Bug 171929 – Accessibility: nullptr dereference in RenderSlider::layout()

• Status: NEW
• Component: Accessibility

[zalan]

>RenderBox* thumbBox = element().sliderThumbElement()->renderBox();
element().sliderThumbElement() is nullptr.

run-webkit-test
  fast/forms/range/range-type-change-onchange-2.html
  fast/forms/range/range-type-change-onchange.html
  fast/forms/range/range-type-change-oninput.html
with AX on.

0   com.apple.WebCore             	0x0000000118c1ad7f WebCore::Node::getFlag(WebCore::Node::NodeFlags) const + 15 (Node.h:610)
1   com.apple.WebCore             	0x0000000118c1db1a WebCore::Node::hasRareData() const + 26 (Node.h:636)
2   com.apple.WebCore             	0x0000000118c1dab9 WebCore::Node::renderer() const + 25 (Node.h:418)
3   com.apple.WebCore             	0x000000011aca7bb5 WebCore::Node::renderBox() const + 21 (Node.cpp:725)
4   com.apple.WebCore             	0x000000011b099d99 WebCore::RenderSlider::layout() + 57 (RenderSlider.cpp:109)
5   com.apple.WebCore             	0x0000000119604ecc WebCore::RenderElement::layoutIfNeeded() + 60 (RenderElement.h:130)
6   com.apple.WebCore             	0x000000011aeb8179 WebCore::RenderBlockFlow::layoutLineBoxes(bool, WebCore::LayoutUnit&, WebCore::LayoutUnit&) + 1561 (RenderBlockLineLayout.cpp:1737)
7   com.apple.WebCore             	0x000000011ae8e481 WebCore::RenderBlockFlow::layoutInlineChildren(bool, WebCore::LayoutUnit&, WebCore::LayoutUnit&) + 385 (RenderBlockFlow.cpp:709)
8   com.apple.WebCore             	0x000000011ae8d3a7 WebCore::RenderBlockFlow::layoutBlock(bool, WebCore::LayoutUnit) + 1079 (RenderBlockFlow.cpp:542)
9   com.apple.WebCore             	0x000000011ae4ede3 WebCore::RenderBlock::layout() + 115 (RenderBlock.cpp:1072)
10  com.apple.WebCore             	0x000000011ae91196 WebCore::RenderBlockFlow::layoutBlockChild(WebCore::RenderBox&, WebCore::RenderBlockFlow::MarginInfo&, WebCore::LayoutUnit&, WebCore::LayoutUnit&) + 1270 (RenderBlockFlow.cpp:769)
11  com.apple.WebCore             	0x000000011ae8e6ea WebCore::RenderBlockFlow::layoutBlockChildren(bool, WebCore::LayoutUnit&) + 602 (RenderBlockFlow.cpp:668)
12  com.apple.WebCore             	0x000000011ae8d3ca WebCore::RenderBlockFlow::layoutBlock(bool, WebCore::LayoutUnit) + 1114 (RenderBlockFlow.cpp:547)
13  com.apple.WebCore             	0x000000011ae4ede3 WebCore::RenderBlock::layout() + 115 (RenderBlock.cpp:1072)
14  com.apple.WebCore             	0x000000011ae91196 WebCore::RenderBlockFlow::layoutBlockChild(WebCore::RenderBox&, WebCore::RenderBlockFlow::MarginInfo&, WebCore::LayoutUnit&, WebCore::LayoutUnit&) + 1270 (RenderBlockFlow.cpp:769)
15  com.apple.WebCore             	0x000000011ae8e6ea WebCore::RenderBlockFlow::layoutBlockChildren(bool, WebCore::LayoutUnit&) + 602 (RenderBlockFlow.cpp:668)
16  com.apple.WebCore             	0x000000011ae8d3ca WebCore::RenderBlockFlow::layoutBlock(bool, WebCore::LayoutUnit) + 1114 (RenderBlockFlow.cpp:547)
17  com.apple.WebCore             	0x000000011ae4ede3 WebCore::RenderBlock::layout() + 115 (RenderBlock.cpp:1072)
18  com.apple.WebCore             	0x000000011b1ba691 WebCore::RenderView::layoutContent(WebCore::LayoutState const&) + 97 (RenderView.cpp:250)
19  com.apple.WebCore             	0x000000011b1bb702 WebCore::RenderView::layout() + 2082 (RenderView.cpp:377)
20  com.apple.WebCore             	0x0000000119775298 WebCore::FrameView::layout(bool) + 4040 (FrameView.cpp:1491)
21  com.apple.WebCore             	0x000000011937653c WebCore::Document::updateLayout() + 332 (Document.cpp:1858)
22  com.apple.WebCore             	0x000000011937af9e WebCore::Document::updateLayoutIgnorePendingStylesheets(WebCore::Document::RunPostLayoutTasks) + 94 (Document.cpp:1874)
23  com.apple.WebCore             	0x000000011b8bf91b WebCore::VisiblePosition::canonicalPosition(WebCore::Position const&) + 187 (VisiblePosition.cpp:560)
24  com.apple.WebCore             	0x000000011b8bf771 WebCore::VisiblePosition::init(WebCore::Position const&, WebCore::EAffinity) + 49 (VisiblePosition.cpp:60)
25  com.apple.WebCore             	0x000000011b8bf733 WebCore::VisiblePosition::VisiblePosition(WebCore::Position const&, WebCore::EAffinity) + 51 (VisiblePosition.cpp:54)
26  com.apple.WebCore             	0x000000011b8bf853 WebCore::VisiblePosition::VisiblePosition(WebCore::Position const&, WebCore::EAffinity) + 35 (VisiblePosition.cpp:54)
27  com.apple.WebCore             	0x0000000119a3148c WebCore::HTMLTextFormControlElement::setInnerTextValue(WTF::String const&) + 572 (HTMLTextFormControlElement.cpp:580)
28  com.apple.WebCore             	0x000000011b74118c WebCore::TextFieldInputType::updateInnerTextValue() + 108 (TextFieldInputType.cpp:576)
29  com.apple.WebCore             	0x0000000119971d2c WebCore::HTMLInputElement::updateType() + 1804 (HTMLInputElement.cpp:519)
30  com.apple.WebCore             	0x0000000119972ecb WebCore::HTMLInputElement::parseAttribute(WebCore::QualifiedName const&, WTF::AtomicString const&) + 587 (HTMLInputElement.cpp:693)
31  com.apple.WebCore             	0x000000011950d7c9 WebCore::Element::attributeChanged(WebCore::QualifiedName const&, WTF::AtomicString const&, WTF::AtomicString const&, WebCore::Element::AttributeModificationReason) + 793 (Element.cpp:1335)
32  com.apple.WebCore             	0x000000011b53207f WebCore::StyledElement::attributeChanged(WebCore::QualifiedName const&, WTF::AtomicString const&, WTF::AtomicString const&, WebCore::Element::AttributeModificationReason) + 223 (StyledElement.cpp:91)
33  com.apple.WebCore             	0x0000000119519664 WebCore::Element::didModifyAttribute(WebCore::QualifiedName const&, WTF::AtomicString const&, WTF::AtomicString const&) + 84 (Element.cpp:3374)
34  com.apple.WebCore             	0x000000011950d390 WebCore::Element::setAttributeInternal(unsigned int, WebCore::QualifiedName const&, WTF::AtomicString const&, WebCore::Element::SynchronizationOfLazyAttribute) + 432 (Element.cpp:1290)
35  com.apple.WebCore             	0x000000011950d425 WebCore::Element::setAttributeWithoutSynchronization(WebCore::QualifiedName const&, WTF::AtomicString const&) + 117 (Element.cpp:1246)
36  com.apple.WebCore             	0x000000011997161a WebCore::HTMLInputElement::setType(WTF::AtomicString const&) + 42 (HTMLInputElement.cpp:479)
37  com.apple.WebCore             	0x000000011a235429 WebCore::setJSHTMLInputElementTypeFunction(JSC::ExecState&, WebCore::JSHTMLInputElement&, JSC::JSValue, JSC::ThrowScope&) + 169 (JSHTMLInputElement.cpp:1675)
38  com.apple.WebCore             	0x000000011a22e83c bool WebCore::BindingCaller<WebCore::JSHTMLInputElement>::setAttribute<&(WebCore::setJSHTMLInputElementTypeFunction(JSC::ExecState&, WebCore::JSHTMLInputElement&, JSC::JSValue, JSC::ThrowScope&)), (WebCore::CastedThisErrorBehavior)0>(JSC::ExecState*, long long, long long, char const*) + 348 (JSDOMBindingCaller.h:82)
39  com.apple.WebCore             	0x000000011a22e6cc WebCore::setJSHTMLInputElementType(JSC::ExecState*, long long, long long) + 44 (JSHTMLInputElement.cpp:1665)
40  com.apple.JavaScriptCore      	0x00000001139472ad JSC::callCustomSetter(JSC::ExecState*, bool (*)(JSC::ExecState*, long long, long long), bool, JSC::JSValue, JSC::JSValue) + 157 (CustomGetterSetter.cpp:41)
41  com.apple.JavaScriptCore      	0x0000000113947383 JSC::callCustomSetter(JSC::ExecState*, JSC::JSValue, bool, JSC::JSObject*, JSC::JSValue, JSC::JSValue) + 163 (CustomGetterSetter.cpp:58)
42  com.apple.JavaScriptCore      	0x0000000114215c0a JSC::JSObject::putInlineSlow(JSC::ExecState*, JSC::PropertyName, JSC::JSValue, JSC::PutPropertySlot&) + 1034 (JSObject.cpp:779)
43  com.apple.JavaScriptCore      	0x00000001139245c8 JSC::JSObject::putInline(JSC::JSCell*, JSC::ExecState*, JSC::PropertyName, JSC::JSValue, JSC::PutPropertySlot&) + 1160 (JSObjectInlines.h:221)
44  com.apple.JavaScriptCore      	0x000000011391e314 JSC::JSValue::putInline(JSC::ExecState*, JSC::PropertyName, JSC::JSValue, JSC::PutPropertySlot&) + 260 (JSCJSValueInlines.h:883)
45  com.apple.JavaScriptCore      	0x00000001143272a5 llint_slow_path_put_by_id + 645 (LLIntSlowPaths.cpp:727)
46  com.apple.JavaScriptCore      	0x000000011433861b llint_entry + 14103 (LowLevelInterpreter64.asm:307)
47  com.apple.JavaScriptCore      	0x0000000114334cee vmEntryToJavaScript + 334 (LowLevelInterpreter64.asm:256)
48  com.apple.JavaScriptCore      	0x00000001141082ce JSC::JITCode::execute(JSC::VM*, JSC::ProtoCallFrame*) + 350 (JITCode.cpp:81)
49  com.apple.JavaScriptCore      	0x00000001140b87a5 JSC::Interpreter::executeCall(JSC::ExecState*, JSC::JSObject*, JSC::CallType, JSC::CallData const&, JSC::JSValue, JSC::ArgList const&) + 1269 (Interpreter.cpp:955)
50  com.apple.JavaScriptCore      	0x000000011386a6d8 JSC::call(JSC::ExecState*, JSC::JSValue, JSC::CallType, JSC::CallData const&, JSC::JSValue, JSC::ArgList const&) + 184 (CallData.cpp:39)
51  com.apple.JavaScriptCore      	0x000000011386a7e9 JSC::call(JSC::ExecState*, JSC::JSValue, JSC::CallType, JSC::CallData const&, JSC::JSValue, JSC::ArgList const&, WTF::NakedPtr<JSC::Exception>&) + 201 (CallData.cpp:46)
52  com.apple.JavaScriptCore      	0x000000011386aa7d JSC::profiledCall(JSC::ExecState*, JSC::ProfilingReason, JSC::JSValue, JSC::CallType, JSC::CallData const&, JSC::JSValue, JSC::ArgList const&, WTF::NakedPtr<JSC::Exception>&) + 125 (CallData.cpp:65)
53  com.apple.WebCore             	0x0000000119e2481b WebCore::JSMainThreadExecState::profiledCall(JSC::ExecState*, JSC::ProfilingReason, JSC::JSValue, JSC::CallType, JSC::CallData const&, JSC::JSValue, JSC::ArgList const&, WTF::NakedPtr<JSC::Exception>&) + 139 (JSMainThreadExecState.h:71)
54  com.apple.WebCore             	0x000000011a0e99e9 WebCore::JSEventListener::handleEvent(WebCore::ScriptExecutionContext*, WebCore::Event*) + 1801 (JSEventListener.cpp:155)
55  com.apple.WebCore             	0x0000000119578216 WebCore::EventTarget::fireEventListeners(WebCore::Event&, WTF::Vector<WTF::RefPtr<WebCore::RegisteredEventListener>, 1ul, WTF::CrashOnOverflow, 16ul>) + 742 (EventTarget.cpp:266)
56  com.apple.WebCore             	0x0000000119577dde WebCore::EventTarget::fireEventListeners(WebCore::Event&) + 318 (EventTarget.cpp:209)
