Bug 28800 – Inspected tab crashes in Chrome on inspected page refresh.

• Component: WebCore JavaScript
• Status: RESOLVED FIXED

[Yury Semikhatsky]

Steps to reproduce:
1. Navigate to a page.
2. Open devtools window.
3. Refresh inspected page.
4. While the page is reloading close DevTools window.


	chrome.dll!v8::internal::OS::DebugBreak()  Line 882	C++
 	chrome.dll!v8::internal::OS::Abort()  Line 877	C++
 	chrome.dll!V8_Fatal(const char * file=0x0407715c, int line=48, const char * format=0x040712d8, ...)  Line 57	C++
 	chrome.dll!CheckHelper(const char * file=0x0407715c, int line=48, const char * source=0x040771d0, bool condition=false)  Line 62 + 0x16 bytes	C++
 	chrome.dll!v8::internal::Handle<v8::internal::Context>::operator*()  Line 48 + 0x1b bytes	C++
 	chrome.dll!v8::Context::Enter()  Line 431 + 0x8 bytes	C++
 	chrome.dll!v8::Context::Scope::Scope(v8::Handle<v8::Context> context={...})  Line 2511	C++
 	chrome.dll!WebCore::ScriptScope::ScriptScope(WebCore::ScriptState * scriptState=0x00eeb280, bool reportExceptions=true)  Line 49 + 0x46 bytes	C++
 	chrome.dll!WebCore::ScriptObject::createNew(WebCore::ScriptState * scriptState=0x00eeb280)  Line 110	C++
 	chrome.dll!WebCore::InspectorFrontend::newScriptObject()  Line 71 + 0x10 bytes	C++
 	chrome.dll!WebCore::InspectorDOMAgent::buildObjectForNode(WebCore::Node * node=0x01254000, int depth=2, WTF::HashMap<WTF::RefPtr<WebCore::Node>,long,WTF::PtrHash<WTF::RefPtr<WebCore::Node> >,WTF::HashTraits<WTF::RefPtr<WebCore::Node> >,WTF::HashTraits<long> > * nodesMap=0x0184b790)  Line 380	C++
 	chrome.dll!WebCore::InspectorDOMAgent::pushDocumentToFrontend()  Line 242 + 0x19 bytes	C++
>	chrome.dll!WebCore::InspectorDOMAgent::handleEvent(WebCore::Event * event=0x01942dc0, bool __formal=false)  Line 180 + 0x8 bytes	C++
 	chrome.dll!WebCore::Node::handleLocalEvents(WebCore::Event * event=0x01942dc0, bool useCapture=false)  Line 2466 + 0x20 bytes	C++
 	chrome.dll!WebCore::Node::dispatchGenericEvent(WTF::PassRefPtr<WebCore::Event> prpEvent={...})  Line 2587 + 0x1d bytes	C++
 	chrome.dll!WebCore::Node::dispatchEvent(WTF::PassRefPtr<WebCore::Event> e={...}, int & ec=0)  Line 2520 + 0x12 bytes	C++
 	chrome.dll!WebCore::Document::finishedParsing()  Line 3944	C++
 	chrome.dll!WebCore::HTMLParser::finished()  Line 1635 + 0x1a bytes	C++
 	chrome.dll!WebCore::HTMLTokenizer::end()  Line 1847	C++
 	chrome.dll!WebCore::HTMLTokenizer::write(const WebCore::SegmentedString & str={...}, bool appendData=true)  Line 1791	C++
 	chrome.dll!WebCore::HTMLTokenizer::timerFired(WebCore::Timer<WebCore::HTMLTokenizer> * __formal=0x012fe578)  Line 1824 + 0x1a bytes	C++
 	chrome.dll!WebCore::Timer<WebCore::HTMLTokenizer>::fired()  Line 98 + 0x29 bytes	C++
 	chrome.dll!WebCore::ThreadTimers::fireTimers(double fireTime=1251446396.6920252, const WTF::Vector<WebCore::TimerBase *,0> & firingTimers={...})  Line 111 + 0xf bytes	C++
 	chrome.dll!WebCore::ThreadTimers::sharedTimerFiredInternal()  Line 143	C++
 	chrome.dll!WebCore::ThreadTimers::sharedTimerFired()  Line 123	C++
 	chrome.dll!webkit_glue::WebKitClientImpl::DoTimeout()  Line 66 + 0xa bytes	C++
 	chrome.dll!DispatchToMethod<webkit_glue::WebKitClientImpl,void (__thiscall webkit_glue::WebKitClientImpl::*)(void)>(webkit_glue::WebKitClientImpl * obj=0x00e289c0, void (void)* method=0x0258d320, const Tuple0 & arg={...})  Line 412 + 0x8 bytes	C++
 	chrome.dll!base::BaseTimer<webkit_glue::WebKitClientImpl,0>::TimerTask::Run()  Line 160 + 0x1c bytes	C++
 	chrome.dll!MessageLoop::RunTask(Task * task=0x01847f00)  Line 314 + 0xf bytes	C++
 	chrome.dll!MessageLoop::DeferOrRunPendingTask(const MessageLoop::PendingTask & pending_task={...})  Line 325	C++
 	chrome.dll!MessageLoop::DoWork()  Line 429 + 0xc bytes	C++
 	chrome.dll!base::MessagePumpDefault::Run(base::MessagePump::Delegate * delegate=0x0012f580)  Line 23 + 0xf bytes	C++
 	chrome.dll!MessageLoop::RunInternal()  Line 199 + 0x2a bytes	C++
 	chrome.dll!MessageLoop::RunHandler()  Line 182	C++
 	chrome.dll!MessageLoop::Run()  Line 156	C++
 	chrome.dll!RendererMain(const MainFunctionParams & parameters={...})  Line 164	C++
 	chrome.dll!ChromeMain(HINSTANCE__ * instance=0x00400000, sandbox::SandboxInterfaceInfo * sandbox_info=0x0012fe9c, wchar_t * command_line=0x000209b4)  Line 539 + 0xc bytes	C++
 	chrome.exe!wWinMain(HINSTANCE__ * instance=0x00400000, HINSTANCE__ * prev_instance=0x00000000, wchar_t * command_line=0x000209b4, int __formal=10)  Line 102 + 0x14 bytes	C++
 	chrome.exe!__tmainCRTStartup()  Line 324 + 0x35 bytes	C
 	chrome.exe!wWinMainCRTStartup()  Line 196	C
 	kernel32.dll!7c817077() 	
 	[Frames below may be incorrect and/or missing, no symbols loaded for kernel32.dll]

