Bug 138914 – Crash when destroying a Document that has a throttled timer still running

• Status: RESOLVED
• Resolution: FIXED
• Component: DOM

[Chris Dumez]

Crash when destroying a Document that has a throttled timer still running:
0   com.apple.WebCore             	0x00007fff9403d8d4 WebCore::Document::view() const + 4
1   com.apple.WebCore             	0x00007fff94189e33 WebCore::DOMTimer::~DOMTimer() + 67
2   com.apple.WebCore             	0x00007fff94189dde WebCore::DOMTimer::~DOMTimer() + 14
3   com.apple.WebCore             	0x00007fff940c7396 WebCore::ScriptExecutionContext::~ScriptExecutionContext() + 534
4   com.apple.WebCore             	0x00007fff940c59c0 WebCore::Document::~Document() + 5104
5   com.apple.WebCore             	0x00007fff9461924e WebCore::HTMLDocument::~HTMLDocument() + 14
6   com.apple.WebCore             	0x00007fff940c42dc WebCore::Node::~Node() + 172
7   com.apple.WebCore             	0x00007fff9418275a WebCore::HTMLScriptElement::~HTMLScriptElement() + 26
8   com.apple.WebCore             	0x00007fff941825df WebCore::JSNodeOwner::finalize(JSC::Handle<JSC::Unknown>, 

Radar: <rdar://problem/19040156>

[Chris Dumez]

Created attachment 241929 [details]
Patch

[Chris Dumez]

Comment on attachment 241929 [details]
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=241929&action=review

> LayoutTests/fast/dom/resources/frame-with-throttled-timer.html:3
> +<iframe id="testFrame"></iframe>

This extra iframe is needed to work around:
https://bugs.webkit.org/show_bug.cgi?id=138915

[Benjamin Poulain]

Comment on attachment 241929 [details]
Patch

rs=me

[WebKit Commit Bot]

Comment on attachment 241929 [details]
Patch

Clearing flags on attachment: 241929

Committed r176402: <http://trac.webkit.org/changeset/176402>

[WebKit Commit Bot]

All reviewed patches have been landed.  Closing bug.

[Benjamin Poulain]

Comment on attachment 241929 [details]
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=241929&action=review

> LayoutTests/fast/dom/throttled-timer-running-on-document-destruction.html:18
> +setTimeout(removeFrame, 300);

Can't this be shorter?

Maybe wait for the onload of the frame and do a short timer (100ms)?

[Chris Dumez]

(In reply to comment #6)
> Comment on attachment 241929 [details]
> Patch
> 
> View in context:
> https://bugs.webkit.org/attachment.cgi?id=241929&action=review
> 
> > LayoutTests/fast/dom/throttled-timer-running-on-document-destruction.html:18
> > +setTimeout(removeFrame, 300);
> 
> Can't this be shorter?
> 
> Maybe wait for the onload of the frame and do a short timer (100ms)?

Yes, that works. I updated the test in https://bugs.webkit.org/show_bug.cgi?id=138915.