49116 2010-11-05 17:19:20 -0700 Need to check if page is detached in Frame::transferChildFrameToNewDocument to avoid occasional crash 2010-11-05 17:44:10 -0700 1 1 1 Unclassified WebKit WebCore JavaScript 528+ (Nightly build) PC All RESOLVED FIXED P2 Normal --- 1 jianli jianli abarth commit-queue dimich levin oldest_to_newest 305657 0 jianli 2010-11-05 17:19:20 -0700 We see some occasional crash happening in Frame::transferChildFrameToNewDocument when we try to transfer the frame and close the document at the same time. 305661 1 73148 jianli 2010-11-05 17:24:09 -0700 Created attachment 73148 Proposed Patch 305663 2 73148 dimich 2010-11-05 17:28:01 -0700 Comment on attachment 73148 Proposed Patch I guess there is no way to test it from layout test... We don't even have a repro case for it, only crash stack. Anyways, the check looks reasonable. r=me 305672 3 73148 commit-queue 2010-11-05 17:42:42 -0700 Comment on attachment 73148 Proposed Patch Clearing flags on attachment: 73148 Committed r71460: <http://trac.webkit.org/changeset/71460> 305673 4 commit-queue 2010-11-05 17:42:47 -0700 All reviewed patches have been landed. Closing bug. 305674 5 abarth 2010-11-05 17:44:10 -0700 Why can't you test it? A +-B +-C +-D In A, grab B's document and then detach frame B from the DOM. Now, grab C and try to adopt it as a child of D. 73148 2010-11-05 17:24:09 -0700 2010-11-05 17:42:42 -0700 Proposed Patch 49116 text/plain 1375 jianli ZGlmZiAtLWdpdCBhL1dlYkNvcmUvQ2hhbmdlTG9nIGIvV2ViQ29yZS9DaGFuZ2VMb2cKaW5kZXgg NmU3NGY2Zi4uYzYyZmUxNiAxMDA2NDQKLS0tIGEvV2ViQ29yZS9DaGFuZ2VMb2cKKysrIGIvV2Vi Q29yZS9DaGFuZ2VMb2cKQEAgLTEsMyArMSwxNSBAQAorMjAxMC0xMS0wNSAgSmlhbiBMaSAgPGpp YW5saUBjaHJvbWl1bS5vcmc+CisKKyAgICAgICAgUmV2aWV3ZWQgYnkgTk9CT0RZIChPT1BTISku CisKKyAgICAgICAgTmVlZCB0byBjaGVjayBpZiBwYWdlIGlzIGRldGFjaGVkIGluIEZyYW1lOjp0 cmFuc2ZlckNoaWxkRnJhbWVUb05ld0RvY3VtZW50IHRvIGF2b2lkIG9jY2FzaW9uYWwgY3Jhc2gK KyAgICAgICAgaHR0cHM6Ly9idWdzLndlYmtpdC5vcmcvc2hvd19idWcuY2dpP2lkPTQ5MTE2CisK KyAgICAgICAgVGhlIGZpeCBpcyB0byBhZGQgdGhlIGNoZWNrLgorCisgICAgICAgICogcGFnZS9G cmFtZS5jcHA6CisgICAgICAgIChXZWJDb3JlOjpGcmFtZTo6dHJhbnNmZXJDaGlsZEZyYW1lVG9O ZXdEb2N1bWVudCk6CisKIDIwMTAtMTEtMDQgIFpoZW55YW8gTW8gIDx6bW9AZ29vZ2xlLmNvbT4K IAogICAgICAgICBSZXZpZXdlZCBieSBLZW5uZXRoIFJ1c3NlbGwuCmRpZmYgLS1naXQgYS9XZWJD b3JlL3BhZ2UvRnJhbWUuY3BwIGIvV2ViQ29yZS9wYWdlL0ZyYW1lLmNwcAppbmRleCBkYmU2OWEz Li44NTE0ZjJkIDEwMDY0NAotLS0gYS9XZWJDb3JlL3BhZ2UvRnJhbWUuY3BwCisrKyBiL1dlYkNv cmUvcGFnZS9GcmFtZS5jcHAKQEAgLTcxNiwxMSArNzE2LDEyIEBAIHZvaWQgRnJhbWU6OnRyYW5z ZmVyQ2hpbGRGcmFtZVRvTmV3RG9jdW1lbnQoKQogICAgIFBhZ2UqIG5ld1BhZ2UgPSBuZXdQYXJl bnQgPyBuZXdQYXJlbnQtPnBhZ2UoKSA6IDA7CiAgICAgUGFnZSogb2xkUGFnZSA9IG1fcGFnZTsK ICAgICBpZiAobV9wYWdlICE9IG5ld1BhZ2UpIHsKLSAgICAgICAgaWYgKHBhZ2UoKS0+Zm9jdXND b250cm9sbGVyKCktPmZvY3VzZWRGcmFtZSgpID09IHRoaXMpCi0gICAgICAgICAgICBwYWdlKCkt PmZvY3VzQ29udHJvbGxlcigpLT5zZXRGb2N1c2VkRnJhbWUoMCk7CisgICAgICAgIGlmIChtX3Bh Z2UpIHsKKyAgICAgICAgICAgIGlmIChtX3BhZ2UtPmZvY3VzQ29udHJvbGxlcigpLT5mb2N1c2Vk RnJhbWUoKSA9PSB0aGlzKQorICAgICAgICAgICAgICAgIG1fcGFnZS0+Zm9jdXNDb250cm9sbGVy KCktPnNldEZvY3VzZWRGcmFtZSgwKTsKIAotICAgICAgICBpZiAobV9wYWdlKQotICAgICAgICAg ICAgbV9wYWdlLT5kZWNyZW1lbnRGcmFtZUNvdW50KCk7CisgICAgICAgICAgICAgbV9wYWdlLT5k ZWNyZW1lbnRGcmFtZUNvdW50KCk7CisgICAgICAgIH0KIAogICAgICAgICBtX3BhZ2UgPSBuZXdQ YWdlOwogCg==