Bug 9664

Summary: REGRESSION (r15106): Crash in fast/events/mouseover-mouseout2.html
Product: WebKit Reporter: mitz
Component: New BugsAssignee: Nobody <webkit-unassigned>
Status: RESOLVED FIXED    
Severity: Normal CC: ap, ddkilzer, timothy
Priority: P1 Keywords: Regression
Version: 420+   
Hardware: Mac   
OS: OS X 10.4   
Attachments:
Description Flags
Proposed patch timothy: review+

mitz
Reported 2006-06-30 03:14:42 PDT
run-webkit-tests fast/events/mouseover-mouseout2.html crashes: 0    WebCore::FrameMac::mouseMoved(NSEvent*) + 40 (FrameMac.mm:2087) 1    -[WebCoreFrameBridge mouseMoved:] + 52 (WebCoreFrameBridge.mm:1044) (because m_frame is 0 in -[mouseMoved:]).
Attachments
Proposed patch (1.58 KB, patch)
2006-06-30 03:50 PDT, mitz 		timothy: review+
DetailsFormatted DiffDiff
View All Add attachment proposed patch, testcase, etc.
mitz
Comment 1 2006-06-30 03:50:45 PDT
Created attachment 9103 [details] Proposed patch
mitz
Comment 2 2006-06-30 04:10:52 PDT
I should have included the complete backtrace :-) Thread 0 Crashed: 0   com.apple.WebCore         0x0112dba0 WebCore::FrameMac::mouseMoved(NSEvent*) + 40 (FrameMac.mm:2087) 1   com.apple.WebCore         0x01163138 -[WebCoreFrameBridge mouseMoved:] + 52 (WebCoreFrameBridge.mm:1044) 2   com.apple.WebCore         0x0112cdf8 WebCore::FrameMac::passSubframeEventToSubframe(WebCore::MouseEventWithHitTestResults&, WebCore::Frame*) + 528 (FrameMac.mm:1851) 3   com.apple.WebCore         0x01144cfc WebCore::FrameView::handleMouseMoveEvent(WebCore::PlatformMouseEvent const&) + 740 (FrameView.cpp:694) 4   com.apple.WebCore         0x0112dd10 WebCore::FrameMac::mouseMoved(NSEvent*) + 408 (FrameMac.mm:2100) 5   com.apple.WebCore         0x01163138 -[WebCoreFrameBridge mouseMoved:] + 52 (WebCoreFrameBridge.mm:1044) 6   com.apple.WebKit          0x00265a98 -[WebHTMLView(WebPrivate) _updateMouseoverWithEvent:] + 1316 (WebHTMLView.m:1139) 7   com.apple.WebKit          0x00273674 -[WebHTMLView mouseMovedNotification:] + 148 (WebHTMLView.m:3155) 8   com.apple.Foundation      0x92943ad8 _nsnote_callback + 180 9   com.apple.CoreFoundation  0x90803010 __CFXNotificationPost + 368 10  com.apple.CoreFoundation  0x907fb0ec _CFXNotificationPostNotification + 684 11  com.apple.Foundation      0x9292dee0 -[NSNotificationCenter postNotificationName:object:userInfo:] + 92 12  com.apple.AppKit          0x937bcf84 forwardMethod + 92 13  com.apple.AppKit          0x937bcf84 forwardMethod + 92 14  com.apple.AppKit          0x937bcf84 forwardMethod + 92 15  com.apple.AppKit          0x937bcf84 forwardMethod + 92 16  com.apple.AppKit          0x937bcf84 forwardMethod + 92 17  com.apple.AppKit          0x937bcf84 forwardMethod + 92 18  DumpRenderTree            0x0000523c -[EventSendingController mouseMoveToX:Y:] + 1188 (EventSendingController.m:223) 19  libobjc.A.dylib           0x90a431f4 objc_msgSendv + 180 20  com.apple.Foundation      0x9293fc88 -[NSInvocation invoke] + 944 21  com.apple.JavaScriptCore  0x006bc68c