36894 2010-03-31 11:49:31 -0700 Crash with frame flattening on after r56854 2010-04-06 11:43:30 -0700 1 1 1 Unclassified WebKit Frames 528+ (Nightly build) PC OS X 10.5 CLOSED FIXED P2 Normal --- 35784 1 bolsinga webkit-unassigned ain beanoboy7 ddkilzer deleted_user1 drcarstens hausmann hyatt kenneth koivisto mcroft svetloslav oldest_to_newest 206614 0 bolsinga 2010-03-31 11:49:31 -0700 Thread 0 Crashed: Dispatch queue: com.apple.main-thread 0 com.apple.WebCore 0x00000001011cd4c0 WebCore::Frame::ownerElement() const + 12 (Frame.cpp:1107) 1 com.apple.WebCore 0x00000001011f6d6c WebCore::FrameView::avoidScrollbarCreation() + 36 (FrameView.cpp:334) 2 com.apple.WebCore 0x00000001018101c4 WebCore::ScrollView::setHasHorizontalScrollbar(bool) + 38 (ScrollView.cpp:84) 3 com.apple.WebCore 0x00000001011f9faf WebCore::FrameView::~FrameView() + 359 (FrameView.cpp:165) m_frame is being destroyed here and is being accessed. To reproduce apply the following patch, build WebKit debug and run Safari: diff --git a/WebKit/mac/WebView/WebPreferences.mm b/WebKit/mac/WebView/WebPreferences.mm index 84a6e9e..28f8f17 100644 --- a/WebKit/mac/WebView/WebPreferences.mm +++ b/WebKit/mac/WebView/WebPreferences.mm @@ -357,7 +357,7 @@ static WebCacheModel cacheModelForMainBundle(void) [NSNumber numberWithBool:NO], WebKitWebGLEnabledPreferenceKey, [NSNumber numberWithBool:NO], WebKitUsesProxiedOpenPanelPreferenceKey, [NSNumber numberWithUnsignedInt:4], WebKitPluginAllowedRunTimePreferenceKey, - [NSNumber numberWithBool:NO], WebKitFrameFlatteningEnabledPreferenceKey, + [NSNumber numberWithBool:YES], WebKitFrameFlatteningEnabledPreferenceKey, nil]; // This value shouldn't ever change, which is assumed in the initialization of WebKitPDFDisplay 206619 1 bolsinga 2010-03-31 11:52:46 -0700 See Bug 36798 206624 2 kenneth 2010-03-31 12:04:55 -0700 Could you try changing void ScrollView::setHasVerticalScrollbar(bool hasBar) { if (avoidScrollbarCreation()) return; to if (hasBar && avoidScrollbarCreation()) return; 206626 3 bolsinga 2010-03-31 12:08:46 -0700 I did that for both tests, and that prevents the crash. 206632 4 kenneth 2010-03-31 12:17:53 -0700 Fix landed in r56856 208962 5 hausmann 2010-04-06 02:53:41 -0700 Revision r56856 cherry-picked into qtwebkit-2.0 with commit 59daec93fc7ad1f4c5dbeb88b67aca17d6f4cc3b 209141 6 ap 2010-04-06 11:41:42 -0700 *** Bug 36928 has been marked as a duplicate of this bug. *** 209144 7 ap 2010-04-06 11:42:49 -0700 *** Bug 36915 has been marked as a duplicate of this bug. *** 209146 8 ap 2010-04-06 11:42:52 -0700 *** Bug 36914 has been marked as a duplicate of this bug. *** 209148 9 ap 2010-04-06 11:42:56 -0700 *** Bug 36913 has been marked as a duplicate of this bug. *** 209150 10 ap 2010-04-06 11:42:59 -0700 *** Bug 36969 has been marked as a duplicate of this bug. *** 209152 11 ap 2010-04-06 11:43:08 -0700 *** Bug 36927 has been marked as a duplicate of this bug. *** 209154 12 ap 2010-04-06 11:43:18 -0700 *** Bug 36922 has been marked as a duplicate of this bug. *** 209157 13 ap 2010-04-06 11:43:30 -0700 *** Bug 36920 has been marked as a duplicate of this bug. ***