Web+ crashing in BView::_CheckOwnerLockAndSwitchCurrent()

[humdinger]

This is hrev57439, 64bit. HaikuWebKit 1.9.9 WebKit 618.1.7

For some days now I often get the attached crash. It seems to happen mainly when browsing reddit. Maybe something changed on their site recently? Never saw that one before...

Here's the gist:

thread 1078: WebPositive (main)
state: Exception (Segment violation)

Frame		IP			Function Name
-----------------------------------------------
0x7fba64f9f5e0	0xc4b5fe26a1	BView::_CheckOwnerLockAndSwitchCurrent() const + 0x1 
	Disassembly:
		BView::_CheckOwnerLockAndSwitchCurrent() const:
		0x000000c4b5fe26a0:               55  push %rbp
		0x000000c4b5fe26a1:       48837f6000  cmp $0x0, 0x60(%rdi) <--

	Frame memory:
		[0x7fba64f9f5d0]  ...d....A'......   f0 f5 f9 64 ba 7f 00 00 41 27 fe b5 c4 00 00 00
0x7fba64f9f600	0xc4b5fe273c	BView::PushState() + 0xc 
0x7fba64f9f680	0x16561c9a489	WebCore::ScrollbarThemeHaiku::paintScrollCorner(WebCore::ScrollableArea&, WebCore::GraphicsContext&, WebCore::IntRect const&) + 0x59 
0x7fba64f9f6c0	0x1656145b632	WebCore::ScrollView::paintScrollbars(WebCore::GraphicsContext&, WebCore::IntRect const&) + 0xf2 
0x7fba64f9f770	0x16561466250	WebCore::ScrollView::paint(WebCore::GraphicsContext&, WebCore::IntRect const&, WebCore::Widget::SecurityOriginPaintPolicy, WebCore::RegionContext*) + 0x240 
0x7fba64f9fac0	0x1656163c07d	WebCore::ContentfulPaintChecker::qualifiesForContentfulPaint(WebCore::LocalFrameView&) + 0xad 
0x7fba64f9fae0	0x16560d0232d	WebCore::Document::enqueuePaintTimingEntryIfNeeded() + 0xbd 
0x7fba64f9fb50	0x1656137e8de	WebCore::Page::forEachDocumentFromMainFrame(WebCore::Frame const&, WTF::Function<void ()(WebCore::Document&)> const&) + 0x12e 
0x7fba64f9fb90	0x1656137fe05	WebCore::Page::doAfterUpdateRendering() + 0x85 
0x7fba64f9fc80	0x1656138bbba	WebCore::Page::updateRendering() + 0x72a 
0x7fba64f9fca0	0x1656138be0c	WebCore::Page::isolatedUpdateRendering() + 0xc 
0x7fba64fa0040	0x1656095f505	BWebPage::paint(BRect, bool) + 0x85 
0x7fba64fa0070	0x1656095f727	BWebPage::handleSetVisible(BMessage const*) + 0x87 
0x7fba64fa0140	0x1656095fb6b	BWebPage::MessageReceived(BMessage*) + 0x42b 
0x7fba64fa0190	0xc4b5f34eee	BLooper::task_looper() + 0x28e 
0x7fba64fa01b0	0xc4b5f29f4c	BApplication::Run() + 0x1c 
0x7fba64fa01d0	0x1ff923aa119	main + 0x29 
0x7fba64fa0200	0x1ff923aa379	_start + 0x39 
0x7fba64fa0230	0x118319ebab3	runtime_loader + 0x113 
00000000	0x7fb716854258	commpage_thread_exit + 0 

[pulkomandy]

Already reported at haikuports and already fixed in haikuwebkit github repository. Will be fixed in the next haikuwebkit release.