Bug 40726

Summary:

HTML5 parser crash when setTimeout document.write after slow script

Product:

WebKit

Reporter:

Tony Gentilcore <tonyg>

Component:

WebCore Misc.

Assignee:

Nobody <webkit-unassigned>

Status:

RESOLVED FIXED

Severity:

Normal

CC:

abarth, bulach, eric

Priority:

Version:

528+ (Nightly build)

Hardware:

OS:

OS X 10.5

URL:

http://house.focus.cn/news/2010-03-29/890844.html

Bug Depends on:

Bug Blocks:

39259

Attachments:

Description	Flags
layout test	none
work in progress	none
Patch	eric: review+, abarth: commit-queue+

Tony Gentilcore

Reported 2010-06-16 11:33:52 PDT

This showed up on the chromium reliability bots. Here's a test case: <html> <body> <script> setTimeout("document.write('foo');", 1000); </script> <script src="script-which-takes-2s-to-load.js"></script> </body> </html>

Attachments
layout test (535 bytes, patch) 2010-06-16 11:55 PDT, Adam Barth	no flags	Details Formatted Diff Diff
work in progress (9.34 KB, patch) 2010-06-16 12:22 PDT, Adam Barth	no flags	Details Formatted Diff Diff
Patch (12.36 KB, patch) 2010-06-16 13:41 PDT, Adam Barth	eric: review+ abarth: commit-queue+	Details Formatted Diff Diff
Show Obsolete (2) View All Add attachment proposed patch, testcase, etc.

Eric Seidel (no email)

Comment 1 2010-06-16 11:35:33 PDT

Ah. We don't know that we're still executing script while the timeout is going. So we don't return the proper value from executingScript() and end up getting ourselves deleted... I think.

Eric Seidel (no email)

Comment 2 2010-06-16 11:45:13 PDT

Oh, I mis-read. The parser will still be alive! We're just getting a delayed document.write() callback while we're waiting for another script to load. So the parser will be paused, but the document.write will be from some other script. Shouldn't be too hard to debug.

Adam Barth

Comment 3 2010-06-16 11:55:32 PDT

Created attachment 58917 [details] layout test

Adam Barth

Comment 4 2010-06-16 12:22:42 PDT

Created attachment 58921 [details] work in progress

Adam Barth

Comment 5 2010-06-16 13:41:31 PDT

Created attachment 58923 [details] Patch

Eric Seidel (no email)

Comment 6 2010-06-16 13:46:37 PDT

Comment on attachment 58923 [details] Patch LGTM.