217936 – Web Inspector: REGRESSION(r260076): crash under InspectorInstrumentation::willApplyKeyframeEffect

RESOLVED FIXED 217936

Web Inspector: REGRESSION(r260076): crash under InspectorInstrumentation::willApplyKeyframeEffect

https://bugs.webkit.org/show_bug.cgi?id=217936

Summary Web Inspector: REGRESSION(r260076): crash under InspectorInstrumentation::wil...

Devin Rousso

Reported 2020-10-19 18:05:14 PDT

Thread 0 Crashed:: Dispatch queue: com.apple.main-thread 0 com.apple.WebCore 0x000000056909dab5 WebCore::Node::treeScope() const + 0 (Node.h:352) [inlined] 1 com.apple.WebCore 0x000000056909dab5 WebCore::Node::document() const + 0 (Node.h:347) [inlined] 2 com.apple.WebCore 0x000000056909dab5 WebCore::InspectorInstrumentation::willApplyKeyframeEffect(WebCore::Element&, WebCore::KeyframeEffect&, WebCore::ComputedEffectTiming) + 53 (InspectorInstrumentation.h:1510) 3 com.apple.WebCore 0x000000056909d9be WebCore::KeyframeEffect::apply(WebCore::RenderStyle&, WTF::Optional<WTF::Seconds>) + 382 (KeyframeEffect.cpp:1252) 4 com.apple.WebCore 0x00000005690a3dd5 WebCore::WebAnimation::resolve(WebCore::RenderStyle&, WTF::Optional<WTF::Seconds>) + 101 (WebAnimation.cpp:1241) 5 com.apple.WebCore 0x00000005693813ba WebCore::Element::applyKeyframeEffects(WebCore::PseudoId, WebCore::RenderStyle&) + 218 (Element.cpp:3831) 6 com.apple.WebCore 0x0000000569e2e8d0 WebCore::Styleable::applyKeyframeEffects(WebCore::RenderStyle&) const + 14 (Styleable.h:91) [inlined] 7 com.apple.WebCore 0x0000000569e2e8d0 WebCore::Style::TreeResolver::createAnimatedElementUpdate(std::__1::unique_ptr<WebCore::RenderStyle, std::__1::default_delete<WebCore::RenderStyle> >, WebCore::Styleable const&, WebCore::Style::Change) + 560 (StyleTreeResolver.cpp:356) 8 com.apple.WebCore 0x0000000569e2ec48 WebCore::Style::TreeResolver::resolvePseudoStyle(WebCore::Element&, WebCore::Style::ElementUpdate const&, WebCore::PseudoId) + 456 (StyleTreeResolver.cpp:280) 9 com.apple.WebCore 0x0000000569e2e5e3 WebCore::Style::TreeResolver::resolveElement(WebCore::Element&) + 1059 (StyleTreeResolver.cpp:248) 10 com.apple.WebCore 0x0000000569e2f37c WebCore::Style::TreeResolver::resolveComposedTree() + 1180 (StyleTreeResolver.cpp:542) 11 com.apple.WebCore 0x0000000569e2fef7 WebCore::Style::TreeResolver::resolve() + 679 (StyleTreeResolver.cpp:600) 12 com.apple.WebCore 0x000000056933d226 WebCore::Document::resolveStyle(WebCore::Document::ResolveStyleType) + 678 (Document.cpp:2025) 13 com.apple.WebCore 0x000000056933d6de WebCore::Document::updateStyleIfNeeded() + 302 (Document.cpp:2123) 14 com.apple.WebCore 0x00000005699d5676 WebCore::ThreadTimers::sharedTimerFiredInternal() + 198 (ThreadTimers.cpp:127) 15 com.apple.WebCore 0x00000005699f8e5f WebCore::timerFired(__CFRunLoopTimer*, void*) + 31 (MainThreadSharedTimerCF.cpp:74) 16 com.apple.CoreFoundation 0x00007fff2043fe5d __CFRUNLOOP_IS_CALLING_OUT_TO_A_TIMER_CALLBACK_FUNCTION__ + 20 17 com.apple.CoreFoundation 0x00007fff2043f938 __CFRunLoopDoTimer + 922 18 com.apple.CoreFoundation 0x00007fff2043f492 __CFRunLoopDoTimers + 307 19 com.apple.CoreFoundation 0x00007fff20425b0f __CFRunLoopRun + 2008 20 com.apple.CoreFoundation 0x00007fff20424c4e CFRunLoopRunSpecific + 563 21 com.apple.Foundation 0x00007fff20bc6251 -[NSRunLoop(NSRunLoop) runMode:beforeDate:] + 212 22 com.apple.Foundation 0x00007fff20c4fa44 -[NSRunLoop(NSRunLoop) runUntilDate:] + 103 23 com.apple.WebCore 0x000000056891046f WebCore::PageDebugger::platformShouldContinueRunningEventLoopWhilePaused() + 223 (PageDebuggerMac.mm:44) 24 com.apple.WebCore 0x0000000569722781 WebCore::PageDebugger::runEventLoopWhilePausedInternal() + 40 (PageDebugger.cpp:129) [inlined] 25 com.apple.WebCore 0x0000000569722781 WebCore::PageDebugger::runEventLoopWhilePaused() + 49 (PageDebugger.cpp:119) 26 com.apple.JavaScriptCore 0x000000056e4ebe6c JSC::Debugger::handlePause(JSC::JSGlobalObject*, JSC::Debugger::ReasonForPause) + 108 (Debugger.cpp:971) 27 com.apple.JavaScriptCore 0x000000056e4eb628 JSC::Debugger::pauseIfNeeded(JSC::JSGlobalObject*) + 1288 (Debugger.cpp:949) 28 com.apple.JavaScriptCore 0x000000056e4ec81e JSC::Debugger::updateCallFrame(JSC::JSGlobalObject*, JSC::CallFrame*, JSC::Debugger::CallFrameUpdateAction) + 53 (Debugger.cpp:837) [inlined] 29 com.apple.JavaScriptCore 0x000000056e4ec81e JSC::Debugger::atStatement(JSC::CallFrame*) + 238 (Debugger.cpp:1030) 30 com.apple.JavaScriptCore 0x000000056e977c5f llint_slow_path_debug + 95 (LLIntSlowPaths.cpp:2018) 31 