Bug 138744

Summary:	Crash in WebCore::WebVideoFullscreenModelMediaElement::updateForEventName
Product:	WebKit	Reporter:	Stuart Morgan <stuartmorgan>
Component:	WebCore Misc.	Assignee:	Nobody <webkit-unassigned>
Status:	RESOLVED DUPLICATE
Severity:	Critical	CC:	ap
Priority:	P2
Version:	528+ (Nightly build)
Hardware:	iPhone / iPad
OS:	iOS 8.1

Description Stuart Morgan 2014-11-14 10:47:55 PST

The top crash for Chrome on iOS is a video-related crash with a stack that looks like:
Thread 19 CRASHED [EXC_BAD_ACCESS / KERN_PROTECTION_FAILURE @ 0x0d1de408] MAGIC SIGNATURE THREAD
0x0d1de408		
0x368f3cdf	[WebCore + 0x00a5dcdf ]	WebCore::WebVideoFullscreenModelMediaElement::updateForEventName(WTF::AtomicString const&)
0x35fc9389	[WebCore + 0x00133389 ]	WebCore::EventTarget::fireEventListeners(WebCore::Event*, WebCore::EventTargetData*, WTF::Vector<WebCore::RegisteredEventListener, 1ul, WTF::CrashOnOverflow>&)
0x35f253a9	[WebCore + 0x0008f3a9 ]	WebCore::EventTarget::fireEventListeners(WebCore::Event*)
0x36214a5f	[WebCore + 0x0037ea5f ]	WebCore::EventContext::handleLocalEvents(WebCore::Event&) const
0x36215297	[WebCore + 0x0037f297 ]	WebCore::EventDispatcher::dispatchEvent(WebCore::Node*, WTF::PassRefPtr<WebCore::Event>)
0x35f2523b	[WebCore + 0x0008f23b ]	WebCore::Node::dispatchEvent(WTF::PassRefPtr<WebCore::Event>)
0x36280ccb	[WebCore + 0x003eaccb ]	WebCore::GenericEventQueue::timerFired(WebCore::Timer<WebCore::GenericEventQueue>&)
0x35eb408b	[WebCore + 0x0001e08b ]	WebCore::ThreadTimers::sharedTimerFiredInternal()
0x35eb3fe7	[WebCore + 0x0001dfe7 ]	WebCore::timerFired(__CFRunLoopTimer*, void*)
0x2b22fea5	[CoreFoundation + 0x000caea5 ]	__CFRUNLOOP_IS_CALLING_OUT_TO_A_TIMER_CALLBACK_FUNCTION__
0x2b22fa21	[CoreFoundation + 0x000caa21 ]	__CFRunLoopDoTimer
0x2b22dc71	[CoreFoundation + 0x000c8c71 ]	__CFRunLoopRun
0x2b17ca1f	[CoreFoundation + 0x00017a1f ]	CFRunLoopRunSpecific
0x2b17c831	[CoreFoundation + 0x00017831 ]	CFRunLoopRunInMode
0x35f19391	[WebCore + 0x00083391 ]	RunWebThread(void*)
0x38a10091	[libsystem_pthread.dylib + 0x00003091 ]	_pthread_body
0x38a10005	[libsystem_pthread.dylib + 0x00003005 ]	_pthread_start
0x38a0de1e	[libsystem_pthread.dylib + 0x00000e1e ]	thread_start

A simple UIWebView-based application that loads videos in a loop will reproduce this crash. This happens in both 8.0 and 8.1; it's a severe regression since iOS 7.x.

This was also filed as rdar://17884046 and more details about reproduction are there.

Comment 1 Alexey Proskuryakov 2014-11-15 23:38:50 PST


*** This bug has been marked as a duplicate of bug 137123 ***