[Webkit-unassigned] [Bug 60559] Frequent crashes beneath WebCore::ScriptElement::prepareScript

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=60559





--- Comment #6 from Adam Barth <abarth at webkit.org>  2011-05-10 15:24:21 PST ---
HTMLDocumentParser::runScriptsForPausedTreeBuilder assumes m_treeBuilder->isPaused() implies m_treeBuilder->takeScriptToProcess(scriptStartPosition) is non-null, but HTMLScriptRunner::execute returning false can make m_treeBuilder->isPaused() stay true even though the element has been taken.

In HTMLScriptRunner::execute this code looks related to the nesting:

    if (haveParsingBlockingScript()) {
        if (m_scriptNestingLevel)
            return false; // Block the parser.  Unwind to the outermost HTMLScriptRunner::execute before continuing parsing.

So...  Maybe if you document.write an inline script followed by something else that gets us running down these code paths.  Not sure.

-- 
Configure bugmail: https://bugs.webkit.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.