Skip to content

GitLab

T
tangled
Commit ac2d13bd authored by Denis Bessonov's avatar Denis Bessonov Committed by Commit Bot
Browse files
Options

Added a javascript layout test to reproduce the 793720 crash. 

The crash occurs in the following situation:
- Navigation is performing which results in Frame detach from DOMWindow
- PerformanceObserver::disconnect is called from PromiseReactionJob micro task

In this case, this call graph is executed:

blink::(anonymous namespace)::EndOfTaskRunner::DidProcessTask()
  v8::internal::Isolate::RunMicrotasks()
    v8::internal::Isolate::RunMicrotasksInternal()
      v8::internal::Isolate::PromiseReactionJob()
        ... some V8 magic to call browser API from JS ...
          blink::PerformanceObserver::disconnect()
            blink::PerformanceBase::UnregisterPerformanceObserver()
              blink::Performance::UpdateLongTaskInstrumentation()
                blink::LocalFrame::GetDocument() const

and, given that Frame has been detached, GetDocument() is called with this
equal to nullptr, which leads to segfault.

Bug: 793720
Change-Id: Id3cd67e3ebb5a197024b8ac269eebfc241cf2fc7
Reviewed-on: https://chromium-review.googlesource.com/825022
Commit-Queue: Steve Kobes <skobes@chromium.org>
Reviewed-by: default avatarDaniel Cheng <dcheng@chromium.org>
Reviewed-by: default avatarSteve Kobes <skobes@chromium.org>
Cr-Commit-Position: refs/heads/master@{#526528}
parent a9b68160
Hide whitespace changes
Inline Side-by-side
Showing with 26 additions and 0 deletions
third_party/WebKit/LayoutTests/performance/performance-observer-crash.html 0 → 100644
View file @ ac2d13bd
<html>
<head>
<title>Crash page</title>
<script>
var observer = new PerformanceObserver(() => {});
function disconnectObserver() {
observer.disconnect();
testRunner.notifyDone();
}
function beginFetch() {
fetch('http://localhost/not-exists.jpg').catch(disconnectObserver);
}
function navigate() {
window.addEventListener("unload", beginFetch);
location.assign("about:blank");
};
testRunner.dumpAsText();
testRunner.setCustomTextOutput("");
testRunner.waitUntilDone();
</script>
</head>
<body onload="navigate()">
<p>This page will try to crash the renderer</p>
</body>
</html>
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment