[Webkit-unassigned] [Bug 194538] Crash in WebCore::ScrollingTree::updateTreeFromStateNode

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=194538

Justin Cohen <justincohen at google.com> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |justincohen at chromium.org,
                   |                            |justincohen at google.com

--- Comment #5 from Justin Cohen <justincohen at google.com> ---
Chrome for iOS is seeing a big increase in this crash on 12.2.  And while volume is low, we also see it on 12.3


For example:
0x000000019ae7d0dc      (libsystem_kernel.dylib + 0x000230dc )  __pthread_kill
0x000000019aef6090      (libsystem_pthread.dylib + 0x00002090 ) pthread_kill$VARIANT$mp
0x000000019add6ea4      (libsystem_c.dylib + 0x0005aea4 )       abort
0x000000019a4a3784      (libc++abi.dylib + 0x00001784 ) abort_message
0x000000019a4b0a3c      (libc++abi.dylib + 0x0000ea3c ) __cxa_pure_virtual
0x00000001a4cd68d4      (WebCore + 0x011da8d4 ) WebCore::ScrollingTree::updateTreeFromStateNode(WebCore::ScrollingStateNode const*, WTF::HashMap<unsigned long long, WTF::RefPtr<WebCore::ScrollingTreeNode, WTF::DumbPtrTraits<WebCore::ScrollingTreeNode> >, WTF::IntHash<unsigned long long>, WTF::HashTraits<unsigned long long>, WTF::HashTraits<WTF::RefPtr<WebCore::ScrollingTreeNode, WTF::DumbPtrTraits<WebCore::ScrollingTreeNode> > > >&)
0x00000001a4cd69bc      (WebCore + 0x011da9bc ) WebCore::ScrollingTree::updateTreeFromStateNode(WebCore::ScrollingStateNode const*, WTF::HashMap<unsigned long long, WTF::RefPtr<WebCore::ScrollingTreeNode, WTF::DumbPtrTraits<WebCore::ScrollingTreeNode> >, WTF::IntHash<unsigned long long>, WTF::HashTraits<unsigned long long>, WTF::HashTraits<WTF::RefPtr<WebCore::ScrollingTreeNode, WTF::DumbPtrTraits<WebCore::ScrollingTreeNode> > > >&)
0x00000001a4cd636c      (WebCore + 0x011da36c ) WebCore::ScrollingTree::commitTreeState(std::__1::unique_ptr<WebCore::ScrollingStateTree, std::__1::default_delete<WebCore::ScrollingStateTree> >)
0x00000001aaa080cc      (WebKit + 0x002a50cc )  WebKit::RemoteScrollingCoordinatorProxy::commitScrollingTreeState(WebKit::RemoteScrollingCoordinatorTransaction const&, WebKit::RemoteScrollingCoordinatorProxy::RequestedScrollInfo&)
0x00000001aa9115d0      (WebKit + 0x001ae5d0 )  WebKit::RemoteLayerTreeDrawingAreaProxy::commitLayerTree(WebKit::RemoteLayerTreeTransaction const&, WebKit::RemoteScrollingCoordinatorTransaction const&)
0x00000001aa7b915c      (WebKit + 0x0005615c )  void IPC::handleMessage<Messages::RemoteLayerTreeDrawingAreaProxy::CommitLayerTree, WebKit::RemoteLayerTreeDrawingAreaProxy, void (WebKit::RemoteLayerTreeDrawingAreaProxy::*)(WebKit::RemoteLayerTreeTransaction const&, WebKit::RemoteScrollingCoordinatorTransaction const&)>(IPC::Decoder&, WebKit::RemoteLayerTreeDrawingAreaProxy*, void (WebKit::RemoteLayerTreeDrawingAreaProxy::*)(WebKit::RemoteLayerTreeTransaction const&, WebKit::RemoteScrollingCoordinatorTransaction const&))
0x00000001aa79ceac      (WebKit + 0x00039eac )  IPC::MessageReceiverMap::dispatchMessage(IPC::Connection&, IPC::Decoder&)
0x00000001aa95a31c      (WebKit + 0x001f731c )  WebKit::WebProcessProxy::didReceiveMessage(IPC::Connection&, IPC::Decoder&)
0x00000001aa78da1c      (WebKit + 0x0002aa1c )  IPC::Connection::dispatchMessage(std::__1::unique_ptr<IPC::Decoder, std::__1::default_delete<IPC::Decoder> >)
0x00000001aa79050c      (WebKit + 0x0002d50c )  IPC::Connection::dispatchIncomingMessages()

-- 
You are receiving this mail because:
You are the assignee for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.webkit.org/pipermail/webkit-unassigned/attachments/20190507/d191a496/attachment.html>