KJS::Bindings::ObjcInstance::invokeMethod(KJS::ExecState*, KJS::Bindings::MethodList const&, KJS::List const&) + 1808 (objc_instance.mm:201) 22  com.apple.JavaScriptCore  0x006b6274 KJS::RuntimeMethod::callAsFunction(KJS::ExecState*, KJS::JSObject*, KJS::List const&) + 356 (runtime_method.cpp:88) 23  com.apple.JavaScriptCore  0x0068dfa4 KJS::JSObject::call(KJS::ExecState*, KJS::JSObject*, KJS::List const&) + 288 (object.cpp:96) 24  com.apple.JavaScriptCore  0x006833ec KJS::FunctionCallDotNode::evaluate(KJS::ExecState*) + 908 (nodes.cpp:758) 25  com.apple.JavaScriptCore  0x0067fde8 KJS::ExprStatementNode::execute(KJS::ExecState*) + 220 (nodes.cpp:1661) 26  com.apple.JavaScriptCore  0x0067c5e0 KJS::SourceElementsNode::execute(KJS::ExecState*) + 616 (nodes.cpp:2448) 27  com.apple.JavaScriptCore  0x00679f9c KJS::BlockNode::execute(KJS::ExecState*) + 216 (nodes.cpp:1638) 28  com.apple.JavaScriptCore  0x0067fc70 KJS::IfNode::execute(KJS::ExecState*) + 500 (nodes.cpp:1680) 29  com.apple.JavaScriptCore  0x0067c490 KJS::SourceElementsNode::execute(KJS::ExecState*) + 280 (nodes.cpp:2442) 30  com.apple.JavaScriptCore  0x00679f9c KJS::BlockNode::execute(KJS::ExecState*) + 216 (nodes.cpp:1638) 31  com.apple.JavaScriptCore  0x006685e4 KJS::DeclaredFunctionImp::execute(KJS::ExecState*) + 92 (function.cpp:338) 32  com.apple.JavaScriptCore  0x00667bf0 KJS::FunctionImp::callAsFunction(KJS::ExecState*, KJS::JSObject*, KJS::List const&) + 668 (function.cpp:104) 33  com.apple.JavaScriptCore  0x0068dfa4 KJS::JSObject::call(KJS::ExecState*, KJS::JSObject*, KJS::List const&) + 288 (object.cpp:96) 34  com.apple.JavaScriptCore  0x00683c38 KJS::FunctionCallResolveNode::evaluate(KJS::ExecState*) + 792 (nodes.cpp:665) 35  com.apple.JavaScriptCore  0x0067fde8 KJS::ExprStatementNode::execute(KJS::ExecState*) + 220 (nodes.cpp:1661) 36  com.apple.JavaScriptCore  0x0067c490 KJS::SourceElementsNode::execute(KJS::ExecState*) + 280 (nodes.cpp:2442) 37  com.apple.JavaScriptCore  0x00679f9c KJS::BlockNode::execute(KJS::ExecState*) + 216 (nodes.cpp:1638) 38  com.apple.JavaScriptCore  0x006685e4 KJS::DeclaredFunctionImp::execute(KJS::ExecState*) + 92 (function.cpp:338) 39  com.apple.JavaScriptCore  0x00667bf0 KJS::FunctionImp::callAsFunction(KJS::ExecState*, KJS::JSObject*, KJS::List const&) + 668 (function.cpp:104) 40  com.apple.JavaScriptCore  0x0068dfa4 KJS::JSObject::call(KJS::ExecState*, KJS::JSObject*, KJS::List const&) + 288 (object.cpp:96) 41  com.apple.WebCore         0x0133db9c KJS::JSAbstractEventListener::handleEvent(WebCore::Event*, bool) + 772 (kjs_events.cpp:114) 42  com.apple.WebCore         0x0114d480 WebCore::Document::handleWindowEvent(WebCore::Event*, bool) + 308 (Document.cpp:2224) 43  com.apple.WebCore         0x012ff280 WebCore::EventTargetNode::dispatchWindowEvent(WebCore::AtomicString const&, bool, bool) + 324 (EventTargetNode.cpp:321) 44  com.apple.WebCore         0x011504b4 WebCore::Document::implicitClose() + 700 (Document.cpp:1195) 45  com.apple.WebCore         0x0111c894 