21218 2008-09-29 12:59:04 -0700 REGRESSION: Crash in Frame::prohibitsScrolling() when releasing a page from the back/forward cache 2008-09-29 13:10:20 -0700 1 1 1 Unclassified WebKit Platform 528+ (Nightly build) PC Windows XP RESOLVED FIXED PlatformOnly P1 Major --- 1 mitz hyatt hyatt oldest_to_newest 93261 0 mitz 2008-09-29 12:59:04 -0700 Steps to reproduce: 1) Go to data:text/html,a 2) In the same window, go to data:text/html,b 3) Open a new tab 4) Close the tab in which you visited a and b 5) Wait (do not interact with Safari while waiting) Backtrace: > WebKit_debug.dll!WebCore::Frame::prohibitsScrolling() Line 1732 + 0x3 bytes C++ WebKit_debug.dll!WebCore::ScrollView::updateScrollbars(const WebCore::IntSize & desiredOffset={...}) Line 270 + 0xf bytes C++ WebKit_debug.dll!WebCore::ScrollView::setScrollbarModes(WebCore::ScrollbarMode horizontalMode=ScrollbarAuto, WebCore::ScrollbarMode verticalMode=ScrollbarAuto) Line 76 C++ WebKit_debug.dll!WebCore::FrameView::resetScrollbars() Line 215 C++ WebKit_debug.dll!WebCore::FrameView::~FrameView() Line 184 C++ WebKit_debug.dll!WebCore::FrameView::`scalar deleting destructor'() + 0x16 bytes C++ WebKit_debug.dll!WebCore::FrameView::deref() Line 68 + 0x55 bytes C++ WebKit_debug.dll!WTF::RefPtr<WebCore::FrameView>::operator=(WebCore::FrameView * optr=0x00000000) Line 119 C++ WebKit_debug.dll!WebCore::CachedPage::clear() Line 169 C++ WebKit_debug.dll!WebCore::PageCache::releaseAutoreleasedPagesNow() Line 167 + 0x16 bytes C++ WebKit_debug.dll!WebCore::PageCache::releaseAutoreleasedPagesNowOrReschedule(WebCore::Timer<WebCore::PageCache> * timer=0x0447e6b0) Line 153 C++ WebKit_debug.dll!WebCore::Timer<WebCore::PageCache>::fired() Line 99 + 0x23 bytes C++ WebKit_debug.dll!WebCore::TimerBase::fireTimers(double fireTime=1222718154.5365591, const WTF::Vector<WebCore::TimerBase *,0> & firingTimers={...}) Line 347 + 0xf bytes C++ WebKit_debug.dll!WebCore::TimerBase::sharedTimerFired() Line 368 + 0x12 bytes C++ WebKit_debug.dll!WebCore::TimerWindowWndProc(HWND__ * hWnd=0x00020676, unsigned int message=0x0000c1bb, unsigned int wParam=0x00000000, long lParam=0x00000000) Line 102 + 0x8 bytes C++ Note: The Frame is null in the topmost stack frame. 93263 1 23916 hyatt 2008-09-29 13:08:28 -0700 Created attachment 23916 Patch 93264 2 23916 mitz 2008-09-29 13:09:35 -0700 Comment on attachment 23916 Patch r=me 93266 3 hyatt 2008-09-29 13:10:10 -0700 Fixed in r37069. 23916 2008-09-29 13:08:28 -0700 2008-09-29 13:09:35 -0700 Patch patch.txt text/plain 1281 hyatt SW5kZXg6IENoYW5nZUxvZwo9PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09Ci0tLSBDaGFuZ2VMb2cJKHJldmlzaW9uIDM3MDY4 KQorKysgQ2hhbmdlTG9nCSh3b3JraW5nIGNvcHkpCkBAIC0xLDMgKzEsMTUgQEAKKzIwMDgtMDkt MjkgIERhdmlkIEh5YXR0ICA8aHlhdHRAYXBwbGUuY29tPgorCisgICAgICAgIGh0dHBzOi8vYnVn cy53ZWJraXQub3JnL3Nob3dfYnVnLmNnaT9pZD0yMTIxOAorCisgICAgICAgIEFjY2lkZW50YWxs eSByZW1vdmVkIGEgY2hlY2sgdG8gc2VlIGlmIHRoZSBzY3JvbGxiYXIgbW9kZXMgd2VyZSBlcXVh bC4gIFRoaXMgY2F1c2VkIGEgY3Jhc2ggb24gV2luZG93cy4KKyAgICAgICAgSXQncyBzaWxseSB0 aGF0IHRoZSBjb2RlIHdhcyB0aGlzIGZyYWdpbGUsIGJ1dCBmb3Igbm93IGp1c3QgcHV0IHRoZSBj aGVjayBiYWNrIGluLgorCisgICAgICAgIFJldmlld2VkIGJ5IE5PQk9EWSAoT09QUyEpLgorCisg ICAgICAgICogcGxhdGZvcm0vU2Nyb2xsVmlldy5jcHA6CisgICAgICAgIChXZWJDb3JlOjpTY3Jv bGxWaWV3OjpzZXRTY3JvbGxiYXJNb2Rlcyk6CisKIDIwMDgtMDktMjkgIERhdmlkIEh5YXR0ICA8 aHlhdHRAYXBwbGUuY29tPgogCiAgICAgICAgIGh0dHBzOi8vYnVncy53ZWJraXQub3JnL3Nob3df YnVnLmNnaT9pZD0yMTIxNgpJbmRleDogcGxhdGZvcm0vU2Nyb2xsVmlldy5jcHAKPT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PQotLS0gcGxhdGZvcm0vU2Nyb2xsVmlldy5jcHAJKHJldmlzaW9uIDM3MDY3KQorKysgcGxhdGZv cm0vU2Nyb2xsVmlldy5jcHAJKHdvcmtpbmcgY29weSkKQEAgLTY3LDYgKzY3LDggQEAgdm9pZCBT Y3JvbGxWaWV3OjpyZW1vdmVDaGlsZChXaWRnZXQqIGNoaQogCiB2b2lkIFNjcm9sbFZpZXc6OnNl dFNjcm9sbGJhck1vZGVzKFNjcm9sbGJhck1vZGUgaG9yaXpvbnRhbE1vZGUsIFNjcm9sbGJhck1v ZGUgdmVydGljYWxNb2RlKQogeworICAgIGlmIChob3Jpem9udGFsTW9kZSA9PSBob3Jpem9udGFs U2Nyb2xsYmFyTW9kZSgpICYmIHZlcnRpY2FsTW9kZSA9PSB2ZXJ0aWNhbFNjcm9sbGJhck1vZGUo KSkKKyAgICAgICAgcmV0dXJuOwogICAgIG1faG9yaXpvbnRhbFNjcm9sbGJhck1vZGUgPSBob3Jp em9udGFsTW9kZTsKICAgICBtX3ZlcnRpY2FsU2Nyb2xsYmFyTW9kZSA9IHZlcnRpY2FsTW9kZTsK ICAgICBpZiAocGxhdGZvcm1XaWRnZXQoKSkK