[Yury Semikhatsky]

Created attachment 38725 [details]
Set DOM agent document to 0 when inspector closes

[Pavel Feldman]

Committing to http://svn.webkit.org/repository/webkit/trunk ...
	M	WebCore/ChangeLog
	M	WebCore/inspector/InspectorController.cpp
	M	WebCore/inspector/InspectorController.h
Committed r47862

[Yury Semikhatsky]

Created attachment 38729 [details]
Check that DOM agent and inspector frontend are not nulls when accessing them from InspectorBackend.

[Yury Semikhatsky]

Created attachment 38730 [details]
Check that DOM agent and inspector frontend are not nulls when accessing them from InspectorBackend. 

(removed an empty line from getChildNodes)

[Yury Semikhatsky]

We need to check that front-end and DOM agent exist when they are acccessed from InspectorBackand. A patch is already prepared.

[Yury Semikhatsky]

We need to check that front-end and DOM agent exist when they are acccessed from InspectorBackand. A patch is already prepared.

[Eric Seidel (no email)]

Comment on attachment 38725 [details]
Set DOM agent document to 0 when inspector closes

Looks like this was landed.  Removing Tim's r+ so that it doesn't appear in the commit-queue since this bug seems to be being re-used for a second patch.

[Pavel Feldman]

Committing to http://svn.webkit.org/repository/webkit/trunk ...
    M    WebCore/ChangeLog
    M    WebCore/inspector/InspectorBackend.cpp
    M    WebCore/inspector/InspectorBackend.h
Committed r47944