33972 2010-01-21 14:39:37 -0800 Assertion failure in FrameLoader::checkLoadComplete() 2010-01-21 15:21:24 -0800 1 1 1 Unclassified WebKit Page Loading 528+ (Nightly build) Mac OS X 10.6 RESOLVED FIXED InRadar P2 Normal --- 29692 1 ap ap oldest_to_newest 183321 0 ap 2010-01-21 14:39:37 -0800 I'm frequently seeing assertion failure in FrameLoader::checkLoadComplete(): ASSERT(m_client->hasWebView()); I couldn't make a test case, but the sequence of events if roughly as follows: - a subframe is detached (FrameLoader::detachFromParent is called); - this results in a Frame::pageDestroyed() call (which is a lie, as Page is not destroyed); - after a while, FrameLoader's checkTimer fires; - since Frame::m_page is null now, m_client->hasWebView() returns false. This doesn't always happen, because usually, Frame is destructed before checkTimer has a chance to fire, canceling the timer. But Frame destruction is not totally deterministic, and I see Frame::m_lifeSupportTimer timer sometimes keep it alive long enough for FrameLoader::checkTimer to fire. 183322 1 ap 2010-01-21 14:40:02 -0800 <rdar://problem/7545095> 183325 2 47147 ap 2010-01-21 14:47:57 -0800 Created attachment 47147 proposed fix 183345 3 ap 2010-01-21 15:21:24 -0800 Committed <http://trac.webkit.org/changeset/53655>. 47147 2010-01-21 14:47:57 -0800 2010-01-21 15:11:10 -0800 proposed fix FuzzerAssertion.txt text/plain 1308 ap SW5kZXg6IFdlYkNvcmUvQ2hhbmdlTG9nCj09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT0KLS0tIFdlYkNvcmUvQ2hhbmdlTG9n CShyZXZpc2lvbiA1MzY1MSkKKysrIFdlYkNvcmUvQ2hhbmdlTG9nCSh3b3JraW5nIGNvcHkpCkBA IC0xLDMgKzEsMTcgQEAKKzIwMTAtMDEtMjEgIEFsZXhleSBQcm9za3VyeWFrb3YgIDxhcEBhcHBs ZS5jb20+CisKKyAgICAgICAgUmV2aWV3ZWQgYnkgTk9CT0RZIChPT1BTISkuCisKKyAgICAgICAg aHR0cHM6Ly9idWdzLndlYmtpdC5vcmcvc2hvd19idWcuY2dpP2lkPTMzOTcyCisgICAgICAgIEFz c2VydGlvbiBmYWlsdXJlIGluIEZyYW1lTG9hZGVyOjpjaGVja0xvYWRDb21wbGV0ZSgpCisKKyAg ICAgICAgSSBjb3VsZG4ndCBtYWtlIGEgdGVzdCBmb3IgdGhpcywgYWZ0ZXIgdHJ5aW5nIHJhdGhl ciBoYXJkLiBJJ20gbm90IHRvbyB3b3JyaWVkLCBiZWNhdXNlIHN1Y2gKKyAgICAgICAgYSB0ZXN0 IGhhcyB0byBkZXBlbmQgb24gZGV0YWlscyBvZiBjdXJyZW50IGltcGxlbWVudGF0aW9uIHNvIGlu dGltYXRlbHkgdGhhdCBpdCB3b3VsZCBiZWNvbWUKKyAgICAgICAgaW5lZmZlY3RpdmUgdmVyeSBx dWlja2x5IGFueXdheS4KKworICAgICAgICAqIGxvYWRlci9GcmFtZUxvYWRlci5jcHA6IChXZWJD b3JlOjpGcmFtZUxvYWRlcjo6c3RvcEFsbExvYWRlcnMpOiBTdG9wIHRoZSBjaGVjayB0aW1lciwg d2UKKyAgICAgICAgZG9uJ3QgbmVlZCBpdCBhZnRlciBhYm9ydGluZyBsb2FkLgorCiAyMDEwLTAx LTIxICBDc2FiYSBPc3p0cm9nb27DoWMgIDxvc3N5QHdlYmtpdC5vcmc+CiAKICAgICAgICAgVW5y ZXZpZXdlZCBidWlsZGZpeCBhZnRlciByNTM2NDQuCkluZGV4OiBXZWJDb3JlL2xvYWRlci9GcmFt ZUxvYWRlci5jcHAKPT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PQotLS0gV2ViQ29yZS9sb2FkZXIvRnJhbWVMb2FkZXIuY3Bw CShyZXZpc2lvbiA1MzU3MikKKysrIFdlYkNvcmUvbG9hZGVyL0ZyYW1lTG9hZGVyLmNwcAkod29y a2luZyBjb3B5KQpAQCAtMjMxMCw2ICsyMzEwLDggQEAgdm9pZCBGcmFtZUxvYWRlcjo6c3RvcEFs bExvYWRlcnMoRGF0YWJhcwogICAgIGlmIChtX2RvY3VtZW50TG9hZGVyKQogICAgICAgICBtX2Rv Y3VtZW50TG9hZGVyLT5jbGVhckFyY2hpdmVSZXNvdXJjZXMoKTsKIAorICAgIG1fY2hlY2tUaW1l ci5zdG9wKCk7CisKICAgICBtX2luU3RvcEFsbExvYWRlcnMgPSBmYWxzZTsgICAgCiB9CiAK