Bug 144050 - CrashTracer: WebProcess at com.apple.WebCore: WebCore::toScriptElementIfPossible + 4
Summary: CrashTracer: WebProcess at com.apple.WebCore: WebCore::toScriptElementIfPossi...
Status: RESOLVED FIXED
Alias: None
Product: WebKit
Classification: Unclassified
Component: Page Loading (show other bugs)
Version: 528+ (Nightly build)
Hardware: Unspecified Unspecified
: P2 Normal
Assignee: Nobody
URL:
Keywords: InRadar
Depends on:
Blocks:
 
Reported: 2015-04-22 10:32 PDT by Antti Koivisto
Modified: 2015-05-05 13:18 PDT (History)
7 users (show)

See Also:

Attachments
patch (2.50 KB, patch)
2015-04-22 11:20 PDT, Antti Koivisto 		cdumez: review+
Details | Formatted Diff | Diff
View All Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Antti Koivisto 2015-04-22 10:32:10 PDT 
47 com.apple.WebCore:  WebCore::toScriptElementIfPossible + 4 <==
        47 com.apple.WebCore:  WebCore::ScriptRunner::timerFired + 452
          47 com.apple.WebCore:  WebCore::ThreadTimers::sharedTimerFiredInternal + 175
            47 com.apple.WebCore:  WebCore::timerFired + 58
              47 com.apple.CoreFoundation:  __CFRUNLOOP_IS_CALLING_OUT_TO_A_TIMER_CALLBACK_FUNCTION__ + 20
                47 com.apple.CoreFoundation:  __CFRunLoopDoTimer + 557
                  47 com.apple.CoreFoundation:  __CFRunLoopRun + 1529
Comment 1 Antti Koivisto 2015-04-22 10:32:35 PDT 
<rdar://problem/15534973>
Comment 2 Antti Koivisto 2015-04-22 11:20:57 PDT 
Created attachment 251342 [details]
patch
Comment 3 Chris Dumez 2015-04-22 13:31:07 PDT 
Comment on attachment 251342 [details]
patch

View in context: https://bugs.webkit.org/attachment.cgi?id=251342&action=review

r=me as it seems safe but we should revisit this later on.

> Source/WebCore/ChangeLog:5
> +

Would be nice to have the radar here as well.

> Source/WebCore/ChangeLog:19
> +        in ScriptRunner::notifyScriptReady fails to find scriptElement and we are left with null entry in

s/in/If
Comment 4 Antti Koivisto 2015-04-23 00:59:28 PDT 
https://trac.webkit.org/r183178
Comment 5 Liam Quinn 2015-05-04 15:04:11 PDT 
In builds without the fix, I can reproduce this crash reliably by visiting http://www.hifi-forum.de/viewthread-152-4332.html (using the BlackBerry port or EFL port).
Comment 6 Chris Dumez 2015-05-04 15:42:26 PDT 
(In reply to comment #5)
> In builds without the fix, I can reproduce this crash reliably by visiting
> http://www.hifi-forum.de/viewthread-152-4332.html (using the BlackBerry port
> or EFL port).

I have just tried visiting this URL with WebKit ToT / Mac port and it did not crash.
Comment 7 Antti Koivisto 2015-05-05 01:15:09 PDT 
(In reply to comment #5)
> In builds without the fix, I can reproduce this crash reliably by visiting
> http://www.hifi-forum.de/viewthread-152-4332.html (using the BlackBerry port
> or EFL port).

I can't repro it either. Could you try debugging it? Just reproing the crash on debug build might give a backtrace explaining how this becomes null.
Comment 8 Liam Quinn 2015-05-05 13:18:06 PDT 
Unfortunately, it's no longer reproducing for me today.