Bug 40726 - HTML5 parser crash when setTimeout document.write after slow script
Summary: HTML5 parser crash when setTimeout document.write after slow script
Status: RESOLVED FIXED
Alias: None
Product: WebKit
Classification: Unclassified
Component: WebCore Misc. (show other bugs)
Version: 528+ (Nightly build)
Hardware: PC OS X 10.5
: P2 Normal
Assignee: Nobody
URL: http://house.focus.cn/news/2010-03-29...
Keywords:
Depends on:
Blocks: 39259
  Show dependency treegraph
 
Reported: 2010-06-16 11:33 PDT by Tony Gentilcore
Modified: 2010-06-16 14:57 PDT (History)
3 users (show)

See Also:


Attachments
layout test (535 bytes, patch)
2010-06-16 11:55 PDT, Adam Barth
no flags Details | Formatted Diff | Diff
work in progress (9.34 KB, patch)
2010-06-16 12:22 PDT, Adam Barth
no flags Details | Formatted Diff | Diff
Patch (12.36 KB, patch)
2010-06-16 13:41 PDT, Adam Barth
eric: review+
abarth: commit-queue+
Details | Formatted Diff | Diff

Note You need to log in before you can comment on or make changes to this bug.
Description Tony Gentilcore 2010-06-16 11:33:52 PDT
This showed up on the chromium reliability bots.

Here's a test case:
<html>
<body>
<script>
setTimeout("document.write('foo');", 1000);
</script>
<script src="script-which-takes-2s-to-load.js"></script>
</body>
</html>
Comment 1 Eric Seidel (no email) 2010-06-16 11:35:33 PDT
Ah.  We don't know that we're still executing script while the timeout is going.  So we don't return the proper value from executingScript() and end up getting ourselves deleted... I think.
Comment 2 Eric Seidel (no email) 2010-06-16 11:45:13 PDT
Oh, I mis-read.  The parser will still be alive!  We're just getting a delayed document.write() callback while we're waiting for another script to load.  So the parser will be paused, but the document.write will be from some other script.  Shouldn't be too hard to debug.
Comment 3 Adam Barth 2010-06-16 11:55:32 PDT
Created attachment 58917 [details]
layout test
Comment 4 Adam Barth 2010-06-16 12:22:42 PDT
Created attachment 58921 [details]
work in progress
Comment 5 Adam Barth 2010-06-16 13:41:31 PDT
Created attachment 58923 [details]
Patch
Comment 6 Eric Seidel (no email) 2010-06-16 13:46:37 PDT
Comment on attachment 58923 [details]
Patch

LGTM.
Comment 7 Eric Seidel (no email) 2010-06-16 13:47:04 PDT
This might break pages, but it's good to agree with the spec an mindfield.
Comment 8 Adam Barth 2010-06-16 13:49:15 PDT
Comment on attachment 58923 [details]
Patch

I think this is one of the handful of evangelism bugs Henri has open.
Comment 9 Adam Barth 2010-06-16 14:57:44 PDT
Committed r61286: <http://trac.webkit.org/changeset/61286>