Bug 181742 - REGRESSION (r226385?): Crash in com.apple.WebCore: WebCore::MediaQueryEvaluator::evaluate const + 32
Summary: REGRESSION (r226385?): Crash in com.apple.WebCore: WebCore::MediaQueryEvaluat...
Status: RESOLVED FIXED
Alias: None
Product: WebKit
Classification: Unclassified
Component: CSS (show other bugs)
Version: WebKit Nightly Build
Hardware: Unspecified Unspecified
: P2 Normal
Assignee: Nobody
URL:
Keywords: InRadar
Depends on:
Blocks:
 
Reported: 2018-01-17 07:42 PST by Antti Koivisto
Modified: 2018-01-17 13:53 PST (History)
4 users (show)

See Also:

Attachments
patch (5.93 KB, patch)
2018-01-17 08:00 PST, Antti Koivisto 		no flags Details | Formatted Diff | Diff
View All Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Antti Koivisto 2018-01-17 07:42:23 PST 
>  1 com.apple.WebCore              0x00bf2440 WebCore::MediaQueryEvaluator::evaluate(WebCore::MediaQueryExpression const&) const + 32
   2 com.apple.WebCore              0x00bf2278 WebCore::MediaQueryEvaluator::evaluate(WebCore::MediaQuerySet const&, WebCore::StyleResolver*) const + 344
   3 com.apple.WebCore              0x00bfdcf9 WebCore::RuleSet::addChildRules(WTF::Vector<WTF::RefPtr<WebCore::StyleRuleBase, WTF::DumbPtrTraits<WebCore::StyleRuleBase> >, 0ul, WTF::CrashOnOverflow, 16ul, WTF::FastMalloc> const&, WebCore::MediaQueryEvaluator const&, WebCore::StyleResolver*, bool) + 281
   4 com.apple.WebCore              0x00bfde71 WebCore::RuleSet::addRulesFromSheet(WebCore::StyleSheetContents&, WebCore::MediaQueryEvaluator const&, WebCore::StyleResolver*) + 145
   5 com.apple.WebCore              0x00be1fb7 WebCore::ElementRuleCollector::ElementRuleCollector(WebCore::Element const&, WebCore::DocumentRuleSets const&, WebCore::SelectorFilter const*) + 135
   6 com.apple.WebCore              0x00c0df0e WebCore::StyleResolver::styleForElement(WebCore::Element const&, WebCore::RenderStyle const*, WebCore::RenderStyle const*, WebCore::RuleMatchingBehavior, WebCore::SelectorFilter const*) + 798
   7 com.apple.WebCore              0x00caa22e WebCore::Document::styleForElementIgnoringPendingStylesheets(WebCore::Element&, WebCore::RenderStyle const*, WebCore::PseudoId) + 158
   8 com.apple.WebCore              0x00cdaefb WebCore::Element::resolveComputedStyle() + 699
   9 com.apple.WebCore              0x0007293a WebCore::Element::computedStyle(WebCore::PseudoId) + 186
  10 com.apple.WebCore              0x00e57a91 WebCore::HTMLTitleElement::computedTextWithDirection() + 33
  11 com.apple.WebCore              0x00e579ed WebCore::HTMLTitleElement::childrenChanged(WebCore::ContainerNode::ChildChange const&) + 29
  12 com.apple.WebCore              0x00c91d44 WebCore::ContainerNode::appendChildWithoutPreInsertionValidityCheck(WebCore::Node&) + 980
  13 com.apple.WebCore              0x00c93a65 WebCore::ContainerNode::replaceAllChildren(WTF::Ref<WebCore::Node, WTF::DumbPtrTraits<WebCore::Node> >&&) + 645
  14 com.apple.WebCore              0x00df1949 WebCore::HTMLElement::setInnerText(WTF::String const&) + 265
  15 com.apple.WebCore              0x0051b32e WebCore::setJSHTMLElementInnerText(JSC::ExecState*, long long, long long) + 334
Comment 1 Antti Koivisto 2018-01-17 07:42:56 PST 
<rdar://problem/36334726>
Comment 2 Antti Koivisto 2018-01-17 08:00:14 PST 
Created attachment 331494 [details]
patch
Comment 3 David Kilzer (:ddkilzer) 2018-01-17 12:45:13 PST 
Comment on attachment 331494 [details]
patch

View in context: https://bugs.webkit.org/attachment.cgi?id=331494&action=review

r=me, but maybe you want a review from Dean Jackson or another area expert.

> Source/WebCore/css/MediaQueryEvaluator.cpp:778
> +    if (!m_document)
> +        return m_fallbackResult;
> +
> +    Document& document = *m_document;
> +    auto* frame = document.frame();
> +    if (!frame || !frame->view() || !m_style)
>          return m_fallbackResult;

You could move the "!m_style" check to the first if statement to avoid a small amount of work:

    if (!m_document || !m_style)
        return m_fallbackResult;
Comment 4 WebKit Commit Bot 2018-01-17 13:53:31 PST 
Comment on attachment 331494 [details]
patch

Clearing flags on attachment: 331494

Committed r227082: <https://trac.webkit.org/changeset/227082>
Comment 5 WebKit Commit Bot 2018-01-17 13:53:32 PST 
All reviewed patches have been landed.  Closing bug.