Bug 217936

Summary: Web Inspector: REGRESSION(r260076): crash under InspectorInstrumentation::willApplyKeyframeEffect
Product: WebKit Reporter: Devin Rousso <hi>
Component: Web InspectorAssignee: Devin Rousso <hi>
Status: RESOLVED FIXED    
Severity: Normal CC: bburg, graouts, graouts, hi, inspector-bugzilla-changes, webkit-bug-importer
Priority: P2 Keywords: InRadar
Version: WebKit Nightly Build   
Hardware: All   
OS: All   
Bug Depends on: 210491    
Bug Blocks:    
Attachments:
Description Flags
Patch none

Description Devin Rousso 2020-10-19 18:05:14 PDT 
Thread 0 Crashed:: Dispatch queue: com.apple.main-thread
0   com.apple.WebCore             	0x000000056909dab5 WebCore::Node::treeScope() const + 0 (Node.h:352) [inlined]
1   com.apple.WebCore             	0x000000056909dab5 WebCore::Node::document() const + 0 (Node.h:347) [inlined]
2   com.apple.WebCore             	0x000000056909dab5 WebCore::InspectorInstrumentation::willApplyKeyframeEffect(WebCore::Element&, WebCore::KeyframeEffect&, WebCore::ComputedEffectTiming) + 53 (InspectorInstrumentation.h:1510)
3   com.apple.WebCore             	0x000000056909d9be WebCore::KeyframeEffect::apply(WebCore::RenderStyle&, WTF::Optional<WTF::Seconds>) + 382 (KeyframeEffect.cpp:1252)
4   com.apple.WebCore             	0x00000005690a3dd5 WebCore::WebAnimation::resolve(WebCore::RenderStyle&, WTF::Optional<WTF::Seconds>) + 101 (WebAnimation.cpp:1241)
5   com.apple.WebCore             	0x00000005693813ba WebCore::Element::applyKeyframeEffects(WebCore::PseudoId, WebCore::RenderStyle&) + 218 (Element.cpp:3831)
6   com.apple.WebCore             	0x0000000569e2e8d0 WebCore::Styleable::applyKeyframeEffects(WebCore::RenderStyle&) const + 14 (Styleable.h:91) [inlined]
7   com.apple.WebCore             	0x0000000569e2e8d0 WebCore::Style::TreeResolver::createAnimatedElementUpdate(std::__1::unique_ptr<WebCore::RenderStyle, std::__1::default_delete<WebCore::RenderStyle> >, WebCore::Styleable const&, WebCore::Style::Change) + 560 (StyleTreeResolver.cpp:356)
8   com.apple.WebCore             	0x0000000569e2ec48 WebCore::Style::TreeResolver::resolvePseudoStyle(WebCore::Element&, WebCore::Style::ElementUpdate const&, WebCore::PseudoId) + 456 (StyleTreeResolver.cpp:280)
9   com.apple.WebCore             	0x0000000569e2e5e3 WebCore::Style::TreeResolver::resolveElement(WebCore::Element&) + 1059 (StyleTreeResolver.cpp:248)
10  com.apple.WebCore             	0x0000000569e2f37c WebCore::Style::TreeResolver::resolveComposedTree() + 1180 (StyleTreeResolver.cpp:542)
11  com.apple.WebCore             	0x0000000569e2fef7 WebCore::Style::TreeResolver::resolve() + 679 (StyleTreeResolver.cpp:600)
12  com.apple.WebCore             	0x000000056933d226 WebCore::Document::resolveStyle(WebCore::Document::ResolveStyleType) + 678 (Document.cpp:2025)
13  com.apple.WebCore             	0x000000056933d6de WebCore::Document::updateStyleIfNeeded() + 302 (Document.cpp:2123)
14  com.apple.WebCore             	0x00000005699d5676 WebCore::ThreadTimers::sharedTimerFiredInternal() + 198 (ThreadTimers.cpp:127)
15  com.apple.WebCore             	0x00000005699f8e5f WebCore::timerFired(__CFRunLoopTimer*, void*) + 31 (MainThreadSharedTimerCF.cpp:74)
16  com.apple.CoreFoundation      	0x00007fff2043fe5d __CFRUNLOOP_IS_CALLING_OUT_TO_A_TIMER_CALLBACK_FUNCTION__ + 20
17  com.apple.CoreFoundation      	0x00007fff2043f938 __CFRunLoopDoTimer + 922
18  com.apple.CoreFoundation      	0x00007fff2043f492 __CFRunLoopDoTimers + 307
