[Webkit-unassigned] [Bug 145142] New: Possible crash in WebCore::RenderLayer::updateScrollbarsAfterLayout

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=145142

            Bug ID: 145142
           Summary: Possible crash in
                    WebCore::RenderLayer::updateScrollbarsAfterLayout
    Classification: Unclassified
           Product: WebKit
           Version: 528+ (Nightly build)
          Hardware: Unspecified
                OS: Unspecified
            Status: NEW
          Severity: Normal
          Priority: P2
         Component: Layout and Rendering
          Assignee: webkit-unassigned at lists.webkit.org
          Reporter: bdakin at apple.com

I have not been able to reproduce this crash, but according to symbolication m_vBar is null. It seems like this crash was probably caused by http://trac.webkit.org/changeset/173668 which made it so that overflow:scroll behaves like overflow:auto when the scrollbars are overlay. I can see how you could encounter this crash with that change if the layout caused styleRequiresScrollbar() to return true when it used to return false. Then this code, by failing to nil-check the scrollbars assumes that there is already a scrollbar, because it assumes that styleRequiresScrollbar() could not have changed based on a layout. But it could change if the css changed the scrollbars to be custom or if the user managed switch to legacy style scrollbars at just the wrong time. Or I suppose it could also happen if the user has legacy scrollbars and the style switched from auto to scroll during the layout.

Anyway, we should null check the scrollbars.


>  1 com.apple.WebCore              0x7fff93692574 WebCore::RenderLayer::updateScrollbarsAfterLayout() + 0x204
   2 com.apple.WebCore              0x7fff93691d34 WebCore::RenderLayer::updateScrollInfoAfterLayout() + 0x154
   3 com.apple.WebCore              0x7fff9410a6bd WebCore::RenderBlock::endAndCommitUpdateScrollInfoAfterLayoutTransaction() + 0x23d
   4 com.apple.WebCore              0x7fff93725c7f WebCore::RenderFlexibleBox::layoutBlock(bool, WebCore::LayoutUnit) + 0x38f
   5 com.apple.WebCore              0x7fff935dbaf3 WebCore::RenderBlock::layout() + 0x83
…

-- 
You are receiving this mail because:
You are the assignee for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.webkit.org/pipermail/webkit-unassigned/attachments/20150518/f643bfac/attachment-0001.html>