[Webkit-unassigned] [Bug 153043] New: [iOS Simulator] fast/picture/image-picture-loads-1x.html crashes

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=153043

            Bug ID: 153043
           Summary: [iOS Simulator]
                    fast/picture/image-picture-loads-1x.html crashes
    Classification: Unclassified
           Product: WebKit
           Version: WebKit Nightly Build
          Hardware: iOS
                OS: iOS 9.0
            Status: NEW
          Severity: Normal
          Priority: P2
         Component: Images
          Assignee: webkit-unassigned at lists.webkit.org
          Reporter: ryanhaddad at apple.com
                CC: hyatt at apple.com

[iOS Simulator] fast/picture/image-picture-loads-1x.html crashes

Application Specific Information:
CoreSimulator 179 - Device: iPhone 5s WebKit Tester2 - Runtime: iOS 9.0 (13A340) - DeviceType: iPhone 5s
CRASHING TEST: fast/picture/image-picture-invalid.html

Thread 0 Crashed:: Dispatch queue: com.apple.main-thread
0   com.apple.WebCore                 0x000000010b093404 WebCore::HTMLImageElement::bestFitSourceFromPictureElement() + 1092
1   com.apple.WebCore                 0x000000010b0937fc WebCore::HTMLImageElement::selectImageSource() + 28
2   com.apple.WebCore                 0x000000010b0c7538 WebCore::HTMLPictureElement::sourcesChanged() + 72
3   com.apple.WebCore                 0x000000010b0d7fac WebCore::HTMLSourceElement::removedFrom(WebCore::ContainerNode&) + 108
4   com.apple.WebCore                 0x000000010acdeaa4 WebCore::notifyNodeRemovedFromDocument(WebCore::ContainerNode&, WebCore::Node&) + 36
5   com.apple.WebCore                 0x000000010acdeb46 WebCore::notifyNodeRemovedFromDocument(WebCore::ContainerNode&, WebCore::Node&) + 198
6   com.apple.WebCore                 0x000000010acdeb46 WebCore::notifyNodeRemovedFromDocument(WebCore::ContainerNode&, WebCore::Node&) + 198
7   com.apple.WebCore                 0x000000010acdeb46 WebCore::notifyNodeRemovedFromDocument(WebCore::ContainerNode&, WebCore::Node&) + 198
8   com.apple.WebCore                 0x000000010acdee66 WebCore::addChildNodesToDeletionQueue(WebCore::Node*&, WebCore::Node*&, WebCore::ContainerNode&) + 150f
9   com.apple.WebCore                 0x000000010acdef12 WebCore::removeDetachedChildrenInContainer(WebCore::ContainerNode&) + 50
10  com.apple.WebCore                 0x000000010ae3a4cf WebCore::Document::removedLastRef() + 383
11  ???                               0x000000010a370d08 0 + 4466347272
12  ???                               0x000000010a37099d 0 + 4466346397

Full crashlog:
<https://build.webkit.org/results/Apple%20iOS%209%20Simulator%20Release%20WK2%20(Tests)/r194928%20(2253)/fast/picture/image-picture-loads-1x-crash-log.txt>

<https://build.webkit.org/builders/Apple%20iOS%209%20Simulator%20Release%20WK2%20%28Tests%29/builds/2253>

-- 
You are receiving this mail because:
You are the assignee for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.webkit.org/pipermail/webkit-unassigned/attachments/20160112/c8add2a8/attachment.html>