19  com.apple.CoreFoundation      	0x00007fff20425b0f __CFRunLoopRun + 2008
20  com.apple.CoreFoundation      	0x00007fff20424c4e CFRunLoopRunSpecific + 563
21  com.apple.Foundation          	0x00007fff20bc6251 -[NSRunLoop(NSRunLoop) runMode:beforeDate:] + 212
22  com.apple.Foundation          	0x00007fff20c4fa44 -[NSRunLoop(NSRunLoop) runUntilDate:] + 103
23  com.apple.WebCore             	0x000000056891046f WebCore::PageDebugger::platformShouldContinueRunningEventLoopWhilePaused() + 223 (PageDebuggerMac.mm:44)
24  com.apple.WebCore             	0x0000000569722781 WebCore::PageDebugger::runEventLoopWhilePausedInternal() + 40 (PageDebugger.cpp:129) [inlined]
25  com.apple.WebCore             	0x0000000569722781 WebCore::PageDebugger::runEventLoopWhilePaused() + 49 (PageDebugger.cpp:119)
26  com.apple.JavaScriptCore      	0x000000056e4ebe6c JSC::Debugger::handlePause(JSC::JSGlobalObject*, JSC::Debugger::ReasonForPause) + 108 (Debugger.cpp:971)
27  com.apple.JavaScriptCore      	0x000000056e4eb628 JSC::Debugger::pauseIfNeeded(JSC::JSGlobalObject*) + 1288 (Debugger.cpp:949)
28  com.apple.JavaScriptCore      	0x000000056e4ec81e JSC::Debugger::updateCallFrame(JSC::JSGlobalObject*, JSC::CallFrame*, JSC::Debugger::CallFrameUpdateAction) + 53 (Debugger.cpp:837) [inlined]
29  com.apple.JavaScriptCore      	0x000000056e4ec81e JSC::Debugger::atStatement(JSC::CallFrame*) + 238 (Debugger.cpp:1030)
30  com.apple.JavaScriptCore      	0x000000056e977c5f llint_slow_path_debug + 95 (LLIntSlowPaths.cpp:2018)
31  com.apple.JavaScriptCore      	0x000000056e1cc12f llint_entry + 122427 (LowLevelInterpreter64.asm:97)
32  com.apple.JavaScriptCore      	0x000000056e1ca1af llint_entry + 114363 (LowLevelInterpreter.asm:1055)
33  com.apple.JavaScriptCore      	0x000000056e1ae0ff vmEntryToJavaScript + 216 (LowLevelInterpreter64.asm:310)
34  com.apple.JavaScriptCore      	0x000000056e86acd3 JSC::JITCode::execute(JSC::VM*, JSC::ProtoCallFrame*) + 36 (JITCodeInlines.h:42) [inlined]
35  com.apple.JavaScriptCore      	0x000000056e86acd3 JSC::Interpreter::executeProgram(JSC::SourceCode const&, JSC::JSGlobalObject*, JSC::JSObject*) + 12275 (Interpreter.cpp:836)
36  com.apple.JavaScriptCore      	0x000000056eb0a395 JSC::evaluate(JSC::JSGlobalObject*, JSC::SourceCode const&, JSC::JSValue, WTF::NakedPtr<JSC::Exception>&) + 245 (Completion.cpp:139)
37  com.apple.WebCore             	0x00000005690f0c04 WebCore::JSExecState::profiledEvaluate(JSC::JSGlobalObject*, JSC::ProfilingReason, JSC::SourceCode const&, JSC::JSValue, WTF::NakedPtr<JSC::Exception>&) + 84 (JSExecState.h:79)
38  com.apple.WebCore             	0x00000005690f09c3 WebCore::ScriptController::evaluateInWorld(WebCore::ScriptSourceCode const&, WebCore::DOMWrapperWorld&) + 195 (ScriptController.cpp:148)
39  com.apple.WebCore             	0x00000005690f0c88 WebCore::ScriptController::evaluateInWorldIgnoringException(WebCore::ScriptSourceCode const&, WebCore::DOMWrapperWorld&) + 14 (ScriptController.cpp:121) [inlined]
40  com.apple.WebCore             	0x00000005690f0c88 WebCore::ScriptController::evaluateIgnoringException(WebCore::ScriptSourceCode const&) + 40 (ScriptController.cpp:167)
41  com.apple.WebCore             	0x00000005693dbe24 WebCore::ScriptElement::executeClassicScript(WebCore::ScriptSourceCode const&) + 516 (ScriptElement.cpp:400)
42  com.apple.WebCore             	0x00000005693a25ba WebCore::LoadableClassicScript::execute(WebCore::ScriptElement&) + 122 (LoadableClassicScript.cpp:123)
