WebCore crash on RenderTreeBuilder when play video within webview

• Component: Media
• Status: NEW ---

[lidj]

WebCore	
WTFCrashWithInfo(int, char const*, char const*, int) + 20
1
WebCore	
WebCore::RenderTreeBuilder::RenderTreeBuilder(WebCore::RenderView&) + 358
2	WebCore	
WebCore::RenderTreeUpdater::tearDownRenderers(WebCore::Element&) + 44
3	WebCore	
WebCore::ContainerNode::removeBetween(WebCore::Node*, WebCore::Node*, WebCore::Node&) + 140
4	WebCore	
WebCore::ContainerNode::removeChild(WebCore::Node&) + 644
5	WebCore	
WebCore::VTTCue::removeDisplayTree() + 136
6	WebCore	
WebCore::HTMLMediaElement::updateActiveTextTrackCues(WTF::MediaTime const&) + 5828
7	WebCore	
WTF::Function<void ()>::CallableWrapper<WebCore::HTMLMediaElement::updateActiveTextTrackCues(WTF::MediaTime const&)::$_22>::call() + 172
8	AVFoundation	
__67-[AVOccasionalTimebaseObserver initWithTimebase:times:queue:block:]_block_invoke_4 + 68


the stack of function calls, the iOS system is iOS 12.2, and the webkit version is 607.1.40 i think.

[Alexey Proskuryakov]

Thank you for the report! Is this at least semi-reproducible, or a one off?

For Apple folks: crash point matches rdar://problem/36153631&47826223&47826975&40373156&39302087, but those issues look different.

[lidj]

(In reply to Alexey Proskuryakov from comment #1)
> Thank you for the report! Is this at least semi-reproducible, or a one off?
> 
> For Apple folks: crash point matches
> rdar://problem/36153631&47826223&47826975&40373156&39302087, but those
> issues look different.

it's a reproducible bug, only iOS 12.
github issue:https://github.com/youtube/youtube-ios-player-helper/issues/322

[Alexey Proskuryakov]

I cannot reproduce the crash with iOS 12.2.

[Radar WebKit Bug Importer]

<rdar://problem/50862123>