com.apple.JavaScriptCore 0x000000056e1cc12f llint_entry + 122427 (LowLevelInterpreter64.asm:97) 32 com.apple.JavaScriptCore 0x000000056e1ca1af llint_entry + 114363 (LowLevelInterpreter.asm:1055) 33 com.apple.JavaScriptCore 0x000000056e1ae0ff vmEntryToJavaScript + 216 (LowLevelInterpreter64.asm:310) 34 com.apple.JavaScriptCore 0x000000056e86acd3 JSC::JITCode::execute(JSC::VM*, JSC::ProtoCallFrame*) + 36 (JITCodeInlines.h:42) [inlined] 35 com.apple.JavaScriptCore 0x000000056e86acd3 JSC::Interpreter::executeProgram(JSC::SourceCode const&, JSC::JSGlobalObject*, JSC::JSObject*) + 12275 (Interpreter.cpp:836) 36 com.apple.JavaScriptCore 0x000000056eb0a395 JSC::evaluate(JSC::JSGlobalObject*, JSC::SourceCode const&, JSC::JSValue, WTF::NakedPtr<JSC::Exception>&) + 245 (Completion.cpp:139) 37 com.apple.WebCore 0x00000005690f0c04 WebCore::JSExecState::profiledEvaluate(JSC::JSGlobalObject*, JSC::ProfilingReason, JSC::SourceCode const&, JSC::JSValue, WTF::NakedPtr<JSC::Exception>&) + 84 (JSExecState.h:79) 38 com.apple.WebCore 0x00000005690f09c3 WebCore::ScriptController::evaluateInWorld(WebCore::ScriptSourceCode const&, WebCore::DOMWrapperWorld&) + 195 (ScriptController.cpp:148) 39 com.apple.WebCore 0x00000005690f0c88 WebCore::ScriptController::evaluateInWorldIgnoringException(WebCore::ScriptSourceCode const&, WebCore::DOMWrapperWorld&) + 14 (ScriptController.cpp:121) [inlined] 40 com.apple.WebCore 0x00000005690f0c88 WebCore::ScriptController::evaluateIgnoringException(WebCore::ScriptSourceCode const&) + 40 (ScriptController.cpp:167) 41 com.apple.WebCore 0x00000005693dbe24 WebCore::ScriptElement::executeClassicScript(WebCore::ScriptSourceCode const&) + 516 (ScriptElement.cpp:400) 42 com.apple.WebCore 0x00000005693a25ba WebCore::LoadableClassicScript::execute(WebCore::ScriptElement&) + 122 (LoadableClassicScript.cpp:123) 43 com.apple.WebCore 0x00000005693dc2fd WebCore::ScriptElement::executeScriptAndDispatchEvent(WebCore::LoadableScript&) + 173 (ScriptElement.cpp:442) 44 com.apple.WebCore 0x0000000569682482 WebCore::HTMLScriptRunner::executePendingScriptAndDispatchEvent(WebCore::PendingScript&) + 89 (HTMLScriptRunner.cpp:114) [inlined] 45 com.apple.WebCore 0x0000000569682482 WebCore::HTMLScriptRunner::executeParsingBlockingScripts() + 258 (HTMLScriptRunner.cpp:164) 46 com.apple.WebCore 0x00000005696758fd WebCore::HTMLDocumentParser::runScriptsForPausedTreeBuilder() + 157 (HTMLDocumentParser.cpp:244) 47 com.apple.WebCore 0x0000000569675ccf WebCore::HTMLDocumentParser::pumpTokenizerLoop(WebCore::HTMLDocumentParser::SynchronousMode, bool, WebCore::PumpSession&) + 623 (HTMLDocumentParser.cpp:263) 48 com.apple.WebCore 0x00000005696755c3 WebCore::HTMLDocumentParser::pumpTokenizer(WebCore::HTMLDocumentParser::SynchronousMode) + 195 (HTMLDocumentParser.cpp:322) 49 com.apple.WebCore 0x00000005696769b8 WebCore::HTMLDocumentParser::pumpTokenizerIfPossible(WebCore::HTMLDocumentParser::SynchronousMode) + 84 (HTMLDocumentParser.cpp:196) [inlined] 50 com.apple.WebCore 0x00000005696769b8 WebCore::HTMLDocumentParser::resumeParsingAfterScriptExecution() + 136 (HTMLDocumentParser.cpp:542) 51 com.apple.WebCore 0x0000000569676c46 WebCore::HTMLDocumentParser::executeScriptsWaitingForStylesheets() + 54 (HTMLDocumentParser.cpp:610) 52 com.apple.WebCore 0x00000005693e3987 WebCore::ScriptableDocumentParser::scriptsWaitingForStylesheetsExecutionTimerFired() + 87 (ScriptableDocumentParser.cpp:67) 53 com.apple.WebCore 0x00000005699d5676 WebCore::ThreadTimers::sharedTimerFiredInternal() + 198 (ThreadTimers.cpp:127) 54 com.apple.WebCore 0x00000005699f8e5f WebCore::timerFired(__CFRunLoopTimer*, void*) + 31 (MainThreadSharedTimerCF.cpp:74) 55 com.apple.CoreFoundation 0x00007fff2043fe5d __CFRUNLOOP_IS_CALLING_OUT_TO_A_TIMER_CALLBACK_FUNCTION__ + 20 56 com.apple.CoreFoundation 0x00007fff2043f938 __CFRunLoopDoTimer + 922 57 com.apple.CoreFoundation 0x00007fff2043f492 __CFRunLoopDoTimers + 307 58 com.apple.CoreFoundation 0x00007fff20425b0f __CFRunLoopRun + 2008 59 com.apple.CoreFoundation 0x00007fff20424c4e CFRunLoopRunSpecific + 563 60 com.apple.Foundation 0x00007fff20bc6251 -[NSRunLoop(NSRunLoop) runMode:beforeDate:] + 212 61 com.apple.Foundation 0x00007fff20c54604 -[NSRunLoop(NSRunLoop) run] + 76 62 libxpc.dylib 0x00007fff2008c3dd _xpc_objc_main + 825 63 libxpc.dylib 0x00007fff2008be65 xpc_main + 437 64 com.apple.WebKit 0x000000010a22b88f WebKit::XPCServiceMain(int, char const**) + 629 (XPCServiceMain.mm:199) 65 libdyld.dylib 0x00007fff201eb5f1 start + 1

