Bug 158241

Crash under VisibleSelection::firstRange(): Thread[0] EXC_BAD_ACCESS (SIGSEGV) (KERN_INVALID_ADDRESS at 0x0000000000000020) [ 0] 0x00007fff966100e6 WebCore`WebCore::VisibleSelection::firstRange() const [inlined] WebCore::Node::treeScope() const at Node.h:402 398 399 TreeScope& treeScope() const 400 { 401 ASSERT(m_treeScope); -> 402 return *m_treeScope; 403 } 404 static ptrdiff_t treeScopeMemoryOffset() { return OBJECT_OFFSETOF(Node, m_treeScope); } 405 406 // Returns true if this node is associated with a document and is in its associated document's 0x00007fff966100d7: movq %r12, %rdi 0x00007fff966100da: movq %rbx, %rsi 0x00007fff966100dd: callq 0x26d810 ; WebCore::Position::parentAnchoredEquivalent at Position.cpp:217 0x00007fff966100e2: movq -0x30(%rbp), %rax -> 0x00007fff966100e6: movq 0x20(%rax), %rax 0x00007fff966100ea: movq 0x8(%rax), %rsi 0x00007fff966100ee: movq %r14, %rdi 0x00007fff966100f1: movq %r15, %rdx 0x00007fff966100f4: movq %r12, %rcx [ 0] 0x00007fff966100e6 WebCore`WebCore::VisibleSelection::firstRange() const [inlined] WebCore::Position::anchorNode() const + 4 at Node.h:396 392 // A Document node returns itself. 393 Document& document() const 394 { 395 ASSERT(this); -> 396 return treeScope().documentScope(); 397 } 398 399 TreeScope& treeScope() const 400 { [ 0] 0x00007fff966100e2 WebCore`WebCore::VisibleSelection::firstRange() const + 66 at VisibleSelection.cpp:132 128 if (isNone()) 129 return 0; 130 Position start = m_start.parentAnchoredEquivalent(); 131 Position end = m_end.parentAnchoredEquivalent(); -> 132 return Range::create(start.anchorNode()->document(), start, end); 133 } 134 135 PassRefPtr<Range> VisibleSelection::toNormalizedRange() const 136 { [ 1] 0x00007fff8e89f2cb WebKit`WebKit::ServicesOverlayController::buildSelectionHighlight() + 79 at ServicesOverlayController.mm:518 514 515 Vector<CGRect> cgRects; 516 cgRects.reserveCapacity(m_currentSelectionRects.size()); 517 -> 518 RefPtr<Range> selectionRange = m_webPage.corePage()->selection().firstRange(); 519 if (selectionRange) { 520 Frame* mainFrame = m_webPage.mainFrame(); 521 FrameView& mainFrameView = *mainFrame->view(); 522 FrameView* viewForRange = selectionRange->ownerDocument().view(); [ 2] 0x00007fff8e89f1e1 WebKit`WebKit::ServicesOverlayController::selectionRectsDidChange(WTF::Vector<WebCore::LayoutRect, 0ul, WTF::CrashOnOverflow> const&, WTF::Vector<WebCore::GapRects, 0ul, WTF::CrashOnOverflow> const&, bool) + 1703 at ServicesOverlayController.mm:392 I hit this when visiting the Performance Dashboard.