57  com.apple.WebCore             	0x000000011acafff1 WebCore::Node::handleLocalEvents(WebCore::Event&) + 177 (Node.cpp:2215)
58  com.apple.WebCore             	0x000000011954297b WebCore::EventContext::handleLocalEvents(WebCore::Event&) const + 171 (EventContext.cpp:55)
59  com.apple.WebCore             	0x00000001195435a9 WebCore::dispatchEventInDOM(WebCore::Event&, WebCore::EventPath const&) + 233 (EventDispatcher.cpp:90)
60  com.apple.WebCore             	0x0000000119543117 WebCore::EventDispatcher::dispatchEvent(WebCore::Node&, WebCore::Event&) + 535 (EventDispatcher.cpp:162)
61  com.apple.WebCore             	0x000000011b298744 WebCore::ScopedEventQueue::dispatchEvent(WebCore::Event&) const + 196 (ScopedEventQueue.cpp:59)
62  com.apple.WebCore             	0x000000011b298671 WebCore::ScopedEventQueue::enqueueEvent(WTF::Ref<WebCore::Event>&&) + 81 (ScopedEventQueue.cpp:52)
63  com.apple.WebCore             	0x0000000119542e19 WebCore::EventDispatcher::dispatchScopedEvent(WebCore::Node&, WebCore::Event&) + 105 (EventDispatcher.cpp:50)
64  com.apple.WebCore             	0x000000011acb001d WebCore::Node::dispatchScopedEvent(WebCore::Event&) + 29 (Node.cpp:2221)
65  com.apple.WebCore             	0x000000011994d3f7 WebCore::HTMLFormControlElement::dispatchChangeEvent() + 71 (HTMLFormControlElement.cpp:317)
66  com.apple.WebCore             	0x0000000119a30b1b WebCore::HTMLTextFormControlElement::dispatchFormControlChangeEvent() + 107 (HTMLTextFormControlElement.cpp:211)
67  com.apple.WebCore             	0x000000011b41a543 WebCore::SliderThumbElement::defaultEventHandler(WebCore::Event&) + 323 (SliderThumbElement.cpp:368)
68  com.apple.WebCore             	0x0000000119543746 WebCore::callDefaultEventHandlersInTheBubblingOrder(WebCore::Event&, WebCore::EventPath const&) + 102 (EventDispatcher.cpp:60)
69  com.apple.WebCore             	0x00000001195431f1 WebCore::EventDispatcher::dispatchEvent(WebCore::Node&, WebCore::Event&) + 753 (EventDispatcher.cpp:178)
70  com.apple.WebCore             	0x000000011acb004d WebCore::Node::dispatchEvent(WebCore::Event&) + 29 (Node.cpp:2229)
71  com.apple.WebCore             	0x0000000119506e5f WebCore::Element::dispatchMouseEvent(WebCore::PlatformMouseEvent const&, WTF::AtomicString const&, int, WebCore::Element*) + 431 (Element.cpp:284)
72  com.apple.WebCore             	0x000000011954c45c WebCore::EventHandler::dispatchMouseEvent(WTF::AtomicString const&, WebCore::Node*, bool, int, WebCore::PlatformMouseEvent const&, bool) + 220 (EventHandler.cpp:2553)
73  com.apple.WebCore             	0x000000011954ee33 WebCore::EventHandler::handleMouseReleaseEvent(WebCore::PlatformMouseEvent const&) + 1459 (EventHandler.cpp:2077)
74  com.apple.WebCore             	0x000000011b8909bf WebCore::UserInputBridge::handleMouseReleaseEvent(WebCore::PlatformMouseEvent const&, WebCore::InputSource) + 767 (UserInputBridge.cpp:111)
75  com.apple.WebKit              	0x000000010e71afa1 WebKit::handleMouseEvent(WebKit::WebMouseEvent const&, WebKit::WebPage*, bool) + 337 (WebPage.cpp:2318)
76  com.apple.WebKit              	0x000000010e71acd9 WebKit::WebPage::mouseEvent(WebKit::WebMouseEvent const&) + 505 (WebPage.cpp:2377)
77  com.apple.WebKit              	0x000000010e79d7b6 void IPC::callMemberFunctionImpl<WebKit::WebPage, void (WebKit::WebPage::*)(WebKit::WebMouseEvent const&), std::__1::tuple<WebKit::WebMouseEvent>, 0ul>(WebKit::WebPage*, void (WebKit::WebPage::*)(WebKit::WebMouseEvent const&), std::__1::tuple<WebKit::WebMouseEvent>&&, std::__1::integer_sequence<unsigned long, 0ul>) + 150 (HandleMessage.h:41)
