181742 2018-01-17 07:42:23 -0800 REGRESSION (r226385?): Crash in com.apple.WebCore: WebCore::MediaQueryEvaluator::evaluate const + 32 2018-01-17 13:53:32 -0800 1 1 1 Unclassified WebKit CSS WebKit Nightly Build Unspecified Unspecified RESOLVED FIXED InRadar P2 Normal --- 1 koivisto webkit-unassigned bfulgham commit-queue ddkilzer webkit-bug-importer oldest_to_newest 1390000 0 koivisto 2018-01-17 07:42:23 -0800 > 1 com.apple.WebCore 0x00bf2440 WebCore::MediaQueryEvaluator::evaluate(WebCore::MediaQueryExpression const&) const + 32 2 com.apple.WebCore 0x00bf2278 WebCore::MediaQueryEvaluator::evaluate(WebCore::MediaQuerySet const&, WebCore::StyleResolver*) const + 344 3 com.apple.WebCore 0x00bfdcf9 WebCore::RuleSet::addChildRules(WTF::Vector<WTF::RefPtr<WebCore::StyleRuleBase, WTF::DumbPtrTraits<WebCore::StyleRuleBase> >, 0ul, WTF::CrashOnOverflow, 16ul, WTF::FastMalloc> const&, WebCore::MediaQueryEvaluator const&, WebCore::StyleResolver*, bool) + 281 4 com.apple.WebCore 0x00bfde71 WebCore::RuleSet::addRulesFromSheet(WebCore::StyleSheetContents&, WebCore::MediaQueryEvaluator const&, WebCore::StyleResolver*) + 145 5 com.apple.WebCore 0x00be1fb7 WebCore::ElementRuleCollector::ElementRuleCollector(WebCore::Element const&, WebCore::DocumentRuleSets const&, WebCore::SelectorFilter const*) + 135 6 com.apple.WebCore 0x00c0df0e WebCore::StyleResolver::styleForElement(WebCore::Element const&, WebCore::RenderStyle const*, WebCore::RenderStyle const*, WebCore::RuleMatchingBehavior, WebCore::SelectorFilter const*) + 798 7 com.apple.WebCore 0x00caa22e WebCore::Document::styleForElementIgnoringPendingStylesheets(WebCore::Element&, WebCore::RenderStyle const*, WebCore::PseudoId) + 158 8 com.apple.WebCore 0x00cdaefb WebCore::Element::resolveComputedStyle() + 699 9 com.apple.WebCore 0x0007293a WebCore::Element::computedStyle(WebCore::PseudoId) + 186 10 com.apple.WebCore 0x00e57a91 WebCore::HTMLTitleElement::computedTextWithDirection() + 33 11 com.apple.WebCore 0x00e579ed WebCore::HTMLTitleElement::childrenChanged(WebCore::ContainerNode::ChildChange const&) + 29 12 com.apple.WebCore 0x00c91d44 WebCore::ContainerNode::appendChildWithoutPreInsertionValidityCheck(WebCore::Node&) + 980 13 com.apple.WebCore 0x00c93a65 WebCore::ContainerNode::replaceAllChildren(WTF::Ref<WebCore::Node, WTF::DumbPtrTraits<WebCore::Node> >&&) + 645 14 