Bug 149308

Summary: Null dereference loading Blink layout test fast/parser/iframe-onload-document-close-with-external-script-2.html
Product: WebKit Reporter: Jon Honeycutt <jhoneycutt>
Component: Page LoadingAssignee: Nobody <webkit-unassigned>
Status: RESOLVED WORKSFORME    
Severity: Normal CC: bfulgham, jhoneycutt, jiewen_tan, webkit-bug-importer
Priority: P2 Keywords: BlinkMergeCandidate, HasReduction, InRadar
Version: WebKit Nightly Build   
Hardware: Unspecified   
OS: Unspecified   
Attachments:
Description Flags
crashing test none

Jon Honeycutt
Reported 2015-09-17 15:45:17 PDT
Created attachment 261445 [details] crashing test Null dereference loading Blink layout test fast/parser/iframe-onload-document-close-with-external-script-2.html. Stack trace: Crashed Thread: 0 Dispatch queue: com.apple.main-thread Exception Type: EXC_BAD_ACCESS (SIGSEGV) Exception Codes: KERN_INVALID_ADDRESS at 0x0000000000000000 Exception Note: EXC_CORPSE_NOTIFY VM Regions Near 0: --> __TEXT 0000000105471000-0000000105473000 [ 8K] r-x/rwx SM=COW /Users/USER/*/WebKit.framework/Versions/A/XPCServices/com.apple.WebKit.WebContent.Development.xpc/Contents/MacOS/com.apple.WebKit.WebContent.Development Application Specific Information: CRASHING TEST: temp-tests/fast/parser/iframe-onload-document-close-with-external-script-2.html Global Trace Buffer (reverse chronological seconds): 18.407070 CFNetwork 0x00007fff88d43b97 Explicitly setting CF cookie storage singleton 18.407452 CFNetwork 0x00007fff88d8f211 Explicitly setting cookie storage singleton Thread 0 Crashed:: Dispatch queue: com.apple.main-thread 0 com.apple.WebCore 0x000000010d4674a1 WebCore::DocumentMarkerController::detach() + 17 (HashTable.h:1202) 1 com.apple.WebCore 0x000000010d434948 WebCore::Document::removedLastRef() + 488 (HashTable.h:1202) 2 com.apple.JavaScriptCore 0x000000010cbc0a28 JSC::MarkedBlock::FreeList JSC::MarkedBlock::specializedSweep<(JSC::MarkedBlock::BlockState)3, (JSC::MarkedBlock::SweepMode)1, true>() + 184 (JSCell.h:151) 3 com.apple.JavaScriptCore 0x000000010cbc06bd JSC::MarkedBlock::FreeList JSC::MarkedBlock::sweepHelper<true>(JSC::MarkedBlock::SweepMode) + 173 (MarkedBlock.cpp:145) 4 com.apple.JavaScriptCore 0x000000010cbc016b JSC::MarkedBlock::sweep(JSC::MarkedBlock::SweepMode) + 75 (MarkedBlock.cpp:126) 5 com.apple.JavaScriptCore 0x000000010cbbf3d1 JSC::MarkedAllocator::allocateSlowCase(unsigned long) + 225 (MarkedAllocator.cpp:74) 6 com.apple.JavaScriptCore 0x000000010cb4f1aa JSC::InferredValue::create(JSC::VM&) + 154 (MarkedAllocator.h:94) 7 com.apple.JavaScriptCore 0x000000010c958277 JSC::FunctionExecutable::finishCreation(JSC::VM&) + 39 (WriteBarrierInlines.h:54) 8 com.apple.JavaScriptCore 0x000000010cb91c80 JSC::UnlinkedFunctionExecutable::link(JSC::VM&, JSC::SourceCode const&, int) + 336 (Executable.h:621) 9 com.apple.JavaScriptCore 0x000000010caebfb6 JSC::JSGlobalObject::init(JSC::VM&) + 32566 (JSGlobalObject.cpp:526) 10 com.apple.WebCore 0x000000010d86ac89 JSC::JSGlobalObject::finishCreation(JSC::VM&, JSC::JSObject*) + 201 (JSGlobalObject.h:371) 11 com.apple.WebCore 0x000000010d8b8456 WebCore::JSDOMWindowBase::finishCreation(JSC::VM&, WebCore::JSDOMWindowShell*) + 38 (JSDOMWindowBase.cpp:75) 12 com.apple.WebCore 0x000000010d8bd96e WebCore::JSDOMWindowShell::setWindow(WTF::PassRefPtr<WebCore::DOMWindow>) + 558 (JSDOMWindow.h:40) 13 com.apple.WebCore 0x000000010decddea WebCore::ScriptController::clearWindowShell(WebCore::DOMWindow*, bool) + 314 (StdLibExtras.h:366) 14 com.apple.WebCore 0x000000010d5c5e16 WebCore::FrameLoader::clear(WebCore::Document*, bool, bool, bool) + 294 (FrameLoader.cpp:621) 15 com.apple.WebCore 0x000000010d4753f5 