78  com.apple.WebKit              	0x000000010e79d718 void IPC::callMemberFunction<WebKit::WebPage, void (WebKit::WebPage::*)(WebKit::WebMouseEvent const&), std::__1::tuple<WebKit::WebMouseEvent>, std::__1::integer_sequence<unsigned long, 0ul> >(std::__1::tuple<WebKit::WebMouseEvent>&&, WebKit::WebPage*, void (WebKit::WebPage::*)(WebKit::WebMouseEvent const&)) + 88 (HandleMessage.h:47)
79  com.apple.WebKit              	0x000000010e78e0f3 void IPC::handleMessage<Messages::WebPage::MouseEvent, WebKit::WebPage, void (WebKit::WebPage::*)(WebKit::WebMouseEvent const&)>(IPC::Decoder&, WebKit::WebPage*, void (WebKit::WebPage::*)(WebKit::WebMouseEvent const&)) + 243 (HandleMessage.h:127)
80  com.apple.WebKit              	0x000000010e787810 WebKit::WebPage::didReceiveWebPageMessage(IPC::Connection&, IPC::Decoder&) + 1440 (WebPageMessageReceiver.cpp:191)
81  com.apple.WebKit              	0x000000010e723c6e WebKit::WebPage::didReceiveMessage(IPC::Connection&, IPC::Decoder&) + 510 (WebPage.cpp:4161)
82  com.apple.WebKit              	0x000000010e723cb4 non-virtual thunk to WebKit::WebPage::didReceiveMessage(IPC::Connection&, IPC::Decoder&) + 52 (WebPage.cpp:4133)
83  com.apple.WebKit              	0x000000010e0bfc98 IPC::MessageReceiverMap::dispatchMessage(IPC::Connection&, IPC::Decoder&) + 456 (MessageReceiverMap.cpp:124)
84  com.apple.WebKit              	0x000000010e95c2ad WebKit::WebProcess::didReceiveMessage(IPC::Connection&, IPC::Decoder&) + 61 (WebProcess.cpp:654)
85  com.apple.WebKit              	0x000000010df73da3 IPC::Connection::dispatchMessage(IPC::Decoder&) + 51 (Connection.cpp:902)
86  com.apple.WebKit              	0x000000010df69468 IPC::Connection::dispatchMessage(std::__1::unique_ptr<IPC::Decoder, std::__1::default_delete<IPC::Decoder> >) + 712 (Connection.cpp:930)
87  com.apple.WebKit              	0x000000010df68d76 IPC::Connection::SyncMessageState::dispatchMessages(IPC::Connection*) + 854 (Connection.cpp:178)
88  com.apple.WebKit              	0x000000010df7366d IPC::Connection::dispatchSyncMessage(IPC::Decoder&) + 1581 (Connection.cpp:856)
89  com.apple.WebKit              	0x000000010df69429 IPC::Connection::dispatchMessage(std::__1::unique_ptr<IPC::Decoder, std::__1::default_delete<IPC::Decoder> >) + 649 (Connection.cpp:926)
90  com.apple.WebKit              	0x000000010df68d76 IPC::Connection::SyncMessageState::dispatchMessages(IPC::Connection*) + 854 (Connection.cpp:178)
91  com.apple.WebKit              	0x000000010df6ec8a IPC::Connection::waitForSyncReply(unsigned long long, WTF::Seconds, WTF::OptionSet<IPC::SendSyncOption>) + 266 (Connection.cpp:559)
92  com.apple.WebKit              	0x000000010df6cdcb IPC::Connection::sendSyncMessage(unsigned long long, std::__1::unique_ptr<IPC::Encoder, std::__1::default_delete<IPC::Encoder> >, WTF::Seconds, WTF::OptionSet<IPC::SendSyncOption>) + 1547 (Connection.cpp:532)
93  com.apple.WebKit              	0x000000010e760713 bool IPC::Connection::sendSync<Messages::WebPageProxy::HandleSynchronousMessage>(Messages::WebPageProxy::HandleSynchronousMessage&&, Messages::WebPageProxy::HandleSynchronousMessage::Reply&&, unsigned long long, WTF::Seconds, WTF::OptionSet<IPC::SendSyncOption>) + 899 (Connection.h:396)
