REGRESSION: Assert and crash after dragging image into window with onunload handlers

• Component: WebCore Misc.
• Status: RESOLVED FIXED

[Tom Brown]

This crash is partially reproducible and *feels* like a race condition. Sometimes the test-case reduction crashes the browser, but other times it doesn't. The test-case reduction does the following:

1) Main window script opens new window.
2) Drag image from new window into main window.
3) Main window document onUnload event fires as image is loaded.
4) Main window onUnload handler closes new window.
5) Main window and new window send notification of closure to server.
6) The dragged image appears briefly as the document in the main window.
7) *Crash*

[Tom Brown]

Created attachment 13069 [details]
A backtrace of the crash

[Tom Brown]

Created attachment 13070 [details]
Test case reduction

1) Open "main.html" in the browser.
2) Click the button.
3) Drag the image from the new window to the main window.
4) *Crash*

[Matt Lilek]

r19510 debug build gives me the following assert: 

ASSERTION FAILED: page
(/Users/matt/Code/WebKit/WebKit/WebView/WebHTMLView.mm:2951 -[WebHTMLView draggedImage:endedAt:operation:])

[Maciej Stachowiak]

<rdar://problem/4990047>

Fixed in <http://trac.webkit.org/projects/webkit/changeset/19614>.