com.apple.WebCore 0x00df1949 WebCore::HTMLElement::setInnerText(WTF::String const&) + 265 15 com.apple.WebCore 0x0051b32e WebCore::setJSHTMLElementInnerText(JSC::ExecState*, long long, long long) + 334 1390002 1 koivisto 2018-01-17 07:42:56 -0800 <rdar://problem/36334726> 1390005 2 331494 koivisto 2018-01-17 08:00:14 -0800 Created attachment 331494 patch 1390167 3 331494 ddkilzer 2018-01-17 12:45:13 -0800 Comment on attachment 331494 patch View in context: https://bugs.webkit.org/attachment.cgi?id=331494&action=review r=me, but maybe you want a review from Dean Jackson or another area expert. > Source/WebCore/css/MediaQueryEvaluator.cpp:778 > + if (!m_document) > + return m_fallbackResult; > + > + Document& document = *m_document; > + auto* frame = document.frame(); > + if (!frame || !frame->view() || !m_style) > return m_fallbackResult; You could move the "!m_style" check to the first if statement to avoid a small amount of work: if (!m_document || !m_style) return m_fallbackResult; 1390195 4 331494 commit-queue 2018-01-17 13:53:31 -0800 Comment on attachment 331494 patch Clearing flags on attachment: 331494 Committed r227082: <https://trac.webkit.org/changeset/227082> 1390196 5 commit-queue 2018-01-17 13:53:32 -0800 All reviewed patches have been landed. Closing bug. 331494 2018-01-17 08:00:14 -0800 2018-01-17 13:53:31 -0800 patch mediaquery-frame-crash.patch text/plain 6073 koivisto SW5kZXg6IFNvdXJjZS9XZWJDb3JlL0NoYW5nZUxvZwo9PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09Ci0tLSBTb3VyY2UvV2Vi Q29yZS9DaGFuZ2VMb2cJKHJldmlzaW9uIDIyNzA2NikKKysrIFNvdXJjZS9XZWJDb3JlL0NoYW5n ZUxvZwkod29ya2luZyBjb3B5KQpAQCAtMSwzICsxLDI4IEBACisyMDE4LTAxLTE3ICBBbnR0aSBL b2l2aXN0byAgPGFudHRpQGFwcGxlLmNvbT4KKworICAgICAgICBSRUdSRVNTSU9OIChyMjI2Mzg1 Pyk6IENyYXNoIGluIGNvbS5hcHBsZS5XZWJDb3JlOiBXZWJDb3JlOjpNZWRpYVF1ZXJ5RXZhbHVh dG9yOjpldmFsdWF0ZSBjb25zdCArIDMyCisgICAgICAgIGh0dHBzOi8vYnVncy53ZWJraXQub3Jn L3Nob3dfYnVnLmNnaT9pZD0xODE3NDIKKyAgICAgICAgPHJkYXI6Ly9wcm9ibGVtLzM2MzM0NzI2 PgorCisgICAgICAgIFJldmlld2VkIGJ5IE5PQk9EWSAoT09QUyEpLgorCisgICAgICAgIFRlc3Q6 IGZhc3QvbWVkaWEvbWVkaWFxdWVyeWV2YWx1YXRvci1jcmFzaC5odG1sCisKKyAgICAgICAgKiBj c3MvTWVkaWFRdWVyeUV2YWx1YXRvci5jcHA6CisgICAgICAgIChXZWJDb3JlOjpNZWRpYVF1ZXJ5 RXZhbHVhdG9yOjpNZWRpYVF1ZXJ5RXZhbHVhdG9yKToKKworICAgICAgICBVc2UgV2Vha1B0cjxE b2N1bWVudD4gaW5zdGVhZCBvZiBhIHBsYWluIEZyYW1lIHBvaW50ZXIuCisKKyAgICAgICAgKFdl