r39059: Crash when clearing webkitTransitionDuration in webkitTransitionEnd event handler

[Thomas Fuchs]

I've an event handler on document that is fired on 'webkitTransitionEnd'. If I try to set the affected element style.webkitTransitionDuration property to an empty string, WebKit nightly crashes.

I'll try to provide a reduced testcase.

Here's the crash log:

Version:         r38654 (38654)

Exception Type:  EXC_BAD_INSTRUCTION (SIGILL)
Exception Codes: 0x0000000000000001, 0x0000000000000000
Crashed Thread:  0

Thread 0 Crashed:
0   ???                           	0x01d7c42d 0 + 30917677
1   com.apple.WebCore             	0x014485c2 WebCore::AnimationTimerCallback::timerFired(WebCore::Timer<WebCore::AnimationTimerBase>*) + 34
2   com.apple.WebCore             	0x0144b49b WebCore::Timer<WebCore::AnimationTimerBase>::fired() + 43
3   com.apple.WebCore             	0x01317635 WebCore::TimerBase::fireTimers(double, WTF::Vector<WebCore::TimerBase*, 0ul> const&) + 133
4   com.apple.WebCore             	0x01317902 WebCore::TimerBase::sharedTimerFired() + 162
5   com.apple.WebCore             	0x012fd674 __ZN7WebCoreL10timerFiredEP16__CFRunLoopTimerPv + 68
6   com.apple.CoreFoundation      	0x93b01b45 CFRunLoopRunSpecific + 4469
7   com.apple.CoreFoundation      	0x93b01cf8 CFRunLoopRunInMode + 88
8   com.apple.HIToolbox           	0x904aa480 RunCurrentEventLoopInMode + 283
9   com.apple.HIToolbox           	0x904aa299 ReceiveNextEventCommon + 374
10  com.apple.HIToolbox           	0x904aa10d BlockUntilNextEventMatchingListInMode + 106
11  com.apple.AppKit              	0x90fe03ed _DPSNextEvent + 657
12  com.apple.AppKit              	0x90fdfca0 -[NSApplication nextEventMatchingMask:untilDate:inMode:dequeue:] + 128
13  com.apple.Safari              	0x000080be 0x1000 + 28862
14  com.apple.AppKit              	0x90fd8cdb -[NSApplication run] + 795
15  com.apple.AppKit              	0x90fa5f14 NSApplicationMain + 574
16  com.apple.Safari              	0x000b9b46 0x1000 + 756550

[Thomas Fuchs]

Clarification -- this happens only if I set the property WITHIN the transition end event handler.

[Thomas Fuchs]

Created attachment 25346 [details]
Reduced test case

[Thomas Fuchs]

Setting to P1 because of reproducible crash. Checked in r38760, too.

[Timothy Hatcher]

*** Bug 22276 has been marked as a duplicate of this bug. ***

[Timothy Hatcher]

*** Bug 22508 has been marked as a duplicate of this bug. ***

[Simon Fraser (smfr)]

Maybe fixed by bug 22052 (which has a patch that needs review)

[Chris Marrin]

Works with patches for 22052 and 22046, both of which dealt with crashes like this.

[Oliver Hunt]

This crash still occurs, not sure if it's a regression or what

[Simon Fraser (smfr)]

Yep, I can reproduce.

[Oliver Hunt]

<rdar://problem/6426245> Reproducible crash when clearing webkitTransitionDuration in webkitTransitionEnd event handler (22398)

Trivial to trigger in "real world" code -- the inspector crashes due to this bug:
1. Go to http://nerget.com/working/crash.html
2. Open the inspector
3. Expand the console in the inspector window
4. click the link provided in the exception message

[Oliver Hunt]

This regressed in r39059

[Oliver Hunt]

Committing to http://svn.webkit.org/repository/webkit/trunk ...
	M	LayoutTests/ChangeLog
	A	LayoutTests/transitions/transition-duration-cleared-in-transitionend-crash-expected.txt
	A	LayoutTests/transitions/transition-duration-cleared-in-transitionend-crash.html
	M	WebCore/ChangeLog
	M	WebCore/page/animation/AnimationBase.cpp
Committed r39092

[Simon Fraser (smfr)]

http://trac.webkit.org/changeset/39092