[Webkit-unassigned] [Bug 206915] New: Rare crash at RenderLayer::calculateLayerBounds const

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=206915

            Bug ID: 206915
           Summary: Rare crash at RenderLayer::calculateLayerBounds const
           Product: WebKit
           Version: Safari Technology Preview
          Hardware: Unspecified
                OS: Unspecified
            Status: NEW
          Severity: Normal
          Priority: P2
         Component: Compositing
          Assignee: webkit-unassigned at lists.webkit.org
          Reporter: simon.fraser at apple.com

We see a rare crash with this backtrace:

Exception Type:        EXC_BAD_ACCESS (SIGSEGV)
Exception Codes:       KERN_INVALID_ADDRESS at 0x0000000000000038
Exception Note:        EXC_CORPSE_NOTIFY


Thread 0 Crashed:: Dispatch queue: com.apple.main-thread
0   com.apple.WebCore                   0x00007fff44232405 WebCore::RenderLayer::calculateLayerBounds(WebCore::RenderLayer const*, WebCore::LayoutSize const&, WTF::OptionSet<WebCore::RenderLayer::CalculateLayerBoundsFlag>) const + 21
1   com.apple.WebCore                   0x00007fff42e0e3cf WebCore::RenderLayerBacking::updateCompositedBounds() + 47
2   com.apple.WebCore                   0x00007fff442283e7 WebCore::RenderLayerBacking::updateAfterLayout(bool, bool) + 23
3   com.apple.WebCore                   0x00007fff442275d2 WebCore::RenderLayer::updateLayerPositions(WebCore::RenderGeometryMap*, WTF::OptionSet<WebCore::RenderLayer::UpdateLayerPositionsFlag>) + 1586
4   com.apple.WebCore                   0x00007fff4422741e WebCore::RenderLayer::updateLayerPositions(WebCore::RenderGeometryMap*, WTF::OptionSet<WebCore::RenderLayer::UpdateLayerPositionsFlag>) + 1150
5   com.apple.WebCore                   0x00007fff4422741e WebCore::RenderLayer::updateLayerPositions(WebCore::RenderGeometryMap*, WTF::OptionSet<WebCore::RenderLayer::UpdateLayerPositionsFlag>) + 1150
6   com.apple.WebCore                   0x00007fff44226f7b WebCore::RenderLayer::updateLayerPositionsAfterLayout(WebCore::RenderLayer const*, WTF::OptionSet<WebCore::RenderLayer::UpdateLayerPositionsFlag>) + 91
7   com.apple.WebCore                   0x00007fff43f74142 WebCore::FrameView::didLayout(WTF::WeakPtr<WebCore::RenderElement>) + 338
8   com.apple.WebCore                   0x00007fff43f80b02 WebCore::FrameViewLayoutContext::layout() + 1458
9   com.apple.WebCore                   0x00007fff42df7307 WebCore::FrameView::updateLayoutAndStyleIfNeededRecursive() + 1399
10  com.apple.WebKit                    0x00007fff44c51bd6 WebKit::TiledCoreAnimationDrawingArea::scaleViewToFitDocumentIfNeeded() + 38
11  com.apple.WebKit                    0x00007fff4494f85c WebKit::TiledCoreAnimationDrawingArea::flushLayers() + 50

0x0000000000000038 is the offset of the bitset including m_isSelfPaintingLayer so it seems to be crashing here:

    -> 376          bool isSelfPaintingLayer() const { return m_isSelfPaintingLayer; }

where |this| is null.

-- 
You are receiving this mail because:
You are the assignee for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.webkit.org/pipermail/webkit-unassigned/attachments/20200129/3f5e2973/attachment.htm>