19249 2008-05-25 20:18:54 -0700 Assertion failure in FrameView::scheduleRelayout() (m_frame->view() == this) clicking an image from the Phoenix Mars mission 2009-04-30 17:12:04 -0700 1 1 1 Unclassified WebKit Layout and Rendering 528+ (Nightly build) Mac OS X 10.5 RESOLVED FIXED http://fawkes1.lpl.arizona.edu/images.php?gID=0&cID=8 HasReduction, InRadar P2 Normal --- 1 mitz webkit-unassigned beidson dev+webkit oldest_to_newest 81504 0 mitz 2008-05-25 20:18:54 -0700 Clicking a thumbnail in the URL leads to ASSERTION FAILED: m_frame->view() == this (/WebCore/page/FrameView.cpp:778 void WebCore::FrameView::scheduleRelayout()) 81506 1 mitz 2008-05-25 20:29:47 -0700 I think the key is Document::updateDocumentsRendering() in the backtrace. The old document has changed children but it is no longer in the frame, so it should not update. Perhaps the function that puts a document into the page cache should take it out of the changedDocuments set. The bug doesn't happen when the back/forward cache is disabled. 81507 2 mitz 2008-05-25 21:55:45 -0700 The URL is already dead and I cannot reproduce with other image galleries on the site :-( 81508 3 mitz 2008-05-25 21:58:10 -0700 (In reply to comment #2) > I cannot reproduce with other image galleries on the site :-( Turns out disabling the back/forward cache is a sticky setting :-) I can reproduce with other galleries. URL updated. 81513 4 21345 mitz 2008-05-25 22:28:17 -0700 Created attachment 21345 Reduction (save as a file and open; will ASSERT) While the page is in the back/forward cache, the link changes to visited, which changes the document and triggers a style recalc in the cached document. 81514 5 21345 mitz 2008-05-25 22:30:37 -0700 Comment on attachment 21345 Reduction (save as a file and open; will ASSERT) Note: the reduction doesn't work when served over https from Bugzilla, because secure pages never enter the page cache. 81517 6 mitz 2008-05-26 00:29:30 -0700 The issue appears to be more general: a script can hold a reference to a document in the back/forward cache and modify it, requiring relayout. 81543 7 21350 mitz 2008-05-26 13:59:08 -0700 Created attachment 21350 Reduction without visited links (will ASSERT) An example of the same problem with a script modifying a document in the back/forward cache. A script can conceivably retroactively make the page ineligible for the back/forward cache, too. 81544 8 mitz 2008-05-26 14:01:05 -0700 <rdar://problem/5963470> 87545 9 mitz 2008-08-01 00:06:28 -0700 *** Bug 20248 has been marked as a duplicate of this bug. *** 119549 10 beidson 2009-04-30 17:12:04 -0700 This no longer reproduces. 21345 2008-05-25 22:28:17 -0700 2008-05-25 22:30:37 -0700 Reduction (save as a file and open; will ASSERT) 19249 reduction.html text/html 258 mitz PHN0eWxlPg0KICAgIGE6dmlzaXRlZCB7IGJvcmRlcjogc29saWQ7IH0NCjwvc3R5bGU+DQo8YSBp ZD0ibGluayI+Q2xpY2sgdGhpcyB1bnZpc2l0ZWQgbGluayBhbmQgd2FpdCAoYnVncy53ZWJraXQu b3JnIGNhbiBiZSBzbG93KTwvYT4NCjxzY3JpcHQ+DQogICAgZG9jdW1lbnQuZ2V0RWxlbWVudEJ5 SWQoImxpbmsiKS5zZXRBdHRyaWJ1dGUoImhyZWYiLCAiaHR0cHM6Ly9idWdzLndlYmtpdC5vcmcv PyIgKyBEYXRlLm5vdygpKTsNCjwvc2NyaXB0Pg0K 21350 2008-05-26 13:59:08 -0700 2008-05-26 13:59:08 -0700 Reduction without visited links (will ASSERT) 19249 another reduction.html text/html 483 mitz PHNjcmlwdD4KICAgIHZhciB3OwogICAgdmFyIGQ7CiAgICBmdW5jdGlvbiB0ZXN0KCkKICAgIHsK ICAgICAgICB3ID0gb3BlbigiZGF0YTp0ZXh0L2h0bWwsIik7CiAgICAgICAgc2V0VGltZW91dChn ZXREb2N1bWVudEFuZE5hdmlnYXRlLCAwKTsKICAgIH0KCiAgICBmdW5jdGlvbiBnZXREb2N1bWVu dEFuZE5hdmlnYXRlKCkKICAgIHsKICAgICAgICBkID0gdy5kb2N1bWVudDsKICAgICAgICB3Lmxv Y2F0aW9uLmhyZWYgPSAiYWJvdXQ6YmxhbmsiOwogICAgICAgIHNldFRpbWVvdXQobW9kaWZ5RG9j dW1lbnQsIDApOwogICAgfQoKICAgIGZ1bmN0aW9uIG1vZGlmeURvY3VtZW50KCkKICAgIHsKICAg ICAgICBkLmJvZHkuYXBwZW5kQ2hpbGQoZC5jcmVhdGVFbGVtZW50KCJkaXYiKSk7CiAgICAgICAg ZC5ib2R5LmZpcnN0Q2hpbGQub2Zmc2V0VG9wOwogICAgfQo8L3NjcmlwdD4KPGJ1dHRvbiBvbmNs aWNrPSJ0ZXN0KCkiPlRlc3Q8L2J1dHRvbj4K