99543 2012-10-16 22:42:29 -0700 Crash on Frame::inScope() part 2 2012-10-17 01:00:25 -0700 1 1 1 Unclassified WebKit DOM 528+ (Nightly build) Unspecified Unspecified RESOLVED FIXED P2 Normal --- 1 morrita morrita tkent webkit.review.bot oldest_to_newest 743868 0 morrita 2012-10-16 22:42:29 -0700 This upstreams http://code.google.com/p/chromium/issues/detail?id=155343 Relevant strack trace: 0x7f0e78388d30 [chrome] - third_party/WebKit/Source/WebCore/dom/Node.cpp:460] WebCore::Node::treeScope 0x7f0e78c830a7 [chrome] - third_party/WebKit/Source/WebCore/page/Frame.cpp:242] WebCore::Frame::inScope 0x7f0e78c85932 [chrome] - third_party/WebKit/Source/WebCore/page/FrameTree.cpp:199] WebCore::FrameTree::scopedChildCount 0x7f0e790b57e8 [chrome] - out/Release/obj/gen/webcore/bindings/V8DOMWindow.cpp:854] WebCore::DOMWindowV8Internal::lengthAttrGetter 0x7f0e786142ee [chrome] - v8/src/objects.cc:207] v8::internal::JSObject::GetPropertyWithCallback 0x7f0e7879f461 [chrome] - v8/src/ic.cc:934] v8::internal::LoadIC::Load 0x7f0e7879fbc9 [chrome] - v8/src/ic.cc:2088] v8::internal::LoadIC_Miss 0x33349f60618d I made a shot at http://trac.webkit.org/changeset/130006 but it looks I missed. 743889 1 169096 morrita 2012-10-16 23:23:08 -0700 Created attachment 169096 Patch 743890 2 morrita 2012-10-16 23:23:35 -0700 Keent-san, could you take a look? 743891 3 169096 tkent 2012-10-16 23:25:04 -0700 Comment on attachment 169096 Patch Looks ok 743980 4 169096 webkit.review.bot 2012-10-17 01:00:21 -0700 Comment on attachment 169096 Patch Clearing flags on attachment: 169096 Committed r131561: <http://trac.webkit.org/changeset/131561> 743981 5 webkit.review.bot 2012-10-17 01:00:25 -0700 All reviewed patches have been landed. Closing bug. 169096 2012-10-16 23:23:08 -0700 2012-10-17 01:00:21 -0700 Patch bug-99543-20121017152155.patch text/plain 1571 morrita U3VidmVyc2lvbiBSZXZpc2lvbjogMTMxNTQ2CmRpZmYgLS1naXQgYS9Tb3VyY2UvV2ViQ29yZS9D aGFuZ2VMb2cgYi9Tb3VyY2UvV2ViQ29yZS9DaGFuZ2VMb2cKaW5kZXggZTM3NDM3ZmYzMWFhNzU0 NzhmYTZkMTJhYjA1MTZjMjQ2MjY5N2U1YS4uZDUwNWQyYjZjNmZhNzU5MWY2NmY3NDMzNjY3OTI1 ZTZhNjc0MGU3ZSAxMDA2NDQKLS0tIGEvU291cmNlL1dlYkNvcmUvQ2hhbmdlTG9nCisrKyBiL1Nv dXJjZS9XZWJDb3JlL0NoYW5nZUxvZwpAQCAtMSwzICsxLDE4IEBACisyMDEyLTEwLTE2ICBNT1JJ VEEgSGFqaW1lICA8bW9ycml0YUBnb29nbGUuY29tPgorCisgICAgICAgIENyYXNoIG9uIEZyYW1l OjppblNjb3BlKCkgcGFydCAyCisgICAgICAgIGh0dHBzOi8vYnVncy53ZWJraXQub3JnL3Nob3df YnVnLmNnaT9pZD05OTU0MworCisgICAgICAgIFJldmlld2VkIGJ5IE5PQk9EWSAoT09QUyEpLgor CisgICAgICAgIEZyYW1lVHJlZTo6c2NvcGVkQ2hpbGRDb3VudCgpIGNhbiBiZSBjYWxsZWQgZXZl biB3aGVuIHRoZSBvbmUgb2YgY2hpbGQgZnJhbWVzCisgICAgICAgIGlzIGluIG9ycGhhbiBzdGF0 ZS4gVGhpcyBjaGFuZ2UgYWRkZWQgYSBndWFyZCBmb3IgdGhhdCBjYXNlLgorCisgICAgICAgIE5v IG5ldyB0ZXN0cy4gQSBoYXJkLXRvLXRlc3QgdGltaW5nIGlzc3VlLgorCisgICAgICAgICogcGFn ZS9GcmFtZS5jcHA6CisgICAgICAgIChXZWJDb3JlOjpGcmFtZTo6aW5TY29wZSk6CisKIDIwMTIt MTAtMTYgIEp1bGllbiBDaGFmZnJhaXggIDxqY2hhZmZyYWl4QHdlYmtpdC5vcmc+CiAKICAgICAg ICAgTWFrZSBSZW5kZXJPYmplY3QgZGVzdHJ1Y3Rpb24gZHVyaW5nIGRldGFjaCBhIHRvcC1kb3du IG9wZXJhdGlvbgpkaWZmIC0tZ2l0IGEvU291cmNlL1dlYkNvcmUvcGFnZS9GcmFtZS5jcHAgYi9T b3VyY2UvV2ViQ29yZS9wYWdlL0ZyYW1lLmNwcAppbmRleCA2MjA1ZmE2Y2UxMmYyNTA4OTEwZDU5 YTQyZjU0M2JiZWVjOWMyYjliLi4xOTI1NGM4YzRiODJiYTc5MmQ3MGE4MTM0NDUzNTM3MDgyNjcy ZDdlIDEwMDY0NAotLS0gYS9Tb3VyY2UvV2ViQ29yZS9wYWdlL0ZyYW1lLmNwcAorKysgYi9Tb3Vy Y2UvV2ViQ29yZS9wYWdlL0ZyYW1lLmNwcApAQCAtMjM2LDkgKzIzNiwxMiBAQCBGcmFtZTo6fkZy YW1lKCkKIGJvb2wgRnJhbWU6OmluU2NvcGUoVHJlZVNjb3BlKiBzY29wZSkgY29uc3QKIHsKICAg ICBBU1NFUlQoc2NvcGUpOwotICAgIEhUTUxGcmFtZU93bmVyRWxlbWVudCogb3duZXIgPSBkb2N1 bWVudCgpLT5vd25lckVsZW1lbnQoKTsKLSAgICAvLyBTY29waW5nIHRlc3Qgc2hvdWxkIGJlIGRv bmUgb25seSBmb3IgY2hpbGQgZnJhbWVzLgotICAgIEFTU0VSVChvd25lcik7CisgICAgRG9jdW1l bnQqIGRvYyA9IGRvY3VtZW50KCk7CisgICAgaWYgKCFkb2MpCisgICAgICAgIHJldHVybiBmYWxz ZTsKKyAgICBIVE1MRnJhbWVPd25lckVsZW1lbnQqIG93bmVyID0gZG9jLT5vd25lckVsZW1lbnQo KTsKKyAgICBpZiAoIW93bmVyKQorICAgICAgICByZXR1cm4gZmFsc2U7CiAgICAgcmV0dXJuIG93 bmVyLT50cmVlU2NvcGUoKSA9PSBzY29wZTsKIH0KIAo=