WebCore::DocumentWriter::begin(WebCore::URL const&, bool, WebCore::Document*) + 309 (StdLibExtras.h:366) 16 com.apple.WebCore 0x000000010d45de75 WebCore::DocumentLoader::commitData(char const*, unsigned long) + 181 (StdLibExtras.h:366) 17 com.apple.WebKit 0x000000010ba85b42 WebKit::WebFrameLoaderClient::committedLoad(WebCore::DocumentLoader*, char const*, int) + 50 (WebFrameLoaderClient.cpp:946) 18 com.apple.WebCore 0x000000010d45fb01 WebCore::DocumentLoader::commitLoad(char const*, int) + 145 (DocumentLoader.h:225) 19 com.apple.WebCore 0x000000010d28a250 WebCore::CachedRawResource::notifyClientsDataWasReceived(char const*, unsigned int) + 160 (CachedResourceClientWalker.h:51) 20 com.apple.WebCore 0x000000010d28a121 WebCore::CachedRawResource::addDataBuffer(WebCore::SharedBuffer&) + 145 (CachedRawResource.cpp:70) 21 com.apple.WebCore 0x000000010e004f8a WebCore::SubresourceLoader::didReceiveDataOrBuffer(char const*, int, WTF::PassRefPtr<WebCore::SharedBuffer>, long long, WebCore::DataPayloadType) + 218 (SubresourceLoader.cpp:292) 22 com.apple.WebCore 0x000000010e004e73 WebCore::SubresourceLoader::didReceiveData(char const*, unsigned int, long long, WebCore::DataPayloadType) + 35 (StdLibExtras.h:366) 23 com.apple.WebKit 0x000000010bb4b85d WebKit::WebResourceLoader::didReceiveWebResourceLoaderMessage(IPC::Connection&, IPC::MessageDecoder&) + 257 (HandleMessage.h:16) 24 com.apple.WebKit 0x000000010b9251f1 IPC::Connection::dispatchMessage(std::__1::unique_ptr<IPC::MessageDecoder, std::__1::default_delete<IPC::MessageDecoder> >) + 127 (memory:2636) 25 com.apple.WebKit 0x000000010b927b4a IPC::Connection::dispatchOneMessage() + 126 (memory:2656) 26 com.apple.JavaScriptCore 0x000000010cd69985 WTF::RunLoop::performWork() + 437 (functional:1742) 27 com.apple.JavaScriptCore 0x000000010cd69d32 WTF::RunLoop::performWork(void*) + 34 (RunLoopCF.cpp:39) 28 com.apple.CoreFoundation 0x00007fff949e2c01 __CFRUNLOOP_IS_CALLING_OUT_TO_A_SOURCE0_PERFORM_FUNCTION__ + 17 29 com.apple.CoreFoundation 0x00007fff949d4b1c __CFRunLoopDoSources0 + 556 30 com.apple.CoreFoundation 0x00007fff949d403f __CFRunLoopRun + 927 31 com.apple.CoreFoundation 0x00007fff949d3a38 CFRunLoopRunSpecific + 296 32 com.apple.HIToolbox 0x00007fff88e673bd RunCurrentEventLoopInMode + 235 33 com.apple.HIToolbox 0x00007fff88e67153 ReceiveNextEventCommon + 432 34 com.apple.HIToolbox 0x00007fff88e66f93 _BlockUntilNextEventMatchingListInModeWithFilter + 71 35 com.apple.AppKit 0x00007fff870b81e7 _DPSNextEvent + 1076 36 com.apple.AppKit 0x00007fff8748490d -[NSApplication _nextEventMatchingEventMask:untilDate:inMode:dequeue:] + 454 37 com.apple.AppKit 0x00007fff870ae0b8 -[NSApplication run] + 682 38 com.apple.AppKit 0x00007fff87030396 NSApplicationMain + 1176 39 libxpc.dylib 0x00007fff8c70ff70 _xpc_objc_main + 793 40 libxpc.dylib 0x00007fff8c7116bf xpc_main + 494 41 com.apple.WebKit.WebContent.Development 0x0000000105472424 main + 409 (XPCServiceMain.Development.mm:187) 42 libdyld.dylib 0x00007fff93aa15ad start + 1
Attachments
crashing test (230 bytes, text/html)
2015-09-17 15:45 PDT, Jon Honeycutt 		no flags
Details
View All Add attachment proposed patch, testcase, etc.
Radar WebKit Bug Importer
Comment 1 2015-09-17 15:45:41 PDT
<rdar://problem/22748197>
Jiewen Tan
Comment 2 2015-11-03 15:03:37 PST
It seems like this is a test case from WebKit. It is related to Bug 53689.
Brent Fulgham
Comment 3 2016-01-08 17:04:53 PST
We have not been able to reproduce this problem under current WebKit. We think other work during this cycle has resolved the issue, but I cannot identify what those changes were.
Note You need to log in before you can comment on or make changes to this bug.