Bug 144050 – CrashTracer: WebProcess at com.apple.WebCore: WebCore::toScriptElementIfPossible + 4

• Status: RESOLVED
• Resolution: FIXED
• Component: Page Loading

[Antti Koivisto]

47 com.apple.WebCore:  WebCore::toScriptElementIfPossible + 4 <==
        47 com.apple.WebCore:  WebCore::ScriptRunner::timerFired + 452
          47 com.apple.WebCore:  WebCore::ThreadTimers::sharedTimerFiredInternal + 175
            47 com.apple.WebCore:  WebCore::timerFired + 58
              47 com.apple.CoreFoundation:  __CFRUNLOOP_IS_CALLING_OUT_TO_A_TIMER_CALLBACK_FUNCTION__ + 20
                47 com.apple.CoreFoundation:  __CFRunLoopDoTimer + 557
                  47 com.apple.CoreFoundation:  __CFRunLoopRun + 1529

[Antti Koivisto]

<rdar://problem/15534973>

[Antti Koivisto]

Created attachment 251342 [details]
patch

[Chris Dumez]

Comment on attachment 251342 [details]
patch

View in context: https://bugs.webkit.org/attachment.cgi?id=251342&action=review

r=me as it seems safe but we should revisit this later on.

> Source/WebCore/ChangeLog:5
> +

Would be nice to have the radar here as well.

> Source/WebCore/ChangeLog:19
> +        in ScriptRunner::notifyScriptReady fails to find scriptElement and we are left with null entry in

s/in/If

[Antti Koivisto]

https://trac.webkit.org/r183178

[Liam Quinn]

In builds without the fix, I can reproduce this crash reliably by visiting http://www.hifi-forum.de/viewthread-152-4332.html (using the BlackBerry port or EFL port).

[Chris Dumez]

(In reply to comment #5)
> In builds without the fix, I can reproduce this crash reliably by visiting
> http://www.hifi-forum.de/viewthread-152-4332.html (using the BlackBerry port
> or EFL port).

I have just tried visiting this URL with WebKit ToT / Mac port and it did not crash.

[Antti Koivisto]

(In reply to comment #5)
> In builds without the fix, I can reproduce this crash reliably by visiting
> http://www.hifi-forum.de/viewthread-152-4332.html (using the BlackBerry port
> or EFL port).

I can't repro it either. Could you try debugging it? Just reproing the crash on debug build might give a backtrace explaining how this becomes null.

[Liam Quinn]

Unfortunately, it's no longer reproducing for me today.