94  com.apple.WebKit              	0x000000010e76035b bool IPC::MessageSender::sendSync<Messages::WebPageProxy::HandleSynchronousMessage>(Messages::WebPageProxy::HandleSynchronousMessage&&, Messages::WebPageProxy::HandleSynchronousMessage::Reply&&, unsigned long long, WTF::Seconds, WTF::OptionSet<IPC::SendSyncOption>) + 187 (MessageSender.h:65)
95  com.apple.WebKit              	0x000000010e72d3c9 bool IPC::MessageSender::sendSync<Messages::WebPageProxy::HandleSynchronousMessage>(Messages::WebPageProxy::HandleSynchronousMessage&&, Messages::WebPageProxy::HandleSynchronousMessage::Reply&&, WTF::Seconds, WTF::OptionSet<IPC::SendSyncOption>) + 121 (MessageSender.h:57)
96  com.apple.WebKit              	0x000000010e72d285 WebKit::WebPage::postSynchronousMessageForTesting(WTF::String const&, API::Object*, WTF::RefPtr<API::Object>&) + 341 (WebPage.cpp:5767)
97  com.apple.WebKit              	0x000000010eb75469 WKBundlePagePostSynchronousMessageForTesting + 105 (WKBundlePage.cpp:622)
98  com.apple.WebKitTestRunner.InjectedBundle	0x00000001184b9e9e WTR::EventSendingController::mouseUp(int, OpaqueJSValue const*) + 206 (EventSendingController.cpp:235)
99  com.apple.WebKitTestRunner.InjectedBundle	0x00000001184e2341 WTR::JSEventSendingController::mouseUp(OpaqueJSContext const*, OpaqueJSValue*, OpaqueJSValue*, unsigned long, OpaqueJSValue const* const*, OpaqueJSValue const**) + 209 (JSEventSendingController.cpp:117)
100 com.apple.JavaScriptCore      	0x00000001141671f7 long long JSC::APICallbackFunction::call<JSC::JSCallbackFunction>(JSC::ExecState*) + 551 (APICallbackFunction.h:63)
101 com.apple.JavaScriptCore      	0x0000000114332d8a JSC::LLInt::handleHostCall(JSC::ExecState*, JSC::Instruction*, JSC::JSValue, JSC::CodeSpecializationKind) + 378 (LLIntSlowPaths.cpp:1239)
102 com.apple.JavaScriptCore      	0x000000011432e99d JSC::LLInt::setUpCall(JSC::ExecState*, JSC::Instruction*, JSC::CodeSpecializationKind, JSC::JSValue, JSC::LLIntCallLinkInfo*) + 253 (LLIntSlowPaths.cpp:1288)
103 com.apple.JavaScriptCore      	0x000000011432dc63 JSC::LLInt::genericCall(JSC::ExecState*, JSC::Instruction*, JSC::CodeSpecializationKind) + 227 (LLIntSlowPaths.cpp:1355)
104 com.apple.JavaScriptCore      	0x000000011432db53 llint_slow_path_call + 163 (LLIntSlowPaths.cpp:1362)
105 com.apple.JavaScriptCore      	0x000000011433c41f llint_entry + 29979 (LowLevelInterpreter.asm:860)
106 com.apple.JavaScriptCore      	0x000000011433c431 llint_entry + 29997 (LowLevelInterpreter.asm:761)
107 com.apple.JavaScriptCore      	0x0000000114334cee vmEntryToJavaScript + 334 (LowLevelInterpreter64.asm:256)
108 com.apple.JavaScriptCore      	0x00000001141082ce JSC::JITCode::execute(JSC::VM*, JSC::ProtoCallFrame*) + 350 (JITCode.cpp:81)
109 com.apple.JavaScriptCore      	0x00000001140b87a5 JSC::Interpreter::executeCall(JSC::ExecState*, JSC::JSObject*, JSC::CallType, JSC::CallData const&, JSC::JSValue, JSC::ArgList const&) + 1269 (Interpreter.cpp:955)
110 com.apple.JavaScriptCore      	0x000000011386a6d8 JSC::call(JSC::ExecState*, JSC::JSValue, JSC::CallType, JSC::CallData const&, JSC::JSValue, JSC::ArgList const&) + 184 (CallData.cpp:39)
111 com.apple.JavaScriptCore      	0x000000011386a7e9 JSC::call(JSC::ExecState*, JSC::JSValue, JSC::CallType, JSC::CallData const&, JSC::JSValue, JSC::ArgList const&, WTF::NakedPtr<JSC::Exception>&) + 201 (CallData.cpp:46)
