE ZXN0cnVjdGlvbk9ic2VydmVyLgorCisgICAgICAgIFRoaXMgcGF0Y2ggcmVmYWN0b3JzIHRoZSBj b2RlIHNvIHRoYXQgTXV0YXRpb25PYnNlcnZlcjo6Y2FuRGVsaXZlcigpCisgICAgICAgIG5vdyBz aW1wbHkgYXNrcyBKU011dGF0aW9uQ2FsbGJhY2sgaWYgaXQgY2FuIGludm9rZSBpdHMgY2FsbGJh Y2suCisgICAgICAgIEpTTXV0YXRpb25DYWxsYmFjayBtYWtlcyB0aGlzIGRlY2lzaW9uIHVzaW5n CisgICAgICAgIEFjdGl2ZURPTUNhbGxiYWNrOjpjYW5JbnZva2VDYWxsYmFjaygpIHdoaWNoIGRv ZXMgYSBwcm9wZXIgbnVsbAorICAgICAgICBjaGVjayBvZiB0aGUgU2NyaXB0RXhlY3V0YXRpb25D b250ZXh0LiBUaGlzIGF2b2lkcyBzb21lIGNvZGUKKyAgICAgICAgZHVwbGljYXRpb24gYW5kIGZp eGVzIHRoZSBjcmFzaC4KKworICAgICAgICAqIGJpbmRpbmdzL2pzL0pTTXV0YXRpb25DYWxsYmFj ay5oOgorICAgICAgICAqIGRvbS9NdXRhdGlvbkNhbGxiYWNrLmg6CisgICAgICAgICogZG9tL011 dGF0aW9uT2JzZXJ2ZXIuY3BwOgorICAgICAgICAoV2ViQ29yZTo6TXV0YXRpb25PYnNlcnZlcjo6 Y2FuRGVsaXZlcik6CisKIDIwMTYtMDQtMjUgIFNpbW9uIEZyYXNlciAgPHNpbW9uLmZyYXNlckBh cHBsZS5jb20+CiAKICAgICAgICAgcGxheS1zdGF0ZSBub3QgcGFyc2VkIGFzIHBhcnQgb2YgYW5p bWF0aW9uIHNob3J0aGFuZApkaWZmIC0tZ2l0IGEvU291cmNlL1dlYkNvcmUvYmluZGluZ3MvanMv SlNNdXRhdGlvbkNhbGxiYWNrLmggYi9Tb3VyY2UvV2ViQ29yZS9iaW5kaW5ncy9qcy9KU011dGF0 aW9uQ2FsbGJhY2suaAppbmRleCA1NDY3YWFhMWJhYTdhZTg5MDNhZmM3MmMyYzcxMTA5MWJlYzYw ZjNhLi5mM2NhNDdkOWE5ZTI1OWFjOTdiYzIwMTViZWY4MGY0YzJiZWVkYzg0IDEwMDY0NAotLS0g YS9Tb3VyY2UvV2ViQ29yZS9iaW5kaW5ncy9qcy9KU011dGF0aW9uQ2FsbGJhY2suaAorKysgYi9T b3VyY2UvV2ViQ29yZS9iaW5kaW5ncy9qcy9KU011dGF0aW9uQ2FsbGJhY2suaApAQCAtMzcsNyAr MzcsNyBAQCBuYW1lc3BhY2UgV2ViQ29yZSB7CiAKIGNsYXNzIEpTRE9NR2xvYmFsT2JqZWN0Owog Ci1jbGFzcyBKU011dGF0aW9uQ2FsbGJhY2sgOiBwdWJsaWMgTXV0YXRpb25DYWxsYmFjaywgcHVi bGljIEFjdGl2ZURPTUNhbGxiYWNrIHsKK2NsYXNzIEpTTXV0YXRpb25DYWxsYmFjayBmaW5hbCA6 IHB1YmxpYyBNdXRhdGlvbkNhbGxiYWNrLCBwdWJsaWMgQWN0aXZlRE9NQ2FsbGJhY2sgewogcHVi bGljOgogICAgIHN0YXRpYyBSZWY8SlNNdXRhdGlvbkNhbGxiYWNrPiBjcmVhdGUoSlNDOjpKU09i amVjdCogY2FsbGJhY2ssIEpTRE9NR2xvYmFsT2JqZWN0KiBnbG9iYWxPYmplY3QpCiAgICAgewpA QCAtNDcsOCArNDcsNyBAQCBwdWJsaWM6CiAgICAgdmlydHVhbCB+SlNNdXRhdGlvbkNhbGxiYWNr KCk7CiAKICAgICB2b2lkIGNhbGwoY29uc3QgVmVjdG9yPFJlZjxNdXRhdGlvblJlY29yZD4+Jiwg