Crash under WebCore::MutationObserver::deliverAllMutations(): Thread[0] EXC_BAD_ACCESS (SIGSEGV) (KERN_INVALID_ADDRESS at 0x00000000000000b0) [ 0] 0x00007fff84d4ddad WebCore`WebCore::MutationObserver::deliverAllMutations() [inlined] WTF::RefPtr<WebCore::MutationCallback>::operator->() const at ScriptExecutionContext.h:98 94 virtual void suspendActiveDOMObjects(ActiveDOMObject::ReasonForSuspension); 95 virtual void resumeActiveDOMObjects(ActiveDOMObject::ReasonForSuspension); 96 virtual void stopActiveDOMObjects(); 97 -> 98 bool activeDOMObjectsAreSuspended() const { return m_activeDOMObjectsAreSuspended; } 99 bool activeDOMObjectsAreStopped() const { return m_activeDOMObjectsAreStopped; } 100 101 // Called from the constructor and destructors of ActiveDOMObject. 102 void didCreateActiveDOMObject(ActiveDOMObject*); 0x00007fff84d4dda0: movq (%r15), %rax 0x00007fff84d4dda3: movq 0x8(%rax), %rdi 0x00007fff84d4dda7: movq (%rdi), %rax 0x00007fff84d4ddaa: callq *0x18(%rax) -> 0x00007fff84d4ddad: cmpb $0x0, 0xb0(%rax) 0x00007fff84d4ddb4: jne 0x139eb1 ; <+433> at MutationObserver.cpp:221 0x00007fff84d4ddba: cmpb $0x1, 0xed44ef(%rip) ; WebCore::suspendedMutationObservers()::suspendedObservers + 7 0x00007fff84d4ddc1: jne 0x139dd0 ; <+208> [inlined] WebCore::suspendedMutationObservers() + 15 at MutationObserver.cpp:225 0x00007fff84d4ddc3: movq 0xed44de(%rip), %rbx ; WebCore::suspendedMutationObservers()::suspendedObservers [ 0] 0x00007fff84d4ddad WebCore`WebCore::MutationObserver::deliverAllMutations() [inlined] WTF::Vector<WTF::RefPtr<WebCore::MutationObserver>, 0ul, WTF::CrashOnOverflow>::operator[](unsigned long) + 25 at MutationObserver.cpp:184 180 } 181 182 bool MutationObserver::canDeliver() 183 { -> 184 return !m_callback->scriptExecutionContext()->activeDOMObjectsAreSuspended(); 185 } 186 187 void MutationObserver::deliver() 188 { [ 0] 0x00007fff84d4dd94 WebCore`WebCore::MutationObserver::deliverAllMutations() + 148 at MutationObserver.cpp:222 218 if (!suspendedMutationObservers().isEmpty()) { 219 Vector<RefPtr<MutationObserver> > suspended; 220 copyToVector(suspendedMutationObservers(), suspended); 221 for (size_t i = 0; i < suspended.size(); ++i) { -> 222 if (!suspended[i]->canDeliver()) 223 continue; 224 225 suspendedMutationObservers().remove(suspended[i]); 226 activeMutationObservers().add(suspended[i]); [ 1] 0x00007fff84e393df WebCore`WebCore::JSMainThreadExecState::call(JSC::ExecState*, JSC::JSValue, JSC::CallType, JSC::CallData const&, JSC::JSValue, JSC::ArgList const&) [inlined] WebCore::JSMainThreadExecState::~JSMainThreadExecState() + 18 at JSMainThreadExecState.h:97 93 94 s_mainThreadState = m_previousState; 95 96 if (didExitJavaScript) -> 97 didLeaveScriptContext(); 98 } 99 100 private: 101 static JSC::ExecState* s_mainThreadState; 0x00007fff84e393d1: je 0x2253e2 ; <+178> [inlined] WebCore::JSMainThreadExecState::~JSMainThreadExecState() + 21 at JSMainThreadExecState.h:89 0x00007fff84e393d3: movq %r14, (%r15) 0x00007fff84e393d6: testq %r14, %r14 0x00007fff84e393d9: jne 0x2253e5 ; <+181> at JSMainThreadExecState.h:57 -> 0x00007fff84e393db: callq 0x13b9a0 ; WebCore::JSMainThreadExecState::didLeaveScriptContext at JSMainThreadExecState.cpp:39 0x00007fff84e393e0: jmp 0x2253e5 ; <+181> at JSMainThreadExecState.h:57 0x00007fff84e393e2: movq %r14, (%r15) 0x00007fff84e393e5: movq %rbx, %rax 0x00007fff84e393e8: addq $0x18, %rsp [ 1] 0x00007fff84e393cd WebCore`WebCore::JSMainThreadExecState::call(JSC::ExecState*, JSC::JSValue, JSC::CallType, JSC::CallData const&, JSC::JSValue, JSC::ArgList const&) [inlined] WebCore::JSMainThreadExecState::~JSMainThreadExecState() at JSMainThreadExecState.h:89 [ 1] 0x00007fff84e393cd WebCore`WebCore::JSMainThreadExecState::call(JSC::ExecState*, JSC::JSValue, JSC::CallType, JSC::CallData const&, JSC::JSValue, JSC::ArgList const&) + 157 at JSMainThreadExecState.h:57 [ 2] 0x00007fff84e7db51 WebCore`WebCore::ScheduledAction::executeFunctionInContext(JSC::JSGlobalObject*, JSC::JSValue, WebCore::ScriptExecutionContext*) + 449 at ScheduledAction.cpp:111 0x00007fff84e7db3c: leaq -0x48(%rbp), %rcx 0x00007fff84e7db40: leaq -0xc0(%rbp), %r9 0x00007fff84e7db47: movq %rbx, %rdi 0x00007fff84e7db4a: movl %r13d, %edx -> 0x00007fff84e7db4d: callq 0x225330 ; WebCore::JSMainThreadExecState::call at JSMainThreadExecState.h:51 0x00007fff84e7db52: jmp 0x269b81 ; <+497> [inlined] WebCore::InspectorInstrumentation::hasFrontends() at InspectorInstrumentation.h:853 0x00007fff84e7db54: movq -0x58(%rbp), %rax 0x00007fff84e7db58: movq %rax, -0xd0(%rbp) 0x00007fff84e7db5f: movl -0xa0(%rbp), %eax
rdar://problem/16542323
Created attachment 277284 [details] Patch
Comment on attachment 277284 [details] Patch Clearing flags on attachment: 277284 Committed r200062: <http://trac.webkit.org/changeset/200062>
All reviewed patches have been landed. Closing bug.