112 com.apple.JavaScriptCore      	0x000000011386aa7d JSC::profiledCall(JSC::ExecState*, JSC::ProfilingReason, JSC::JSValue, JSC::CallType, JSC::CallData const&, JSC::JSValue, JSC::ArgList const&, WTF::NakedPtr<JSC::Exception>&) + 125 (CallData.cpp:65)
113 com.apple.WebCore             	0x0000000119e2481b WebCore::JSMainThreadExecState::profiledCall(JSC::ExecState*, JSC::ProfilingReason, JSC::JSValue, JSC::CallType, JSC::CallData const&, JSC::JSValue, JSC::ArgList const&, WTF::NakedPtr<JSC::Exception>&) + 139 (JSMainThreadExecState.h:71)
114 com.apple.WebCore             	0x000000011a0e99e9 WebCore::JSEventListener::handleEvent(WebCore::ScriptExecutionContext*, WebCore::Event*) + 1801 (JSEventListener.cpp:155)
115 com.apple.WebCore             	0x0000000119578216 WebCore::EventTarget::fireEventListeners(WebCore::Event&, WTF::Vector<WTF::RefPtr<WebCore::RegisteredEventListener>, 1ul, WTF::CrashOnOverflow, 16ul>) + 742 (EventTarget.cpp:266)
116 com.apple.WebCore             	0x0000000119577dde WebCore::EventTarget::fireEventListeners(WebCore::Event&) + 318 (EventTarget.cpp:209)
117 com.apple.WebCore             	0x000000011947e523 WebCore::DOMWindow::dispatchEvent(WebCore::Event&, WebCore::EventTarget*) + 435 (DOMWindow.cpp:1993)
118 com.apple.WebCore             	0x0000000119489210 WebCore::DOMWindow::dispatchLoadEvent() + 256 (DOMWindow.cpp:1953)
119 com.apple.WebCore             	0x0000000119380968 WebCore::Document::dispatchWindowLoadEvent() + 136 (Document.cpp:4041)
120 com.apple.WebCore             	0x000000011937a92c WebCore::Document::implicitClose() + 588 (Document.cpp:2644)
121 com.apple.WebCore             	0x00000001197400cb WebCore::FrameLoader::checkCallImplicitClose() + 155 (FrameLoader.cpp:900)
122 com.apple.WebCore             	0x000000011973fde0 WebCore::FrameLoader::checkCompleted() + 384 (FrameLoader.cpp:847)
123 com.apple.WebCore             	0x000000011973fe45 WebCore::FrameLoader::loadDone() + 21 (FrameLoader.cpp:768)
124 com.apple.WebCore             	0x0000000118eab579 WebCore::CachedResourceLoader::loadDone(bool) + 105 (CachedResourceLoader.cpp:1168)
125 com.apple.WebCore             	0x000000011b5bc0a9 WebCore::SubresourceLoader::notifyDone() + 105 (SubresourceLoader.cpp:666)
126 com.apple.WebCore             	0x000000011b5ba83e WebCore::SubresourceLoader::didFinishLoading(WebCore::NetworkLoadMetrics const&) + 846 (SubresourceLoader.cpp:572)
127 com.apple.WebKit              	0x000000010ea2e88d WebKit::WebResourceLoader::didFinishResourceLoad(WebCore::NetworkLoadMetrics const&) + 413 (WebResourceLoader.cpp:151)
128 com.apple.WebKit              	0x000000010ea33526 void IPC::callMemberFunctionImpl<WebKit::WebResourceLoader, void (WebKit::WebResourceLoader::*)(WebCore::NetworkLoadMetrics const&), std::__1::tuple<WebCore::NetworkLoadMetrics>, 0ul>(WebKit::WebResourceLoader*, void (WebKit::WebResourceLoader::*)(WebCore::NetworkLoadMetrics const&), std::__1::tuple<WebCore::NetworkLoadMetrics>&&, std::__1::integer_sequence<unsigned long, 0ul>) + 150 (HandleMessage.h:41)
129 com.apple.WebKit              	0x000000010ea33398 void IPC::callMemberFunction<WebKit::WebResourceLoader, void (WebKit::WebResourceLoader::*)(WebCore::NetworkLoadMetrics const&), std::__1::tuple<WebCore::NetworkLoadMetrics>, std::__1::integer_sequence<unsigned long, 0ul> >(std::__1::tuple<WebCore::NetworkLoadMetrics>&&, WebKit::WebResourceLoader*, void (WebKit::WebResourceLoader::*)(WebCore::NetworkLoadMetrics const&)) + 88 (HandleMessage.h:47)
