Bug 137608 - Unmatched CSS selector crashes tab.
Summary: Unmatched CSS selector crashes tab.
Status: RESOLVED FIXED
Alias: None
Product: WebKit
Classification: Unclassified
Component: Page Loading (show other bugs)
Version: 528+ (Nightly build)
Hardware: iPhone / iPad Unspecified
: P2 Normal
Assignee: Benjamin Poulain
URL: http://test.internetarchitects.be/ios...
Keywords:
Depends on:
Blocks:
 
Reported: 2014-10-10 04:59 PDT by Jeroen Bensch
Modified: 2014-10-14 14:41 PDT (History)
2 users (show)

See Also:

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Jeroen Bensch 2014-10-10 04:59:47 PDT 
Whenever we try to load this in Safari on iOS 8.0.2 the tab crashes.

The CSS won't match the HTML it seems and crashes.
Comment 1 Alexey Proskuryakov 2014-10-13 22:59:49 PDT 
This seems like it may be fixed in trunk WebKit already. Ben?
Comment 2 Benjamin Poulain 2014-10-13 23:58:06 PDT 
After the branch, I did some big refactoring of style resolution. WebKit trunk uses a completely different algorithm for adjacent relations so it is not ideal for testing.

The branch of iOS 8-8.0.2 has a silly bug on 32bits device when :nth-child() is used inside a backtracking chain. The patch was integrated here: http://trac.webkit.org/changeset/173732

Jeroen, what device have you tested?
Comment 3 Jeroen Bensch 2014-10-14 00:58:36 PDT 
Benjamin,

I've tested it on an iPhone 5 and iPad mini (non-retina). A colleague of mine tested it on iPhone 5s and iPad 3.

iPhone 5 and iPad mini are running iOS 8.0.2.
iPhone 5s and iPad 3 were running iOS 8.0.1.
Comment 4 Benjamin Poulain 2014-10-14 14:41:49 PDT 
Ok.

The crash on 5S is really odd, I can't think of a reason why that would happen. I tried the test case on an iPhone 6 just in case. The CPU architecture is close enough for testing, the JIT is exactly the same for 5S and 6.

I updated an iPhone 5 to the latest seed and the test page does not crash. All the data I have seems to show this is fixed by http://trac.webkit.org/changeset/173732, I close this bug since there is nothing else to do.