23470 2009-01-21 20:52:17 -0800 Crash when page load occurs while processing scroll event with mallocscribble enabled 2009-01-22 08:59:44 -0800 1 1 1 Unclassified WebKit WebCore Misc. 528+ (Nightly build) Mac OS X 10.5 RESOLVED FIXED P2 Normal --- 1 oliver oliver oldest_to_newest 106571 0 oliver 2009-01-21 20:52:17 -0800 I spotted a crash that occurs when a page load occurs in the middle of processing a scroll event that has been propagated to a subframe that is destroyed by the page load. Alas reproducing requires malloc scribble, and a timer driven load independent of webcore. 106572 1 26922 oliver 2009-01-21 21:01:32 -0800 Created attachment 26922 Add a protector Simple fix 106573 2 26922 hyatt 2009-01-21 21:12:26 -0800 Comment on attachment 26922 Add a protector r=me 106600 3 oliver 2009-01-22 08:59:44 -0800 Committing to http://svn.webkit.org/repository/webkit/trunk ... M WebCore/ChangeLog M WebCore/page/EventHandler.cpp Committed r40112 26922 2009-01-21 21:01:32 -0800 2009-01-21 21:12:26 -0800 Add a protector bug23470.patch text/plain 1587 oliver ZGlmZiAtLWdpdCBhL1dlYkNvcmUvQ2hhbmdlTG9nIGIvV2ViQ29yZS9DaGFuZ2VMb2cKaW5kZXgg MDk5OTk5OS4uYzI4MjAwOCAxMDA2NDQKLS0tIGEvV2ViQ29yZS9DaGFuZ2VMb2cKKysrIGIvV2Vi Q29yZS9DaGFuZ2VMb2cKQEAgLTEsMyArMSwxNyBAQAorMjAwOS0wMS0yMSAgT2xpdmVyIEh1bnQg IDxvbGl2ZXJAYXBwbGUuY29tPgorCisgICAgICAgIFJldmlld2VkIGJ5IE5PQk9EWSAoT09QUyEp LgorCisgICAgICAgIEJ1ZyAyMzQ3MDogQ3Jhc2ggd2hlbiBwYWdlIGxvYWQgb2NjdXJzIHdoaWxl IHByb2Nlc3Npbmcgc2Nyb2xsIGV2ZW50IHdpdGggTWFsbG9jU2NyaWJibGUgZW5hYmxlZAorICAg ICAgICA8aHR0cHM6Ly9idWdzLndlYmtpdC5vcmcvc2hvd19idWcuY2dpP2lkPTIzNDcwPgorCisg ICAgICAgIEFkZCBhIFJlZlB0ciBwcm90ZWN0b3IgdG8gaGFuZGxlV2hlZWxFdmVudCB0byBndWFy ZCBhZ2FpbnN0IGRlc3RydWN0aW9uCisgICAgICAgIHdoaWxlIHByb2Nlc3NpbmcgdGhlIHNjcm9s bCBldmVudC4gIEFsYXMgdGhlIGFic3VyZCBzZXQgb2YgY2lyY3Vtc3RhbmNlcworICAgICAgICBy ZXF1aXJlZCB0byB0cmlnZ2VyIHRoaXMgZG8gbm90IGFwcGVhciB0byBiZSByZXByb2R1Y2libGUg aW4gRFJULgorCisgICAgICAgICogcGFnZS9FdmVudEhhbmRsZXIuY3BwOgorICAgICAgICAoV2Vi Q29yZTo6RXZlbnRIYW5kbGVyOjpoYW5kbGVXaGVlbEV2ZW50KToKKwogMjAwOS0wMS0yMSAgQW5k ZXJzIENhcmxzc29uICA8YW5kZXJzY2FAYXBwbGUuY29tPgogCiAgICAgICAgIFJldmlld2VkIGJ5 IFNhbSBXZWluaWcuCmRpZmYgLS1naXQgYS9XZWJDb3JlL3BhZ2UvRXZlbnRIYW5kbGVyLmNwcCBi L1dlYkNvcmUvcGFnZS9FdmVudEhhbmRsZXIuY3BwCmluZGV4IGQ3Y2QzYTEuLmI5MWMyYTcgMTAw NjQ0Ci0tLSBhL1dlYkNvcmUvcGFnZS9FdmVudEhhbmRsZXIuY3BwCisrKyBiL1dlYkNvcmUvcGFn ZS9FdmVudEhhbmRsZXIuY3BwCkBAIC0xLDUgKzEsNSBAQAogLyoKLSAqIENvcHlyaWdodCAoQykg MjAwNiwgMjAwNywgMjAwOCBBcHBsZSBJbmMuIEFsbCByaWdodHMgcmVzZXJ2ZWQuCisgKiBDb3B5 cmlnaHQgKEMpIDIwMDYsIDIwMDcsIDIwMDgsIDIwMDkgQXBwbGUgSW5jLiBBbGwgcmlnaHRzIHJl c2VydmVkLgogICogQ29weXJpZ2h0IChDKSAyMDA2IEFsZXhleSBQcm9za3VyeWFrb3YgKGFwQHdl YmtpdC5vcmcpCiAgKgogICogUmVkaXN0cmlidXRpb24gYW5kIHVzZSBpbiBzb3VyY2UgYW5kIGJp bmFyeSBmb3Jtcywgd2l0aCBvciB3aXRob3V0CkBAIC0xNTc5LDYgKzE1NzksOCBAQCBib29sIEV2 ZW50SGFuZGxlcjo6aGFuZGxlV2hlZWxFdmVudChQbGF0Zm9ybVdoZWVsRXZlbnQmIGUpCiAgICAg UmVuZGVyT2JqZWN0KiBkb2NSZW5kZXJlciA9IGRvYy0+cmVuZGVyZXIoKTsKICAgICBpZiAoIWRv Y1JlbmRlcmVyKQogICAgICAgICByZXR1cm4gZmFsc2U7CisgICAgCisgICAgUmVmUHRyPEZyYW1l Vmlldz4gcHJvdGVjdG9yKG1fZnJhbWUtPnZpZXcoKSk7CiAKICAgICBJbnRQb2ludCB2UG9pbnQg PSBtX2ZyYW1lLT52aWV3KCktPndpbmRvd1RvQ29udGVudHMoZS5wb3MoKSk7CiAK