Crash under eventTargetRespectingTargetRules(): Thread[0] EXC_BAD_ACCESS (SIGSEGV) (KERN_INVALID_ADDRESS at 0x0000000000000014) [ 0] 0x00007fff8b857995 WebCore`WebCore::EventPath::EventPath(WebCore::Node&, WebCore::Event&) [inlined] WebCore::Node::getFlag(WebCore::Node::NodeFlags) const at Node.h:625:49 621 622 DefaultNodeFlags = IsParsingChildrenFinishedFlag 623 }; 624 -> 625 bool getFlag(NodeFlags mask) const { return m_nodeFlags & mask; } 626 void setFlag(bool f, NodeFlags mask) const { m_nodeFlags = (m_nodeFlags & ~mask) | (-(int32_t)f & mask); } 627 void setFlag(NodeFlags mask) const { m_nodeFlags |= mask; } 628 void clearFlag(NodeFlags mask) const { m_nodeFlags &= ~mask; } 629 0x00007fff8b85798a: testb %al, %al 0x00007fff8b85798c: movq %r15, %r14 0x00007fff8b85798f: je 0x5b3995 ; <+117> [inlined] WebCore::Node::getFlag(WebCore::Node::NodeFlags) const at Node.h:217 0x00007fff8b857991: movq 0x60(%r15), %r14 -> 0x00007fff8b857995: movl 0x14(%r14), %eax 0x00007fff8b857999: movl %eax, %ecx 0x00007fff8b85799b: andl $0x100004, %ecx ; imm = 0x100004 0x00007fff8b8579a1: cmpl $0x100004, %ecx ; imm = 0x100004 0x00007fff8b8579a7: jne 0x5b39cf ; <+175> [inlined] WebCore::Node::getFlag(WebCore::Node::NodeFlags) const + 4 at Node.h:221 [ 0] 0x00007fff8b857995 WebCore`WebCore::EventPath::EventPath(WebCore::Node&, WebCore::Event&) [inlined] WebCore::Node::isElementNode() const at Node.h:217 213 WEBCORE_EXPORT void remove(ExceptionCode&); 214 215 // Other methods (not part of DOM) 216 -> 217 bool isElementNode() const { return getFlag(IsElementFlag); } 218 bool isContainerNode() const { return getFlag(IsContainerFlag); } 219 bool isTextNode() const { return getFlag(IsTextFlag); } 220 bool isHTMLElement() const { return getFlag(IsHTMLFlag); } 221 bool isSVGElement() const { return getFlag(IsSVGFlag); } [ 0] 0x00007fff8b857995 WebCore`WebCore::EventPath::EventPath(WebCore::Node&, WebCore::Event&) [inlined] WebCore::Node::pseudoId() const at Node.h:227 223 224 bool isPseudoElement() const { return pseudoId() != NOPSEUDO; } 225 bool isBeforePseudoElement() const { return pseudoId() == BEFORE; } 226 bool isAfterPseudoElement() const { return pseudoId() == AFTER; } -> 227 PseudoId pseudoId() const { return (isElementNode() && hasCustomStyleResolveCallbacks()) ? customPseudoId() : NOPSEUDO; } 228 229 virtual bool isMediaControlElement() const { return false; } 230 virtual bool isMediaControls() const { return false; } 231 #if ENABLE(VIDEO_TRACK) [ 0] 0x00007fff8b857995 WebCore`WebCore::EventPath::EventPath(WebCore::Node&, WebCore::Event&) [inlined] WebCore::Node::isPseudoElement() const at Node.h:224 220 bool isHTMLElement() const { return getFlag(IsHTMLFlag); } 221 bool isSVGElement() const { return getFlag(IsSVGFlag); } 222 bool isMathMLElement() const { return getFlag(IsMathMLFlag); } 223 -> 224 bool isPseudoElement() const { return pseudoId() != NOPSEUDO; } 225 bool isBeforePseudoElement() const { return pseudoId() == BEFORE; } 226 bool isAfterPseudoElement() const { return pseudoId() == AFTER; } 227 PseudoId pseudoId() const { return (isElementNode() && hasCustomStyleResolveCallbacks()) ? customPseudoId() : NOPSEUDO; } 228 [ 0] 0x00007fff8b857995 WebCore`WebCore::EventPath::EventPath(WebCore::Node&, WebCore::Event&) [inlined] WTF::TypeCastTraits<WebCore::PseudoElement const, WebCore::Node const, false>::isType(WebCore::Node const&) at PseudoElement.h:83 [ 0] 0x00007fff8b857995 WebCore`WebCore::EventPath::EventPath(WebCore::Node&, WebCore::Event&) [inlined] WTF::TypeCastTraits<WebCore::PseudoElement const, WebCore::Node const, false>::isOfType(WebCore::Node const&) at PseudoElement.h:82 [ 0] 0x00007fff8b857995 WebCore`WebCore::EventPath::EventPath(WebCore::Node&, WebCore::Event&) [inlined] bool WTF::is<WebCore::PseudoElement, WebCore::Node>(WebCore::Node&) at TypeCasts.h:59 [ 0] 0x00007fff8b857995 WebCore`WebCore::EventPath::EventPath(WebCore::Node&, WebCore::Event&) [inlined] WebCore::EventPath::eventTargetRespectingTargetRules(WebCore::Node&) at EventPath.h:55 [ 0] 0x00007fff8b857995 WebCore`WebCore::EventPath::EventPath(WebCore::Node&, WebCore::Event&) + 117 at EventPath.cpp:94 [ 1] 0x00007fff8b84f47d WebCore`WebCore::EventDispatcher::dispatchEvent(WebCore::Node*, WebCore::Event&) + 77 at EventDispatcher.cpp:157:15 [ 2] 0x00007fff8b40cad3 WebCore`WebCore::AnimationControllerPrivate::fireEventsAndUpdateStyle() + 355 at AnimationController.cpp:208:13 [ 3] 0x00007fff8b581e66 WebCore`WebCore::AnimationControllerPrivate::animationTimerFired() + 182 at AnimationController.cpp:272:5 [ 4] 0x00007fff8b2b760f WebCore`WebCore::ThreadTimers::sharedTimerFiredInternal() + 175 at ThreadTimers.cpp:121:9 [ 5] 0x00007fff8b2b754e WebCore`WebCore::timerFired(__CFRunLoopTimer*, void*) + 30 at MainThreadSharedTimerCF.cpp:74:5
<rdar://problem/26343998>
Created attachment 280266 [details] Patch
Comment on attachment 280266 [details] Patch Clearing flags on attachment: 280266 Committed r201571: <http://trac.webkit.org/changeset/201571>
All reviewed patches have been landed. Closing bug.