| Summary: | REGRESSION (r124489): Crash in FrameView::scrollContentsFastPath when scrolling Facebook and Google image search | ||||||
|---|---|---|---|---|---|---|---|
| Product: | WebKit | Reporter: | Matt Arsenault <arsenm2> | ||||
| Component: | Layout and Rendering | Assignee: | Beth Dakin <bdakin> | ||||
| Status: | RESOLVED FIXED | ||||||
| Severity: | Normal | CC: | andersca, bdakin, jamesr, jimoase, kevin, paul+bugs, simon.fraser, thorton, tonikitoo, webkit-bug-importer, webkit.review.bot | ||||
| Priority: | P2 | Keywords: | InRadar | ||||
| Version: | 528+ (Nightly build) | ||||||
| Hardware: | Unspecified | ||||||
| OS: | OS X 10.8 | ||||||
| Attachments: |
|
||||||
|
Description
Matt Arsenault
2012-08-05 03:10:23 PDT
It looks to me like this is us trying to scroll a fixed-position renderer where style() is null in this part of scrollContentsFastPath:
for (FixedObjectSet::const_iterator it = m_fixedObjects->begin(); it != end; ++it) {
RenderObject* renderer = *it;
if (renderer->style()->position() != FixedPosition)
continue;
It seems likely that this regressed in http://trac.webkit.org/changeset/121443, but I have not confirmed.
This crash is extremely easy to reproduce on release builds on pages with fixed position elements.
Actually, regressing the bug suggests it started in http://trac.webkit.org/changeset/124489 (the range is slightly large, but that's the only related fix I see). *** Bug 93200 has been marked as a duplicate of this bug. *** I'm a bit torn about if I should fix the original bug in an entirely different way, or if I should keep the fix, but add another condition to the clause that I added to ScrollingCoordinator::setShouldUpdateScrollLayerPositionOnMainThread(). In the original fix, I just added:
if (shouldUpdateScrollLayerPositionOnMainThread)
updateMainFrameScrollPositionAndScrollLayerPosition();
But if we knew that we were mid-attach with the current fixed object, then we obviously wouldn't want to update the scroll position. It doesn't seem like there is currently any direct way to assess this though, so I would have to add something.
Created attachment 156782 [details]
Patch
Thanks Anders! Committed fix with http://trac.webkit.org/changeset/124811 *** Bug 93279 has been marked as a duplicate of this bug. *** Search wish this fix would get released into the nightlies which haven't been updated in 4 days. |