43  com.apple.WebCore             	0x00000005693dc2fd WebCore::ScriptElement::executeScriptAndDispatchEvent(WebCore::LoadableScript&) + 173 (ScriptElement.cpp:442)
44  com.apple.WebCore             	0x0000000569682482 WebCore::HTMLScriptRunner::executePendingScriptAndDispatchEvent(WebCore::PendingScript&) + 89 (HTMLScriptRunner.cpp:114) [inlined]
45  com.apple.WebCore             	0x0000000569682482 WebCore::HTMLScriptRunner::executeParsingBlockingScripts() + 258 (HTMLScriptRunner.cpp:164)
46  com.apple.WebCore             	0x00000005696758fd WebCore::HTMLDocumentParser::runScriptsForPausedTreeBuilder() + 157 (HTMLDocumentParser.cpp:244)
47  com.apple.WebCore             	0x0000000569675ccf WebCore::HTMLDocumentParser::pumpTokenizerLoop(WebCore::HTMLDocumentParser::SynchronousMode, bool, WebCore::PumpSession&) + 623 (HTMLDocumentParser.cpp:263)
48  com.apple.WebCore             	0x00000005696755c3 WebCore::HTMLDocumentParser::pumpTokenizer(WebCore::HTMLDocumentParser::SynchronousMode) + 195 (HTMLDocumentParser.cpp:322)
49  com.apple.WebCore             	0x00000005696769b8 WebCore::HTMLDocumentParser::pumpTokenizerIfPossible(WebCore::HTMLDocumentParser::SynchronousMode) + 84 (HTMLDocumentParser.cpp:196) [inlined]
50  com.apple.WebCore             	0x00000005696769b8 WebCore::HTMLDocumentParser::resumeParsingAfterScriptExecution() + 136 (HTMLDocumentParser.cpp:542)
51  com.apple.WebCore             	0x0000000569676c46 WebCore::HTMLDocumentParser::executeScriptsWaitingForStylesheets() + 54 (HTMLDocumentParser.cpp:610)
52  com.apple.WebCore             	0x00000005693e3987 WebCore::ScriptableDocumentParser::scriptsWaitingForStylesheetsExecutionTimerFired() + 87 (ScriptableDocumentParser.cpp:67)
53  com.apple.WebCore             	0x00000005699d5676 WebCore::ThreadTimers::sharedTimerFiredInternal() + 198 (ThreadTimers.cpp:127)
54  com.apple.WebCore             	0x00000005699f8e5f WebCore::timerFired(__CFRunLoopTimer*, void*) + 31 (MainThreadSharedTimerCF.cpp:74)
55  com.apple.CoreFoundation      	0x00007fff2043fe5d __CFRUNLOOP_IS_CALLING_OUT_TO_A_TIMER_CALLBACK_FUNCTION__ + 20
56  com.apple.CoreFoundation      	0x00007fff2043f938 __CFRunLoopDoTimer + 922
57  com.apple.CoreFoundation      	0x00007fff2043f492 __CFRunLoopDoTimers + 307
58  com.apple.CoreFoundation      	0x00007fff20425b0f __CFRunLoopRun + 2008
59  com.apple.CoreFoundation      	0x00007fff20424c4e CFRunLoopRunSpecific + 563
60  com.apple.Foundation          	0x00007fff20bc6251 -[NSRunLoop(NSRunLoop) runMode:beforeDate:] + 212
61  com.apple.Foundation          	0x00007fff20c54604 -[NSRunLoop(NSRunLoop) run] + 76
62  libxpc.dylib                  	0x00007fff2008c3dd _xpc_objc_main + 825
63  libxpc.dylib                  	0x00007fff2008be65 xpc_main + 437
64  com.apple.WebKit              	0x000000010a22b88f WebKit::XPCServiceMain(int, char const**) + 629 (XPCServiceMain.mm:199)
65  libdyld.dylib                 	0x00007fff201eb5f1 start + 1
Comment 1 Devin Rousso 2020-10-19 18:11:08 PDT 
Created attachment 411822 [details]
Patch
Comment 2 Radar WebKit Bug Importer 2020-10-19 18:11:34 PDT 
<rdar://problem/70465005>
Comment 3 Antoine Quint 2020-10-20 00:06:30 PDT 
<rdar://problem/70155803>
Comment 4 BJ Burg 2020-10-20 08:30:56 PDT 
Comment on attachment 411822 [details]
Patch

r=me
Comment 5 EWS 2020-10-20 08:37:28 PDT 
Committed r268730: <https://trac.webkit.org/changeset/268730>

All reviewed patches have been landed. Closing bug and clearing flags on attachment 411822 [details].