1) Open DevTools (Ctrl+Shift+I) 2) Open Console (Esc) 3) Type "window" and hit enter. 4) Start expanding and collapsing 'DOMWindow' node rapidly Observe crash: chrome.dll!WebCore::RenderObject::isText() Line 375 + 0x11 bytes C++ chrome.dll!WebCore::Position::getInlineBoxAndOffset(WebCore::EAffinity affinity=UPSTREAM, WebCore::TextDirection primaryDirection=LTR, WebCore::InlineBox * & inlineBox=0xcccccccc, int & caretOffset=0) Line 1014 + 0x8 bytes C++ chrome.dll!WebCore::Position::getInlineBoxAndOffset(WebCore::EAffinity affinity=UPSTREAM, WebCore::InlineBox * & inlineBox=0xcccccccc, int & caretOffset=0) Line 950 C++ chrome.dll!WebCore::Frame::firstRectForRange(WebCore::Range * range=0x0c20d540) Line 312 + 0x20 bytes C++ chrome.dll!WebKit::WebViewImpl::caretOrSelectionBounds() Line 1249 + 0x15 bytes C++ chrome.dll!RenderWidget::UpdateInputMethod() Line 876 + 0x19 bytes C++ chrome.dll!RenderWidget::DoDeferredUpdate() Line 527 C++ chrome.dll!RenderWidget::CallDoDeferredUpdate() Line 427 C++ chrome.dll!RenderWidget::OnUpdateRectAck() Line 283 C++ chrome.dll!IPC::Message::Dispatch<RenderWidget>(const IPC::Message * msg=0x0caade28, RenderWidget * obj=0x07254400, void (void)* func=0x5fde3f50) Line 134 + 0x1b bytes C++ chrome.dll!RenderWidget::OnMessageReceived(const IPC::Message & msg={...}) Line 143 + 0x38 bytes C++ chrome.dll!RenderView::OnMessageReceived(const IPC::Message & message={...}) Line 737 + 0xc bytes C++ chrome.dll!MessageRouter::RouteMessage(const IPC::Message & msg={...}) Line 40 + 0x13 bytes C++ chrome.dll!MessageRouter::OnMessageReceived(const IPC::Message & msg={...}) Line 31 + 0x13 bytes C++ chrome.dll!ChildThread::OnMessageReceived(const IPC::Message & msg={...}) Line 146 + 0x17 bytes C++ chrome.dll!IPC::ChannelProxy::Context::OnDispatchMessage(const IPC::Message & message={...}) Line 206 + 0x19 bytes C++ chrome.dll!DispatchToMethod<IPC::ChannelProxy::Context,void (__thiscall IPC::ChannelProxy::Context::*)(IPC::Message const &),IPC::Message>(IPC::ChannelProxy::Context * obj=0x04236c00, void (const IPC::Message &)* method=0x5fa65cb0, const Tuple1<IPC::Message> & arg={...}) Line 422 + 0xf bytes C++ chrome.dll!RunnableMethod<IPC::ChannelProxy::Context,void (__thiscall IPC::ChannelProxy::Context::*)(IPC::Message const &),Tuple1<IPC::Message> ::Run() Line 326 + 0x1e bytes C++ chrome.dll!MessageLoop::RunTask(Task * task=0x0caade00) Line 409 + 0xf bytes C++ chrome.dll!MessageLoop::DeferOrRunPendingTask(const MessageLoop::PendingTask & pending_task={...}) Line 421 C++ See https://bugs.webkit.org/show_bug.cgi?id=41334 for a similar bug. Related Chromium bug: http://code.google.com/p/chromium/issues/detail?id=49294
Created attachment 61799 [details] patch
Comment on attachment 61799 [details] patch Clearing flags on attachment: 61799 Committed r63545: <http://trac.webkit.org/changeset/63545>
All reviewed patches have been landed. Closing bug.