Bug 41997 – Null pointer crash in WTF::RefCountedBase::derefBase when navigating away from page with CSS

• Status: UNCONFIRMED
• Component: New Bugs

[Brian Ellis]

Occasionally (in an indeterminate manner) an application using WebKit will crash with the following stack trace:

#0  0x021ea2cd in WTF::RefCountedBase::derefBase ()
#1  0x0235071d in WTF::RefCounted<WebCore::StringImpl>::deref ()
#2  0x0235075f in WTF::derefIfNotNull<WebCore::StringImpl> ()
#3  0x023fc4e1 in WTF::RefPtr<WebCore::StringImpl>::~RefPtr ()
#4  0x0235079d in WebCore::String::~String ()
#5  0x02413113 in WebCore::MediaQueryEvaluator::~MediaQueryEvaluator ()
#6  0x023cec15 in WebCore::CSSStyleSelector::~CSSStyleSelector ()
#7  0x0242c9ab in WebCore::Document::~Document ()
#8  0x02429818 in WebCore::Document::removedLastRef ()
#9  0x023797c5 in WebCore::TreeShared<WebCore::Node>::deref ()
#10 0x022f159a in WTF::derefIfNotNull<WebCore::Document> ()
#11 0x024240f3 in WTF::RefPtr<WebCore::Document>::~RefPtr ()
#12 0x025e2fed in WebCore::Loader::Host::didFail ()
#13 0x025e31d5 in WebCore::Loader::Host::cancelRequests ()
#14 0x025e33a9 in WebCore::Loader::cancelRequests ()
#15 0x025be2d6 in WebCore::DocLoader::~DocLoader ()
#16 0x0242bdc8 in WebCore::Document::~Document ()
#17 0x02528121 in WebCore::HTMLDocument::~HTMLDocument ()
#18 0x0243567e in WebCore::Document::selfOnlyDeref ()
#19 0x024297fe in WebCore::Document::removedLastRef ()
#20 0x023797c5 in WebCore::TreeShared<WebCore::Node>::deref ()
#21 0x022f159a in WTF::derefIfNotNull<WebCore::Document> ()
#22 0x0244b651 in WTF::RefPtr<WebCore::Document>::operator= ()
#23 0x02632d4c in WebCore::Frame::setDocument ()
#24 0x025d050c in WebCore::FrameLoader::clear ()
#25 0x025d34c9 in WebCore::FrameLoader::begin ()

This appears to occur when navigating away from a page that contains CSS (even if there is no explicit media query).  In this case, the application (Google Earth) is using QtWebKit (4.6.3) and navigating to "about:blank", but I do not think this is a Qt-specific bug.