Bug 184950

Summary: Release assert in ScriptController::canExecuteScripts via CachedSVGFont::ensureCustomFontData during Document::updateStyleIfNeeded
Product: WebKit Reporter: Ryosuke Niwa <rniwa>
Component: WebCore Misc.Assignee: Ryosuke Niwa <rniwa>
Status: RESOLVED FIXED    
Severity: Normal CC: bfulgham, cdumez, dbates, ddkilzer, esprehn+autocc, ews-watchlist, japhet, kangil.han, koivisto, webkit-bug-importer, zalan
Priority: P2 Keywords: InRadar
Version: WebKit Nightly Build   
Hardware: Unspecified   
OS: Unspecified   
Attachments:
Description Flags
Fixes the crash zalan: review+

Description Ryosuke Niwa 2018-04-24 19:21:51 PDT
e.g.

Thread 0 Crashed:: Dispatch queue: com.apple.main-thread
0   com.apple.WebCore             	0x00000002e0025651 WebCore::ScriptController::canExecuteScripts(WebCore::ReasonForCallingCanExecuteScripts) + 529
1   com.apple.WebCore             	0x00000002e0ae15ba WebCore::JSEventListener::handleEvent(WebCore::ScriptExecutionContext&, WebCore::Event&) + 346
2   com.apple.WebCore             	0x00000002e0d108d1 WebCore::EventTarget::fireEventListeners(WebCore::Event&, WTF::Vector<WTF::RefPtr<WebCore::RegisteredEventListener, WTF::DumbPtrTraits<WebCore::RegisteredEventListener> >, 1ul, WTF::CrashOnOverflow, 16ul, WTF::FastMalloc>) + 801
3   com.apple.WebCore             	0x00000002e0d0d31d WebCore::EventTarget::fireEventListeners(WebCore::Event&) + 525
4   com.apple.WebCore             	0x00000002e0d0d0f8 WebCore::EventContext::handleLocalEvents(WebCore::Event&) const + 104
5   com.apple.WebCore             	0x00000002e0d0ddad WebCore::dispatchEventInDOM(WebCore::Event&, WebCore::EventPath const&) + 93
6   com.apple.WebCore             	0x00000002e0d0da88 WebCore::EventDispatcher::dispatchEvent(WebCore::Node&, WebCore::Event&) + 792
7   com.apple.WebCore             	0x00000002e007021f WebCore::Node::dispatchBeforeLoadEvent(WTF::String const&) + 127
8   com.apple.WebCore             	0x00000002e00c57e6 WebCore::ImageLoader::dispatchPendingBeforeLoadEvent() + 118
9   com.apple.WebCore             	0x00000002e00c962d WebCore::ImageLoader::dispatchPendingEvent(WebCore::EventSender<WebCore::ImageLoader>*) + 45
10  com.apple.WebCore             	0x00000002e005f107 WebCore::EventSender<WebCore::ImageLoader>::dispatchPendingEvents() + 151
11  com.apple.WebCore             	0x00000002e15057df WebCore::XMLDocumentParser::append(WTF::RefPtr<WTF::StringImpl, WTF::DumbPtrTraits<WTF::StringImpl> >&&) + 127
12  com.apple.WebCore             	0x00000002e0138a3b WebCore::Document::setContent(WTF::String const&) + 59
13  com.apple.WebCore             	0x00000002e0fea0bc WebCore::CachedSVGFont::ensureCustomFontData(WTF::AtomicString const&) + 364
14  com.apple.WebCore             	0x00000002e0bdbfd6 WebCore::CSSFontFaceSource::fontLoaded(WebCore::CachedFont&) + 86
15  com.apple.WebCore             	0x00000002e0bdbad7 WebCore::CSSFontFaceSource::CSSFontFaceSource(WebCore::CSSFontFace&, WTF::String const&, WebCore::CachedFont*, WebCore::SVGFontFaceElement*, WTF::RefPtr<JSC::ArrayBufferView, WTF::DumbPtrTraits<JSC::ArrayBufferView> >&&) + 183
16  com.apple.WebCore             	0x00000002e0bd2b68 WebCore::CSSFontFace::appendSources(WebCore::CSSFontFace&, WebCore::CSSValueList&, WebCore::Document*, bool) + 376
17  com.apple.WebCore             	0x00000002e0bdd5d3 WebCore::CSSFontSelector::addFontFaceRule(WebCore::StyleRuleFontFace&, bool) + 899