TXV0YXRpb25PYnNlcnZlciopIG92ZXJyaWRlOwotCi0gICAgU2NyaXB0RXhlY3V0aW9uQ29udGV4 dCogc2NyaXB0RXhlY3V0aW9uQ29udGV4dCgpIGNvbnN0IG92ZXJyaWRlIHsgcmV0dXJuIENvbnRl eHREZXN0cnVjdGlvbk9ic2VydmVyOjpzY3JpcHRFeGVjdXRpb25Db250ZXh0KCk7IH0KKyAgICBi b29sIGNhbkludm9rZUNhbGxiYWNrKCkgY29uc3Qgb3ZlcnJpZGUgeyByZXR1cm4gQWN0aXZlRE9N Q2FsbGJhY2s6OmNhbkludm9rZUNhbGxiYWNrKCk7IH0KIAogcHJpdmF0ZToKICAgICBKU011dGF0 aW9uQ2FsbGJhY2soSlNDOjpKU09iamVjdCogY2FsbGJhY2ssIEpTRE9NR2xvYmFsT2JqZWN0Kik7 CmRpZmYgLS1naXQgYS9Tb3VyY2UvV2ViQ29yZS9kb20vTXV0YXRpb25DYWxsYmFjay5oIGIvU291 cmNlL1dlYkNvcmUvZG9tL011dGF0aW9uQ2FsbGJhY2suaAppbmRleCA2MjBjMmZjZDlkNWU4OGMx NzY2YWUzYzI4MTU4ZGFkMjUwOTJlOGVjLi5mZmVmMDNhNTI2NDQ3MjgwN2VlMjllMjg0ODEzZDc3 NmYxZjI2ZjA5IDEwMDY0NAotLS0gYS9Tb3VyY2UvV2ViQ29yZS9kb20vTXV0YXRpb25DYWxsYmFj ay5oCisrKyBiL1NvdXJjZS9XZWJDb3JlL2RvbS9NdXRhdGlvbkNhbGxiYWNrLmgKQEAgLTQ1LDcg KzQ1LDcgQEAgcHVibGljOgogICAgIHZpcnR1YWwgfk11dGF0aW9uQ2FsbGJhY2soKSB7IH0KIAog ICAgIHZpcnR1YWwgdm9pZCBjYWxsKGNvbnN0IFZlY3RvcjxSZWY8TXV0YXRpb25SZWNvcmQ+PiYs IE11dGF0aW9uT2JzZXJ2ZXIqKSA9IDA7Ci0gICAgdmlydHVhbCBTY3JpcHRFeGVjdXRpb25Db250 ZXh0KiBzY3JpcHRFeGVjdXRpb25Db250ZXh0KCkgY29uc3QgPSAwOworICAgIHZpcnR1YWwgYm9v bCBjYW5JbnZva2VDYWxsYmFjaygpIGNvbnN0ID0gMDsKIH07CiAKIH0KZGlmZiAtLWdpdCBhL1Nv dXJjZS9XZWJDb3JlL2RvbS9NdXRhdGlvbk9ic2VydmVyLmNwcCBiL1NvdXJjZS9XZWJDb3JlL2Rv bS9NdXRhdGlvbk9ic2VydmVyLmNwcAppbmRleCBhNjkwY2ZhZGVmNTczOTJlZTBjNTQyMmE0ZWU1 MzQwMzI2N2M0ZWU0Li5mOTUxYzg0NjUwODFmY2Y0ZTg4MWM0ZGI4NzM2NDEwOGJhZTZiN2Q4IDEw MDY0NAotLS0gYS9Tb3VyY2UvV2ViQ29yZS9kb20vTXV0YXRpb25PYnNlcnZlci5jcHAKKysrIGIv U291cmNlL1dlYkNvcmUvZG9tL011dGF0aW9uT2JzZXJ2ZXIuY3BwCkBAIC0yMTEsNyArMjExLDcg QEAgSGFzaFNldDxOb2RlKj4gTXV0YXRpb25PYnNlcnZlcjo6Z2V0T2JzZXJ2ZWROb2RlcygpIGNv bnN0CiAKIGJvb2wgTXV0YXRpb25PYnNlcnZlcjo6Y2FuRGVsaXZlcigpCiB7Ci0gICAgcmV0dXJu ICFtX2NhbGxiYWNrLT5zY3JpcHRFeGVjdXRpb25Db250ZXh0KCktPmFjdGl2ZURPTU9iamVjdHNB cmVTdXNwZW5kZWQoKTsKKyAgICByZXR1cm4gbV9jYWxsYmFjay0+Y2FuSW52b2tlQ2FsbGJhY2so KTsKIH0KIAogdm9pZCBNdXRhdGlvbk9ic2VydmVyOjpkZWxpdmVyKCkK