59671 2011-04-27 21:17:59 -0700 Race condition with scrollbar animations and closing a page can cause a crash in WebCore::FrameView::setVisibleScrollerThumbRect + 15 2011-04-27 21:32:53 -0700 1 1 1 Unclassified WebKit Layout and Rendering 528+ (Nightly build) PC OS X 10.5 RESOLVED FIXED InRadar P2 Normal --- 1 bdakin bdakin bdakin oldest_to_newest 394176 0 bdakin 2011-04-27 21:17:59 -0700 I have not been able to catch it in a debugger, but there are numerous reports indicating a crash in WebCore::FrameView::setVisibleScrollerThumbRect(). Looks like we are de-referencing page. Patch forthcoming. <rdar://problem/9329253> 394177 1 91423 bdakin 2011-04-27 21:21:15 -0700 Created attachment 91423 Patch 394182 2 bdakin 2011-04-27 21:32:53 -0700 Thanks Dan! Committed fix with revision 85147. 91423 2011-04-27 21:21:15 -0700 2011-04-27 21:29:26 -0700 Patch for-review.txt text/plain 2161 bdakin SW5kZXg6IFNvdXJjZS9XZWJDb3JlL0NoYW5nZUxvZwo9PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09Ci0tLSBTb3VyY2UvV2Vi Q29yZS9DaGFuZ2VMb2cJKHJldmlzaW9uIDg1MTQ1KQorKysgU291cmNlL1dlYkNvcmUvQ2hhbmdl TG9nCSh3b3JraW5nIGNvcHkpCkBAIC0xLDMgKzEsMjAgQEAKKzIwMTEtMDQtMjcgIEJldGggRGFr aW4gIDxiZGFraW5AYXBwbGUuY29tPgorCisgICAgICAgIFJldmlld2VkIGJ5IE5PQk9EWSAoT09Q UyEpLgorCisgICAgICAgIGh0dHBzOi8vYnVncy53ZWJraXQub3JnL3Nob3dfYnVnLmNnaT9pZD01 OTY3MQorICAgICAgICBSYWNlIGNvbmRpdGlvbiB3aXRoIHNjcm9sbGJhciBhbmltYXRpb25zIGFu ZCBjbG9zaW5nIGEgcGFnZSBjYW4gY2F1c2UgYSBjcmFzaCBpbiAKKyAgICAgICAgV2ViQ29yZTo6 RnJhbWVWaWV3OjpzZXRWaXNpYmxlU2Nyb2xsZXJUaHVtYlJlY3QgKyAxNQorICAgICAgICAtYW5k IGNvcnJlc3BvbmRpbmctCisgICAgICAgIDxyZGFyOi8vcHJvYmxlbS85MzI5MjUzPgorCisgICAg ICAgIEl0IGlzIGRlZmluaXRlbHkgcG9zc2libGUgZm9yIFBhZ2UgdG8gYmUgbnVsbCBoZXJlLiBT byB3ZSBzaG91bGQgbnVsbC1jaGVjayBpdCEgCisgICAgICAgIEFuZCB3ZSBzaG91bGQgbm90IEFT U0VSVC4KKyAgICAgICAgKiBwYWdlL0ZyYW1lVmlldy5jcHA6CisgICAgICAgIChXZWJDb3JlOjpG cmFtZVZpZXc6OmRpZENvbXBsZXRlUnViYmVyQmFuZCk6CisgICAgICAgIChXZWJDb3JlOjpGcmFt ZVZpZXc6OnNjcm9sbGJhclN0eWxlQ2hhbmdlZCk6CisgICAgICAgIChXZWJDb3JlOjpGcmFtZVZp ZXc6OnNldFZpc2libGVTY3JvbGxlclRodW1iUmVjdCk6CisKIDIwMTEtMDQtMjcgIE1hcmsgUGls Z3JpbSAgPHBpbGdyaW1AY2hyb21pdW0ub3JnPgogCiAgICAgICAgIFJldmlld2VkIGJ5IFRvbnkg Q2hhbmcuCkluZGV4OiBTb3VyY2UvV2ViQ29yZS9wYWdlL0ZyYW1lVmlldy5jcHAKPT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PQotLS0gU291cmNlL1dlYkNvcmUvcGFnZS9GcmFtZVZpZXcuY3BwCShyZXZpc2lvbiA4NDk5MCkK KysrIFNvdXJjZS9XZWJDb3JlL3BhZ2UvRnJhbWVWaWV3LmNwcAkod29ya2luZyBjb3B5KQpAQCAt MjEzNSw2ICsyMTM1LDggQEAgSW50UmVjdCBGcmFtZVZpZXc6OndpbmRvd1Jlc2l6ZXJSZWN0KCkg Ywogdm9pZCBGcmFtZVZpZXc6OmRpZENvbXBsZXRlUnViYmVyQmFuZChjb25zdCBJbnRTaXplJiBp bml0aWFsT3ZlcmhhbmcpIGNvbnN0CiB7CiAgICAgUGFnZSogcGFnZSA9IG1fZnJhbWUtPnBhZ2Uo KTsKKyAgICBpZiAoIXBhZ2UpCisgICAgICAgIHJldHVybjsKICAgICBpZiAocGFnZS0+bWFpbkZy YW1lKCkgIT0gbV9mcmFtZSkKICAgICAgICAgcmV0dXJuOwogICAgIHJldHVybiBwYWdlLT5jaHJv bWUoKS0+Y2xpZW50KCktPmRpZENvbXBsZXRlUnViYmVyQmFuZEZvck1haW5GcmFtZShpbml0aWFs T3ZlcmhhbmcpOwpAQCAtMjE0Myw3ICsyMTQ1LDYgQEAgdm9pZCBGcmFtZVZpZXc6OmRpZENvbXBs ZXRlUnViYmVyQmFuZChjbwogdm9pZCBGcmFtZVZpZXc6OnNjcm9sbGJhclN0eWxlQ2hhbmdlZCgp CiB7CiAgICAgUGFnZSogcGFnZSA9IG1fZnJhbWUtPnBhZ2UoKTsKLSAgICBBU1NFUlQocGFnZSk7 CiAgICAgaWYgKCFwYWdlKQogICAgICAgICByZXR1cm47CiAgICAgcGFnZS0+c2V0TmVlZHNSZWNh bGNTdHlsZUluQWxsRnJhbWVzKCk7CkBAIC0yMTUyLDcgKzIxNTMsOCBAQCB2b2lkIEZyYW1lVmll dzo6c2Nyb2xsYmFyU3R5bGVDaGFuZ2VkKCkKIHZvaWQgRnJhbWVWaWV3OjpzZXRWaXNpYmxlU2Ny b2xsZXJUaHVtYlJlY3QoY29uc3QgSW50UmVjdCYgc2Nyb2xsZXJUaHVtYikKIHsKICAgICBQYWdl KiBwYWdlID0gbV9mcmFtZS0+cGFnZSgpOwotICAgIEFTU0VSVChwYWdlKTsKKyAgICBpZiAoIXBh Z2UpCisgICAgICAgIHJldHVybjsKICAgICBpZiAocGFnZS0+bWFpbkZyYW1lKCkgIT0gbV9mcmFt ZSkKICAgICAgICAgcmV0dXJuOwogICAgIHJldHVybiBwYWdlLT5jaHJvbWUoKS0+Y2xpZW50KCkt Pm5vdGlmeVNjcm9sbGVyVGh1bWJJc1Zpc2libGVJblJlY3Qoc2Nyb2xsZXJUaHVtYik7Cg==