WebCore::Frame::checkEmitLoadEvent() + 724 (Frame.cpp:830) 46  com.apple.WebCore         0x011218a8 WebCore::Frame::checkCompleted() + 528 (Frame.cpp:795) 47  com.apple.WebCore         0x01121a3c WebCore::Frame::childCompleted(bool) + 132 (Frame.cpp:1629) 48  com.apple.WebCore         0x0112166c WebCore::Frame::completed(bool) + 176 (Frame.cpp:3569) 49  com.apple.WebCore         0x01121930 WebCore::Frame::checkCompleted() + 664 (Frame.cpp:805) 50  com.apple.WebCore         0x01121cd0 WebCore::Frame::finishedParsing() + 44 (Frame.cpp:750) 51  com.apple.WebCore         0x0114a5d4 WebCore::Document::finishedParsing() + 72 (Document.cpp:3275) 52  com.apple.WebCore         0x010425c4 WebCore::HTMLParser::finished() + 300 (HTMLParser.cpp:1345) 53  com.apple.WebCore         0x01047e9c WebCore::HTMLTokenizer::end() + 336 (HTMLTokenizer.cpp:1526) 54  com.apple.WebCore         0x0104832c WebCore::HTMLTokenizer::finish() + 1128 (HTMLTokenizer.cpp:1567) 55  com.apple.WebCore         0x01148370 WebCore::Document::finishParsing() + 84 (Document.cpp:1329) 56  com.apple.WebCore         0x01122010 WebCore::Frame::endIfNotLoading() + 432 (Frame.cpp:706) 57  com.apple.WebCore         0x01122064 WebCore::Frame::end() + 52 (Frame.cpp:689) 58  com.apple.WebCore         0x01161e5c -[WebCoreFrameBridge end] + 72 (WebCoreFrameBridge.mm:708) 59  com.apple.WebKit          0x00247cac -[WebDataSource(WebPrivate) _finishedLoading] + 220 (WebDataSource.m:771) 60  com.apple.WebKit          0x00284e48 -[WebMainResourceLoader didFinishLoading] + 560 (WebMainResourceLoader.m:380) 61  com.apple.WebKit          0x00243074 -[WebLoader connectionDidFinishLoading:] + 184 (WebLoader.m:575) 62  com.apple.Foundation      0x9297684c -[NSURLConnection(NSURLConnectionInternal) _sendDidFinishLoadingCallback] + 188 63  com.apple.Foundation      0x92974ab8 -[NSURLConnection(NSURLConnectionInternal) _sendCallbacks] + 556 64  com.apple.Foundation      0x92974810 _sendCallbacks + 156 65  com.apple.CoreFoundation  0x907dc4cc __CFRunLoopDoSources0 + 384 66  com.apple.CoreFoundation  0x907db9fc __CFRunLoopRun + 452 67  com.apple.CoreFoundation  0x907db47c CFRunLoopRunSpecific + 268 68  com.apple.Foundation      0x92953164 -[NSRunLoop runMode:beforeDate:] + 172 69  DumpRenderTree            0x0000ad84 dumpRenderTree + 1000 (DumpRenderTree.m:755) 70  DumpRenderTree            0x00007eb4 main + 3672 (DumpRenderTree.m:322) 71  DumpRenderTree            0x00002250 _start + 340 (crt.c:272) 72  DumpRenderTree            0x000020f8 start + 60  
Timothy Hatcher
Comment 3 2006-06-30 06:31:09 PDT
Comment on attachment 9103 [details] Proposed patch r=me
Timothy Hatcher
Comment 4 2006-06-30 07:01:36 PDT
Landed in r15107
Darin Adler
Comment 5 2006-06-30 11:07:19 PDT
Comment on attachment 9103 [details] Proposed patch I wish there was some more direct way of checking if the frame is still an active part of the frame tree. Like maybe checking if it's page pointer is 0?
Note You need to log in before you can comment on or make changes to this bug.