Attachments
Patch (1.81 KB, patch) 2020-10-19 18:11 PDT, Devin Rousso	no flags	Details Formatted Diff Diff
View All Add attachment proposed patch, testcase, etc.

Devin Rousso

Comment 1 2020-10-19 18:11:08 PDT

Created attachment 411822 [details] Patch

Radar WebKit Bug Importer

Comment 2 2020-10-19 18:11:34 PDT

<rdar://problem/70465005>

Antoine Quint

Comment 3 2020-10-20 00:06:30 PDT

<rdar://problem/70155803>

Blaze Burg

Comment 4 2020-10-20 08:30:56 PDT

Comment on attachment 411822 [details] Patch r=me

EWS

Comment 5 2020-10-20 08:37:28 PDT

Committed r268730: <https://trac.webkit.org/changeset/268730> All reviewed patches have been landed. Closing bug and clearing flags on attachment 411822 [details].

Note You need to log in before you can comment on or make changes to this bug.

Status RESOLVED

Resolution FIXED

Priority P2

Severity Normal

Classification Unclassified

Version WebKit Nightly Build

Hardware All

OS All

Product WebKit

Component Web Inspector

Assignee

Devin Rousso

Reported

2020-10-19 18:05 PDT

Modified

2020-10-20 08:37 PDT History

CC List

6 users Show

URL

Keywords InRadar

Depends on

210491

Blocks

Dependencies

tree graph