YkNvcmU6Ok1lZGlhUXVlcnlFdmFsdWF0b3I6OmV2YWx1YXRlIGNvbnN0KToKKworICAgICAgICBH ZXQgdGhlIGZyYW1lIHZpYSBkb2N1bWVudC4KKworICAgICAgICAqIGNzcy9NZWRpYVF1ZXJ5RXZh bHVhdG9yLmg6CisgICAgICAgICogZG9tL0RvY3VtZW50LmNwcDoKKyAgICAgICAgKFdlYkNvcmU6 OkRvY3VtZW50OjpwcmVwYXJlRm9yRGVzdHJ1Y3Rpb24pOgorCisgICAgICAgIFRha2UgY2FyZSB0 byBjbGVhciBzdHlsZSByZXNvbHZlci4KKwogMjAxOC0wMS0xNyAgWmFuIERvYmVyc2VrICA8emRv YmVyc2VrQGlnYWxpYS5jb20+CiAKICAgICAgICAgVW5yZXZpZXdlZCBmb2xsb3ctdXAgdG8gcjIy NzA1MS4KSW5kZXg6IFNvdXJjZS9XZWJDb3JlL2Nzcy9NZWRpYVF1ZXJ5RXZhbHVhdG9yLmNwcAo9 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09Ci0tLSBTb3VyY2UvV2ViQ29yZS9jc3MvTWVkaWFRdWVyeUV2YWx1YXRvci5jcHAJ KHJldmlzaW9uIDIyNjk3MCkKKysrIFNvdXJjZS9XZWJDb3JlL2Nzcy9NZWRpYVF1ZXJ5RXZhbHVh dG9yLmNwcAkod29ya2luZyBjb3B5KQpAQCAtMTA5LDcgKzEwOSw3IEBAIE1lZGlhUXVlcnlFdmFs dWF0b3I6Ok1lZGlhUXVlcnlFdmFsdWF0b3IKIAogTWVkaWFRdWVyeUV2YWx1YXRvcjo6TWVkaWFR dWVyeUV2YWx1YXRvcihjb25zdCBTdHJpbmcmIGFjY2VwdGVkTWVkaWFUeXBlLCBjb25zdCBEb2N1 bWVudCYgZG9jdW1lbnQsIGNvbnN0IFJlbmRlclN0eWxlKiBzdHlsZSkKICAgICA6IG1fbWVkaWFU eXBlKGFjY2VwdGVkTWVkaWFUeXBlKQotICAgICwgbV9mcmFtZShkb2N1bWVudC5mcmFtZSgpKQor ICAgICwgbV9kb2N1bWVudChjb25zdF9jYXN0PERvY3VtZW50Jj4oZG9jdW1lbnQpLmNyZWF0ZVdl YWtQdHIoKSkKICAgICAsIG1fc3R5bGUoc3R5bGUpCiB7CiB9CkBAIC0xMzcsNyArMTM3LDcgQEAg c3RhdGljIGJvb2wgYXBwbHlSZXN0cmljdG9yKE1lZGlhUXVlcnk6OgogCiBib29sIE1lZGlhUXVl cnlFdmFsdWF0b3I6OmV2YWx1YXRlKGNvbnN0IE1lZGlhUXVlcnlTZXQmIHF1ZXJ5U2V0LCBTdHls ZVJlc29sdmVyKiBzdHlsZVJlc29sdmVyKSBjb25zdAogewotICAgIExPR19XSVRIX1NUUkVBTShN ZWRpYVF1ZXJpZXMsIHN0cmVhbSA8PCAiTWVkaWFRdWVyeUV2YWx1YXRvcjo6ZXZhbHVhdGUgb24g IiA8PCAobV9mcmFtZSAmJiBtX2ZyYW1lLT5kb2N1bWVudCgpID8gbV9mcmFtZS0+ZG9jdW1lbnQo KS0+dXJsKCkuc3RyaW5nKCkgOiBlbXB0eVN0cmluZygpKSk7CisgICAgTE9HX1dJVEhfU1RSRUFN KE1lZGlhUXVlcmllcywgc3RyZWFtIDw8ICJNZWRpYVF1ZXJ5RXZhbHVhdG9yOjpldmFsdWF0ZSBv biAiIDw8IChtX2RvY3VtZW50ID8gbV9kb2N1bWVudC0+dXJsKCkuc3RyaW5nKCkgOiBlbXB0eVN0 cmluZygpKSk7CiAKICAgICBhdXRvJiBxdWVyaWVzID0gcXVlcnlTZXQucXVlcnlWZWN0b3IoKTsK ICAgICBpZiAoIXF1ZXJpZXMuc2l6ZSgpKSB7CkBAIC03NjksNyArNzY5LDEyIEBAIHN0YXRpYyB2 b2lkIGFkZChNZWRpYVF1ZXJ5RnVuY3Rpb25NYXAmIG0KIAogYm9vbCBNZWRpYVF1ZXJ5RXZhbHVh dG9yOjpldmFsdWF0ZShjb25zdCBNZWRpYVF1ZXJ5RXhwcmVzc2lvbiYgZXhwcmVzc2lvbikgY29u c3QKIHsKLSAgICBpZiAoIW1fZnJhbWUgfHwgIW1fZnJhbWUtPnZpZXcoKSB8fCAhbV9zdHlsZSkK