Bug 202878 – [iOS] Crash in WebCore::DOMWindow::incrementScrollEventListenersCount

• Status: RESOLVED
• Resolution: FIXED
• Component: DOM

[Ryosuke Niwa]

e.g.
0   com.apple.WebCore             	0x0000000106a24527 WebCore::DOMWindow::incrementScrollEventListenersCount() + 7
1   com.apple.WebCore             	0x000000010656fa29 WebCore::Node::addEventListener(WTF::AtomString const&, WTF::Ref<WebCore::EventListener, WTF::DumbPtrTraits<WebCore::EventListener> >&&, WebCore::EventTarget::AddEventListenerOptions const&) + 441
2   com.apple.WebCore             	0x000000010654c30a WebCore::EventTarget::setAttributeEventListener(WTF::AtomString const&, WTF::RefPtr<WebCore::EventListener, WTF::DumbPtrTraits<WebCore::EventListener> >&&, WebCore::DOMWrapperWorld&) + 474
3   com.apple.WebCore             	0x0000000106277aed WebCore::setEventHandlerAttribute(JSC::ExecState&, JSC::JSObject&, WebCore::EventTarget&, WTF::AtomString const&, JSC::JSValue) + 285
4   com.apple.WebCore             	0x0000000105aa948b WebCore::setJSDocumentOnscroll(JSC::ExecState*, long long, long long) + 107
5   JavaScriptCore                	0x00000001050cf19f JSC::callCustomSetter(JSC::ExecState*, JSC::JSValue, bool, JSC::JSObject*, JSC::JSValue, JSC::JSValue) + 31
6   JavaScriptCore                	0x000000010517f922 JSC::JSObject::putInlineSlow(JSC::ExecState*, JSC::PropertyName, JSC::JSValue, JSC::PutPropertySlot&) + 994
7   JavaScriptCore                	0x0000000105170126 JSC::JSObject::put(JSC::JSCell*, JSC::ExecState*, JSC::PropertyName, JSC::JSValue, JSC::PutPropertySlot&) + 486
8   JavaScriptCore                	0x0000000104f3ac4c llint_slow_path_put_by_val + 1772

<rdar://problem/55609133>

[Ryosuke Niwa]

Created attachment 380820 [details]
Fixes the crash

[Ryosuke Niwa]

Committed r251057: <https://trac.webkit.org/changeset/251057>

[Darin Adler]

Comment on attachment 380820 [details]
Fixes the crash

View in context: https://bugs.webkit.org/attachment.cgi?id=380820&action=review

> Source/WebCore/dom/Node.cpp:2119
> +            targetNode->document().domWindow()->incrementScrollEventListenersCount();

Should use window-> here.

[Ryosuke Niwa]

Committed r251165: <https://trac.webkit.org/changeset/251165>

[Ryosuke Niwa]

(In reply to Darin Adler from comment #3)
> Comment on attachment 380820 [details]
> Fixes the crash
> 
> View in context:
> https://bugs.webkit.org/attachment.cgi?id=380820&action=review
> 
> > Source/WebCore/dom/Node.cpp:2119
> > +            targetNode->document().domWindow()->incrementScrollEventListenersCount();
> 
> Should use window-> here.

Oops, not sure what happened there. Fixed that.