Bug 181132 – Crash beneath ScriptedAnimationController::serviceScriptedAnimations after a requestAnimationFrame callback removes the requesting iframe

• Status: RESOLVED
• Resolution: FIXED
• Component: WebCore Misc.

<rdar://problem/35143540>

When multiple requestAnimationFrame callbacks are set to fire on a subframe, and one of the callbacks which isn’t the last removes the iframe from the document, a crash happens when ScriptedAnimationController::serviceScriptedAnimations calls InspectorInstrumentation::willFireAnimationFrame, dereferencing its now-null m_document member.

Here’s a minimal example:

<iframe id=target></iframe>
<script>
    const target = document.getElementById("target");
    const contentWindow = target.contentWindow;
    contentWindow.requestAnimationFrame(() => { target.remove() });
    contentWindow.requestAnimationFrame(() => { });
</script>

Created attachment 330136 [details]
Take a reference to the document before e firing callbacks

[Simon Fraser (smfr)]

Comment on attachment 330136 [details]
Take a reference to the document before e firing callbacks

Very nice.

Thanks, Simon!

Fixed in <https://trac.webkit.org/r226276>.