Bug 101399 - [BlackBerry] Crash in InRegionScrollerPrivate
Summary: [BlackBerry] Crash in InRegionScrollerPrivate
Status: RESOLVED FIXED
Alias: None
Product: WebKit
Classification: Unclassified
Component: WebKit BlackBerry (show other bugs)
Version: 528+ (Nightly build)
Hardware: Unspecified Unspecified
: P2 Normal
Assignee: Rob Buis
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2012-11-06 14:33 PST by gmak
Modified: 2012-11-12 10:44 PST (History)
4 users (show)

See Also:

Attachments
Patch (5.30 KB, patch)
2012-11-06 14:45 PST, gmak 		no flags Details | Formatted Diff | Diff
Patch (1.55 KB, patch)
2012-11-12 09:18 PST, Rob Buis 		yong.li.webkit: review+
Details | Formatted Diff | Diff
Show Obsolete (1) View All Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description gmak 2012-11-06 14:33:51 PST 
As the tin says
Comment 1 gmak 2012-11-06 14:45:41 PST 
Created attachment 172656 [details]
Patch
Comment 2 Rob Buis 2012-11-06 14:49:13 PST 
Comment on attachment 172656 [details]
Patch

LGTM.
Comment 3 WebKit Review Bot 2012-11-06 15:30:31 PST 
Comment on attachment 172656 [details]
Patch

Clearing flags on attachment: 172656

Committed r133679: <http://trac.webkit.org/changeset/133679>
Comment 4 WebKit Review Bot 2012-11-06 15:30:34 PST 
All reviewed patches have been landed.  Closing bug.
Comment 5 Antonio Gomes 2012-11-07 06:19:13 PST 
Comment on attachment 172656 [details]
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=172656&action=review

Hi Gen!

> Source/WebKit/blackberry/WebKitSupport/InRegionScrollableArea.cpp:65
> +    // Add a pointer to the enclosing document as the pointer to layer or node along the way may become invalid.
> +    if (m_layer->enclosingElement())
> +        m_document = m_layer->enclosingElement()->document();
> +

do you know when that happens?

where is it used?
Comment 6 gmak 2012-11-07 07:36:59 PST 
Antonio - we had an unreproducable crash from our automatic bug logging system with a partial stack trace which ended here:
BlackBerry::WebKit::WebPagePrivate::clearDocumentData (this=0x78b9d750, 
    documentGoingAway=0x7a35aa38)
Comment 7 Antonio Gomes 2012-11-07 08:13:45 PST 
Comment on attachment 172656 [details]
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=172656&action=review

> Source/WebKit/blackberry/Api/InRegionScroller.cpp:105
>      ASSERT(scrollableArea);
> -    Node* node = scrollableArea->layer()->enclosingElement();
> -    if (node && node->document() == documentGoingAway)
> +    if (scrollableArea->document() == documentGoingAway)

maybe the fix could be test Node::isInDocument (what ever the name is) first instead.

But ok, will leave it as is :)
Comment 8 Rob Buis 2012-11-12 09:18:51 PST 
Reopening to attach new patch.
Comment 9 Rob Buis 2012-11-12 09:18:54 PST 
Created attachment 173656 [details]
Patch
Comment 10 Rob Buis 2012-11-12 10:44:43 PST 
Committed r134256: <http://trac.webkit.org/changeset/134256>