KyAgICBpZiAoIW1fZG9jdW1lbnQpCisgICAgICAgIHJldHVybiBtX2ZhbGxiYWNrUmVzdWx0Owor CisgICAgRG9jdW1lbnQmIGRvY3VtZW50ID0gKm1fZG9jdW1lbnQ7CisgICAgYXV0byogZnJhbWUg PSBkb2N1bWVudC5mcmFtZSgpOworICAgIGlmICghZnJhbWUgfHwgIWZyYW1lLT52aWV3KCkgfHwg IW1fc3R5bGUpCiAgICAgICAgIHJldHVybiBtX2ZhbGxiYWNrUmVzdWx0OwogCiAgICAgaWYgKCFl eHByZXNzaW9uLmlzVmFsaWQoKSkKQEAgLTc4NywxMCArNzkyLDkgQEAgYm9vbCBNZWRpYVF1ZXJ5 RXZhbHVhdG9yOjpldmFsdWF0ZShjb25zdAogICAgIGlmICghZnVuY3Rpb24pCiAgICAgICAgIHJl dHVybiBmYWxzZTsKIAotICAgIERvY3VtZW50JiBkb2N1bWVudCA9ICptX2ZyYW1lLT5kb2N1bWVu dCgpOwogICAgIGlmICghZG9jdW1lbnQuZG9jdW1lbnRFbGVtZW50KCkpCiAgICAgICAgIHJldHVy biBmYWxzZTsKLSAgICByZXR1cm4gZnVuY3Rpb24oZXhwcmVzc2lvbi52YWx1ZSgpLCB7IG1fc3R5 bGUsIGRvY3VtZW50LmRvY3VtZW50RWxlbWVudCgpLT5yZW5kZXJTdHlsZSgpLCBkb2N1bWVudC5y ZW5kZXJWaWV3KCksIDEsIGZhbHNlIH0sICptX2ZyYW1lLCBOb1ByZWZpeCk7CisgICAgcmV0dXJu IGZ1bmN0aW9uKGV4cHJlc3Npb24udmFsdWUoKSwgeyBtX3N0eWxlLCBkb2N1bWVudC5kb2N1bWVu dEVsZW1lbnQoKS0+cmVuZGVyU3R5bGUoKSwgZG9jdW1lbnQucmVuZGVyVmlldygpLCAxLCBmYWxz ZSB9LCAqZnJhbWUsIE5vUHJlZml4KTsKIH0KIAogYm9vbCBNZWRpYVF1ZXJ5RXZhbHVhdG9yOjpt ZWRpYUF0dHJpYnV0ZU1hdGNoZXMoRG9jdW1lbnQmIGRvY3VtZW50LCBjb25zdCBTdHJpbmcmIGF0 dHJpYnV0ZVZhbHVlKQpJbmRleDogU291cmNlL1dlYkNvcmUvY3NzL01lZGlhUXVlcnlFdmFsdWF0 b3IuaAo9PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09Ci0tLSBTb3VyY2UvV2ViQ29yZS9jc3MvTWVkaWFRdWVyeUV2YWx1YXRv ci5oCShyZXZpc2lvbiAyMjY5NzApCisrKyBTb3VyY2UvV2ViQ29yZS9jc3MvTWVkaWFRdWVyeUV2 YWx1YXRvci5oCSh3b3JraW5nIGNvcHkpCkBAIC0yOCw2ICsyOCw3IEBACiAjcHJhZ21hIG9uY2UK IAogI2luY2x1ZGUgIk1lZGlhUXVlcnlFeHByZXNzaW9uLmgiCisjaW5jbHVkZSA8d3RmL1dlYWtQ dHIuaD4KIAogbmFtZXNwYWNlIFdlYkNvcmUgewogCkBAIC03NCw3ICs3NSw3IEBAIHB1YmxpYzoK IAogcHJpdmF0ZToKICAgICBTdHJpbmcgbV9tZWRpYVR5cGU7Ci0gICAgRnJhbWUqIG1fZnJhbWUg eyBudWxscHRyIH07IC8vIG5vdCBvd25lZAorICAgIFdlYWtQdHI8RG9jdW1lbnQ+IG1fZG9jdW1l bnQ7CiAgICAgY29uc3QgUmVuZGVyU3R5bGUqIG1fc3R5bGUgeyBudWxscHRyIH07CiAgICAgYm9v bCBtX2ZhbGxiYWNrUmVzdWx0IHsgZmFsc2UgfTsKIH07CkluZGV4OiBTb3VyY2UvV2ViQ29yZS9k b20vRG9jdW1lbnQuY3BwCj09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT0KLS0tIFNvdXJjZS9XZWJDb3JlL2RvbS9Eb2N1bWVu dC5jcHAJKHJldmlzaW9uIDIyNjk3MCkKKysrIFNvdXJjZS9XZWJDb3JlL2RvbS9Eb2N1bWVudC5j cHAJKHdvcmtpbmcgY29weSkKQEAgLTIzNjAsNiArMjM2MCw4IEBAIHZvaWQgRG9jdW1lbnQ6OnBy ZXBhcmVGb3JEZXN0cnVjdGlvbigpCiAgICAgaWYgKG1fZG9tV2luZG93ICYmIG1fZnJhbWUpCiAg ICAgICAgIG1fZG9tV2luZG93LT53aWxsRGV0YWNoRG9jdW1lbnRGcm9tRnJhbWUoKTsKIAorICAg