[Webkit-unassigned] [Bug 138744] New: Crash in WebCore::WebVideoFullscreenModelMediaElement::updateForEventName

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=138744

            Bug ID: 138744
           Summary: Crash in
                    WebCore::WebVideoFullscreenModelMediaElement::updateFo
                    rEventName
    Classification: Unclassified
           Product: WebKit
           Version: 528+ (Nightly build)
          Hardware: Unspecified
                OS: iOS 8.1
            Status: NEW
          Severity: Normal
          Priority: P2
         Component: WebCore Misc.
          Assignee: webkit-unassigned at lists.webkit.org
          Reporter: stuartmorgan at chromium.org

The top crash for Chrome on iOS is a video-related crash with a stack that looks like:
Thread 19 CRASHED [EXC_BAD_ACCESS / KERN_PROTECTION_FAILURE @ 0x0d1de408] MAGIC SIGNATURE THREAD
0x0d1de408        
0x368f3cdf    [WebCore + 0x00a5dcdf ]    WebCore::WebVideoFullscreenModelMediaElement::updateForEventName(WTF::AtomicString const&)
0x35fc9389    [WebCore + 0x00133389 ]    WebCore::EventTarget::fireEventListeners(WebCore::Event*, WebCore::EventTargetData*, WTF::Vector<WebCore::RegisteredEventListener, 1ul, WTF::CrashOnOverflow>&)
0x35f253a9    [WebCore + 0x0008f3a9 ]    WebCore::EventTarget::fireEventListeners(WebCore::Event*)
0x36214a5f    [WebCore + 0x0037ea5f ]    WebCore::EventContext::handleLocalEvents(WebCore::Event&) const
0x36215297    [WebCore + 0x0037f297 ]    WebCore::EventDispatcher::dispatchEvent(WebCore::Node*, WTF::PassRefPtr<WebCore::Event>)
0x35f2523b    [WebCore + 0x0008f23b ]    WebCore::Node::dispatchEvent(WTF::PassRefPtr<WebCore::Event>)
0x36280ccb    [WebCore + 0x003eaccb ]    WebCore::GenericEventQueue::timerFired(WebCore::Timer<WebCore::GenericEventQueue>&)
0x35eb408b    [WebCore + 0x0001e08b ]    WebCore::ThreadTimers::sharedTimerFiredInternal()
0x35eb3fe7    [WebCore + 0x0001dfe7 ]    WebCore::timerFired(__CFRunLoopTimer*, void*)
0x2b22fea5    [CoreFoundation + 0x000caea5 ]    __CFRUNLOOP_IS_CALLING_OUT_TO_A_TIMER_CALLBACK_FUNCTION__
0x2b22fa21    [CoreFoundation + 0x000caa21 ]    __CFRunLoopDoTimer
0x2b22dc71    [CoreFoundation + 0x000c8c71 ]    __CFRunLoopRun
0x2b17ca1f    [CoreFoundation + 0x00017a1f ]    CFRunLoopRunSpecific
0x2b17c831    [CoreFoundation + 0x00017831 ]    CFRunLoopRunInMode
0x35f19391    [WebCore + 0x00083391 ]    RunWebThread(void*)
0x38a10091    [libsystem_pthread.dylib + 0x00003091 ]    _pthread_body
0x38a10005    [libsystem_pthread.dylib + 0x00003005 ]    _pthread_start
0x38a0de1e    [libsystem_pthread.dylib + 0x00000e1e ]    thread_start

A simple UIWebView-based application that loads videos in a loop will reproduce this crash. This happens in both 8.0 and 8.1; it's a severe regression since iOS 7.x.

This was also filed as rdar://17884046 and more details about reproduction are there.

-- 
You are receiving this mail because:
You are the assignee for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.webkit.org/pipermail/webkit-unassigned/attachments/20141114/064a87f7/attachment-0002.html>