Bug 144050 - CrashTracer: WebProcess at com.apple.WebCore: WebCore::toScriptElementIfPossible + 4
Summary: CrashTracer: WebProcess at com.apple.WebCore: WebCore::toScriptElementIfPossi...
Status: RESOLVED FIXED
Alias: None
Product: WebKit
Classification: Unclassified
Component: Page Loading (show other bugs)
Version: 528+ (Nightly build)
Hardware: Unspecified Unspecified
: P2 Normal
Assignee: Nobody
URL:
Keywords: InRadar
Depends on:
Blocks:
 
Reported: 2015-04-22 10:32 PDT by Antti Koivisto
Modified: 2015-05-05 13:18 PDT (History)
7 users (show)

See Also:


Attachments
patch (2.50 KB, patch)
2015-04-22 11:20 PDT, Antti Koivisto
cdumez: review+
Details | Formatted Diff | Diff

Note You need to log in before you can comment on or make changes to this bug.
Description Antti Koivisto 2015-04-22 10:32:10 PDT
47 com.apple.WebCore:  WebCore::toScriptElementIfPossible + 4 <==
        47 com.apple.WebCore:  WebCore::ScriptRunner::timerFired + 452
          47 com.apple.WebCore:  WebCore::ThreadTimers::sharedTimerFiredInternal + 175
            47 com.apple.WebCore:  WebCore::timerFired + 58
              47 com.apple.CoreFoundation:  __CFRUNLOOP_IS_CALLING_OUT_TO_A_TIMER_CALLBACK_FUNCTION__ + 20
                47 com.apple.CoreFoundation:  __CFRunLoopDoTimer + 557
                  47 com.apple.CoreFoundation:  __CFRunLoopRun + 1529
Comment 1 Antti Koivisto 2015-04-22 10:32:35 PDT
<rdar://problem/15534973>
Comment 2 Antti Koivisto 2015-04-22 11:20:57 PDT
Created attachment 251342 [details]
patch
Comment 3 Chris Dumez 2015-04-22 13:31:07 PDT
Comment on attachment 251342 [details]
patch

View in context: https://bugs.webkit.org/attachment.cgi?id=251342&action=review

r=me as it seems safe but we should revisit this later on.

> Source/WebCore/ChangeLog:5
> +

Would be nice to have the radar here as well.

> Source/WebCore/ChangeLog:19
> +        in ScriptRunner::notifyScriptReady fails to find scriptElement and we are left with null entry in

s/in/If
Comment 4 Antti Koivisto 2015-04-23 00:59:28 PDT
https://trac.webkit.org/r183178
Comment 5 Liam Quinn 2015-05-04 15:04:11 PDT
In builds without the fix, I can reproduce this crash reliably by visiting http://www.hifi-forum.de/viewthread-152-4332.html (using the BlackBerry port or EFL port).
Comment 6 Chris Dumez 2015-05-04 15:42:26 PDT
(In reply to comment #5)
> In builds without the fix, I can reproduce this crash reliably by visiting
> http://www.hifi-forum.de/viewthread-152-4332.html (using the BlackBerry port
> or EFL port).

I have just tried visiting this URL with WebKit ToT / Mac port and it did not crash.
Comment 7 Antti Koivisto 2015-05-05 01:15:09 PDT
(In reply to comment #5)
> In builds without the fix, I can reproduce this crash reliably by visiting
> http://www.hifi-forum.de/viewthread-152-4332.html (using the BlackBerry port
> or EFL port).

I can't repro it either. Could you try debugging it? Just reproing the crash on debug build might give a backtrace explaining how this becomes null.
Comment 8 Liam Quinn 2015-05-05 13:18:06 PDT
Unfortunately, it's no longer reproducing for me today.