130 com.apple.WebKit              	0x000000010ea32672 void IPC::handleMessage<Messages::WebResourceLoader::DidFinishResourceLoad, WebKit::WebResourceLoader, void (WebKit::WebResourceLoader::*)(WebCore::NetworkLoadMetrics const&)>(IPC::Decoder&, WebKit::WebResourceLoader*, void (WebKit::WebResourceLoader::*)(WebCore::NetworkLoadMetrics const&)) + 258 (HandleMessage.h:127)
131 com.apple.WebKit              	0x000000010ea31dac WebKit::WebResourceLoader::didReceiveWebResourceLoaderMessage(IPC::Connection&, IPC::Decoder&) + 636 (WebResourceLoaderMessageReceiver.cpp:66)
132 com.apple.WebKit              	0x000000010e222509 WebKit::NetworkProcessConnection::didReceiveMessage(IPC::Connection&, IPC::Decoder&) + 169 (NetworkProcessConnection.cpp:66)
133 com.apple.WebKit              	0x000000010df73da3 IPC::Connection::dispatchMessage(IPC::Decoder&) + 51 (Connection.cpp:902)
134 com.apple.WebKit              	0x000000010df69468 IPC::Connection::dispatchMessage(std::__1::unique_ptr<IPC::Decoder, std::__1::default_delete<IPC::Decoder> >) + 712 (Connection.cpp:930)
135 com.apple.WebKit              	0x000000010df743a0 IPC::Connection::dispatchOneMessage() + 1520 (Connection.cpp:959)
136 com.apple.WebKit              	0x000000010df8cfad IPC::Connection::enqueueIncomingMessage(std::__1::unique_ptr<IPC::Decoder, std::__1::default_delete<IPC::Decoder> >)::$_14::operator()() + 29 (Connection.cpp:896)
137 com.apple.WebKit              	0x000000010df8cf09 WTF::Function<void ()>::CallableWrapper<IPC::Connection::enqueueIncomingMessage(std::__1::unique_ptr<IPC::Decoder, std::__1::default_delete<IPC::Decoder> >)::$_14>::call() + 25 (Function.h:89)
138 com.apple.JavaScriptCore      	0x000000011480c0be WTF::Function<void ()>::operator()() const + 94 (Function.h:50)
139 com.apple.JavaScriptCore      	0x000000011482a65d WTF::RunLoop::performWork() + 445 (RunLoop.cpp:124)
140 com.apple.JavaScriptCore      	0x000000011482ad44 WTF::RunLoop::performWork(void*) + 36 (RunLoopCF.cpp:38)
141 com.apple.CoreFoundation      	0x00007fff8ccc53b1 __CFRUNLOOP_IS_CALLING_OUT_TO_A_SOURCE0_PERFORM_FUNCTION__ + 17
142 com.apple.CoreFoundation      	0x00007fff8cca663c __CFRunLoopDoSources0 + 556
143 com.apple.CoreFoundation      	0x00007fff8cca5b26 __CFRunLoopRun + 934
144 com.apple.CoreFoundation      	0x00007fff8cca5524 CFRunLoopRunSpecific + 420
145 com.apple.HIToolbox           	0x00007fff8c205ebc RunCurrentEventLoopInMode + 240
146 com.apple.HIToolbox           	0x00007fff8c205cf1 ReceiveNextEventCommon + 432
147 com.apple.HIToolbox           	0x00007fff8c205b26 _BlockUntilNextEventMatchingListInModeWithFilter + 71
148 com.apple.AppKit              	0x00007fff8a7a0e24 _DPSNextEvent + 1120
149 com.apple.AppKit              	0x00007fff8af1c85e -[NSApplication(NSEvent) _nextEventMatchingEventMask:untilDate:inMode:dequeue:] + 2796
150 com.apple.AppKit              	0x00007fff8a7957ab -[NSApplication run] + 926
151 com.apple.AppKit              	0x00007fff8a7601de NSApplicationMain + 1237
152 libxpc.dylib                  	0x00007fffa2aa88c7 _xpc_objc_main + 775
153 libxpc.dylib                  	0x00007fffa2aa72e4 xpc_main + 494
154 com.apple.WebKit.WebContent   	0x000000010de7c115 main + 1189 (XPCServiceMain.mm:148)
155 libdyld.dylib                 	0x00007fffa284f235 start + 1

[Radar WebKit Bug Importer]

<rdar://problem/32109938>