IHN0eWxlU2NvcGUoKS5jbGVhclJlc29sdmVyKCk7CisKICAgICBpZiAoaGFzTGl2aW5nUmVuZGVy VHJlZSgpKQogICAgICAgICBkZXN0cm95UmVuZGVyVHJlZSgpOwogCkluZGV4OiBMYXlvdXRUZXN0 cy9DaGFuZ2VMb2cKPT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PQotLS0gTGF5b3V0VGVzdHMvQ2hhbmdlTG9nCShyZXZpc2lv biAyMjY5NzApCisrKyBMYXlvdXRUZXN0cy9DaGFuZ2VMb2cJKHdvcmtpbmcgY29weSkKQEAgLTEs MyArMSwxNCBAQAorMjAxOC0wMS0xNyAgQW50dGkgS29pdmlzdG8gIDxhbnR0aUBhcHBsZS5jb20+ CisKKyAgICAgICAgUkVHUkVTU0lPTiAocjIyNjM4NT8pOiBDcmFzaCBpbiBjb20uYXBwbGUuV2Vi Q29yZTogV2ViQ29yZTo6TWVkaWFRdWVyeUV2YWx1YXRvcjo6ZXZhbHVhdGUgY29uc3QgKyAzMgor ICAgICAgICBodHRwczovL2J1Z3Mud2Via2l0Lm9yZy9zaG93X2J1Zy5jZ2k/aWQ9MTgxNzQyCisg ICAgICAgIDxyZGFyOi8vcHJvYmxlbS8zNjMzNDcyNj4KKworICAgICAgICBSZXZpZXdlZCBieSBO T0JPRFkgKE9PUFMhKS4KKworICAgICAgICAqIGZhc3QvbWVkaWEvbWVkaWFxdWVyeWV2YWx1YXRv ci1jcmFzaC1leHBlY3RlZC50eHQ6IEFkZGVkLgorICAgICAgICAqIGZhc3QvbWVkaWEvbWVkaWFx dWVyeWV2YWx1YXRvci1jcmFzaC5odG1sOiBBZGRlZC4KKwogMjAxOC0wMS0xNiAgWWFjaW5lIEJh bmRvdSAgPHlhY2luZS5iYW5kb3VfZXh0QHNvZnRhdGhvbWUuY29tPgogCiAgICAgICAgIFtFTUVd IEFkZCBsYXlvdXQgdGVzdCBmb3IgdGhlIE1TRSBwbGF5YmFjayBvZiBDbGVhcktleSBlbmNyeXB0 ZWQgYXVkaW8gYW5kIHZpZGVvCkluZGV4OiBMYXlvdXRUZXN0cy9mYXN0L21lZGlhL21lZGlhcXVl cnlldmFsdWF0b3ItY3Jhc2gtZXhwZWN0ZWQudHh0Cj09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT0KLS0tIExheW91dFRlc3Rz L2Zhc3QvbWVkaWEvbWVkaWFxdWVyeWV2YWx1YXRvci1jcmFzaC1leHBlY3RlZC50eHQJKG5vbmV4 aXN0ZW50KQorKysgTGF5b3V0VGVzdHMvZmFzdC9tZWRpYS9tZWRpYXF1ZXJ5ZXZhbHVhdG9yLWNy YXNoLWV4cGVjdGVkLnR4dAkod29ya2luZyBjb3B5KQpAQCAtMCwwICsxIEBACitQQVNTCkluZGV4 OiBMYXlvdXRUZXN0cy9mYXN0L21lZGlhL21lZGlhcXVlcnlldmFsdWF0b3ItY3Jhc2guaHRtbAo9 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09Ci0tLSBMYXlvdXRUZXN0cy9mYXN0L21lZGlhL21lZGlhcXVlcnlldmFsdWF0b3It Y3Jhc2guaHRtbAkobm9uZXhpc3RlbnQpCisrKyBMYXlvdXRUZXN0cy9mYXN0L21lZGlhL21lZGlh cXVlcnlldmFsdWF0b3ItY3Jhc2guaHRtbAkod29ya2luZyBjb3B5KQpAQCAtMCwwICsxLDEwIEBA Cis8IURPQ1RZUEUgaHRtbD4KKzxpZnJhbWUgaWQ9IndlYnRlc3QwIj48L2lmcmFtZT4KKzxzY3Jp cHQgaWQ9IndlYnRlc3QxIj4KK2lmICh3aW5kb3cudGVzdFJ1bm5lcikKKyAgICB0ZXN0UnVubmVy LmR1bXBBc1RleHQoKTsKK2ZyYW1lZG9jID0gZnJhbWVzWzBdLmRvY3VtZW50LmRvY3VtZW50RWxl bWVudDsKK2RvY3VtZW50LmJvZHkuaW5uZXJUZXh0ID0gJ1BBU1MnOworZnJhbWVkb2MuaW5uZXJI VE1MID0gJzx0aXRsZT4nOworZnJhbWVkb2MuZ2V0RWxlbWVudHNCeVRhZ05hbWUoJ3RpdGxlJylb MF0uaW5uZXJUZXh0ID0gJ2EnOworPC9zY3JpcHQ+Cg==