18  com.apple.WebCore             	0x00000002e0c2a498 WebCore::RuleSet::addChildRules(WTF::Vector<WTF::RefPtr<WebCore::StyleRuleBase, WTF::DumbPtrTraits<WebCore::StyleRuleBase> >, 0ul, WTF::CrashOnOverflow, 16ul, WTF::FastMalloc> const&, WebCore::MediaQueryEvaluator const&, WebCore::StyleResolver*, bool) + 392
19  com.apple.WebCore             	0x00000002e0c2a5c1 WebCore::RuleSet::addRulesFromSheet(WebCore::StyleSheetContents&, WebCore::MediaQueryEvaluator const&, WebCore::StyleResolver*) + 145
20  com.apple.WebCore             	0x00000002e0c0db81 WebCore::DocumentRuleSets::appendAuthorStyleSheets(WTF::Vector<WTF::RefPtr<WebCore::CSSStyleSheet, WTF::DumbPtrTraits<WebCore::CSSStyleSheet> >, 0ul, WTF::CrashOnOverflow, 16ul, WTF::FastMalloc> const&, WebCore::MediaQueryEvaluator*, WebCore::InspectorCSSOMWrappers&, WebCore::StyleResolver*) + 97
21  com.apple.WebCore             	0x00000002e0c3a58f WebCore::StyleResolver::appendAuthorStyleSheets(WTF::Vector<WTF::RefPtr<WebCore::CSSStyleSheet, WTF::DumbPtrTraits<WebCore::CSSStyleSheet> >, 0ul, WTF::CrashOnOverflow, 16ul, WTF::FastMalloc> const&) + 31
22  com.apple.WebCore             	0x00000002e13ef0d0 WebCore::Style::Scope::updateStyleResolver(WTF::Vector<WTF::RefPtr<WebCore::CSSStyleSheet, WTF::DumbPtrTraits<WebCore::CSSStyleSheet> >, 0ul, WTF::CrashOnOverflow, 16ul, WTF::FastMalloc>&, WebCore::Style::Scope::StyleResolverUpdateType) + 208
23  com.apple.WebCore             	0x00000002e13eecb8 WebCore::Style::Scope::updateActiveStyleSheets(WebCore::Style::Scope::UpdateType) + 1320
24  com.apple.WebCore             	0x00000002e003012e WebCore::Document::updateStyleIfNeeded() + 126
25  com.apple.WebCore             	0x00000002e000d590 WebCore::ThreadTimers::sharedTimerFiredInternal() + 176
26  com.apple.WebCore             	0x00000002e000d4cf WebCore::timerFired(__CFRunLoopTimer*, void*) + 31
27  com.apple.CoreFoundation      	0x00007fff27de5064 __CFRUNLOOP_IS_CALLING_OUT_TO_A_TIMER_CALLBACK_FUNCTION__ + 20
28  com.apple.CoreFoundation      	0x00007fff27de4cd7 __CFRunLoopDoTimer + 1095
29  com.apple.CoreFoundation      	0x00007fff27de47da __CFRunLoopDoTimers + 346
30  com.apple.CoreFoundation      	0x00007fff27ddbdab __CFRunLoopRun + 2427
31  com.apple.CoreFoundation      	0x00007fff27ddb1a3 CFRunLoopRunSpecific + 483
32  com.apple.HIToolbox           	0x00007fff270c3d96 RunCurrentEventLoopInMode + 286
33  com.apple.HIToolbox           	0x00007fff270c3b06 ReceiveNextEventCommon + 613
34  com.apple.HIToolbox           	0x00007fff270c3884 _BlockUntilNextEventMatchingListInModeWithFilter + 64
35  com.apple.AppKit              	0x00007fff25376a73 _DPSNextEvent + 2085
36  com.apple.AppKit              	0x00007fff25b0ce34 -[NSApplication(NSEvent) _nextEventMatchingEventMask:untilDate:inMode:dequeue:] + 3044
37  com.apple.AppKit              	0x00007fff2536b885 -[NSApplication run] + 764
38  com.apple.AppKit              	0x00007fff2533aa72 NSApplicationMain + 804
39  libxpc.dylib                  	0x00007fff5042cf57 _xpc_objc_main + 580
40  libxpc.dylib                  	0x00007fff5042bbaa xpc_main + 417

<rdar://problem/39578592>
Comment 1 Ryosuke Niwa 2018-04-24 19:34:03 PDT
Created attachment 338697 [details]
Fixes the crash
Comment 2 Ryosuke Niwa 2018-04-24 20:42:08 PDT
Committed r230983: <https://trac.webkit.org/changeset/230983>
Comment 3 Radar WebKit Bug Importer 2018-04-24 20:43:16 PDT
<rdar://problem/39709331>