61733 2011-05-30 09:31:32 -0700 [Chromium] REGRESSION: Crash in WebCore::HTMLLinkElement::onloadTimerFired after r87628 2011-05-30 12:29:26 -0700 1 1 1 Unclassified WebKit DOM 528+ (Nightly build) All All RESOLVED FIXED P1 Normal --- 61736 1 mnaganov mnaganov abarth ap oldest_to_newest 412259 0 mnaganov 2011-05-30 09:31:32 -0700 Having r87628 in place, Chrome reliability bot crashes in WebCore::HTMLLinkElement::onloadTimerFired http://build.chromium.org/p/chromium/builders/Win%20Reliability/builds/4073/steps/reliability%3A%20partial%20result%20of%20current%20build/logs/stdio This is because the change makes WebCore::CachedResource::setRequest to call checkNotify on request reset. HTMLLinkElement registers itself as CachedResource client via m_cachedSheet, which can happen even if m_cachedLinkResource wasn't set. As a result, WebCore::HTMLLinkElement::notifyFinished is got called with unset m_cachedLinkResource, which causes a crash in HTMLLinkElement::onloadTimerFired 412262 1 95348 mnaganov 2011-05-30 09:37:28 -0700 Created attachment 95348 patch 412270 2 95348 abarth 2011-05-30 09:54:43 -0700 Comment on attachment 95348 patch I'm not sure this patch is correct. Why is notifyFinished being called with a different cached resource? 412279 3 95351 abarth 2011-05-30 10:15:41 -0700 Created attachment 95351 Updated patch 412281 4 abarth 2011-05-30 10:19:12 -0700 I'm going to land this patch without a test because this is blocking WebKit => Chromium integration. I'll add the test in Bug 61736. 412283 5 abarth 2011-05-30 10:21:19 -0700 Committed r87693: <http://trac.webkit.org/changeset/87693> 412323 6 ap 2011-05-30 12:29:26 -0700 Thanks Adam! I don't have the time to deeply investigate this right now, but the patch looks very reasonable. 95348 2011-05-30 09:37:28 -0700 2011-05-30 10:15:37 -0700 patch patch-61733 text/plain 1123 mnaganov ZGlmZiAtLWdpdCBhL1NvdXJjZS9XZWJDb3JlL0NoYW5nZUxvZyBiL1NvdXJjZS9XZWJDb3JlL0No YW5nZUxvZwppbmRleCBjYjU5MjVhLi5iZDE2MzRiIDEwMDY0NAotLS0gYS9Tb3VyY2UvV2ViQ29y ZS9DaGFuZ2VMb2cKKysrIGIvU291cmNlL1dlYkNvcmUvQ2hhbmdlTG9nCkBAIC0xLDMgKzEsMTMg QEAKKzIwMTEtMDUtMzAgIE1pa2hhaWwgTmFnYW5vdiAgPG1uYWdhbm92QGNocm9taXVtLm9yZz4K KworICAgICAgICBSZXZpZXdlZCBieSBOT0JPRFkgKE9PUFMhKS4KKworICAgICAgICBbQ2hyb21p dW1dIEZpeCByZWdyZXNzaW9uIGFmdGVyIHI4NzYyOC4KKyAgICAgICAgaHR0cHM6Ly9idWdzLndl YmtpdC5vcmcvc2hvd19idWcuY2dpP2lkPTYxNzMzCisKKyAgICAgICAgKiBodG1sL0hUTUxMaW5r RWxlbWVudC5jcHA6CisgICAgICAgIChXZWJDb3JlOjpIVE1MTGlua0VsZW1lbnQ6Om5vdGlmeUZp bmlzaGVkKToKKwogMjAxMS0wNS0zMCAgQW5kcmV5IEtvc3lha292ICA8Y2FzZXFAY2hyb21pdW0u b3JnPgogCiAgICAgICAgIFJldmlld2VkIGJ5IFBhdmVsIEZlbGRtYW4uCmRpZmYgLS1naXQgYS9T b3VyY2UvV2ViQ29yZS9odG1sL0hUTUxMaW5rRWxlbWVudC5jcHAgYi9Tb3VyY2UvV2ViQ29yZS9o dG1sL0hUTUxMaW5rRWxlbWVudC5jcHAKaW5kZXggZjkzZDFjMC4uNDYwMjg0NiAxMDA2NDQKLS0t IGEvU291cmNlL1dlYkNvcmUvaHRtbC9IVE1MTGlua0VsZW1lbnQuY3BwCisrKyBiL1NvdXJjZS9X ZWJDb3JlL2h0bWwvSFRNTExpbmtFbGVtZW50LmNwcApAQCAtNDUyLDggKzQ1Miw4IEBAIHZvaWQg SFRNTExpbmtFbGVtZW50OjpvbmxvYWRUaW1lckZpcmVkKFRpbWVyPEhUTUxMaW5rRWxlbWVudD4q IHRpbWVyKQogCiB2b2lkIEhUTUxMaW5rRWxlbWVudDo6bm90aWZ5RmluaXNoZWQoQ2FjaGVkUmVz b3VyY2UqIHJlc291cmNlKQogewotICAgIG1fb25sb2FkVGltZXIuc3RhcnRPbmVTaG90KDApOwot ICAgIEFTU0VSVChtX2NhY2hlZExpbmtSZXNvdXJjZS5nZXQoKSA9PSByZXNvdXJjZSk7CisgICAg aWYgKG1fY2FjaGVkTGlua1Jlc291cmNlLmdldCgpID09IHJlc291cmNlKQorICAgICAgICBtX29u bG9hZFRpbWVyLnN0YXJ0T25lU2hvdCgwKTsKIH0KICNlbmRpZgogCg== 95351 2011-05-30 10:15:41 -0700 2011-05-30 10:15:41 -0700 Updated patch bug-61733-20110530101540.patch text/plain 2068 abarth SW5kZXg6IFNvdXJjZS9XZWJDb3JlL0NoYW5nZUxvZwo9PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09Ci0tLSBTb3VyY2UvV2Vi Q29yZS9DaGFuZ2VMb2cJKHJldmlzaW9uIDg3NjkxKQorKysgU291cmNlL1dlYkNvcmUvQ2hhbmdl TG9nCSh3b3JraW5nIGNvcHkpCkBAIC0xLDMgKzEsMjQgQEAKKzIwMTEtMDUtMzAgIE1pa2hhaWwg TmFnYW5vdiAgPG1uYWdhbm92QGNocm9taXVtLm9yZz4KKworICAgICAgICBSZXZpZXdlZCBieSBB ZGFtIEJhcnRoLgorCisgICAgICAgIFtDaHJvbWl1bV0gRml4IHJlZ3Jlc3Npb24gYWZ0ZXIgcjg3 NjI4LgorICAgICAgICBodHRwczovL2J1Z3Mud2Via2l0Lm9yZy9zaG93X2J1Zy5jZ2k/aWQ9NjE3 MzMKKworICAgICAgICBIYXZpbmcgcjg3NjI4IGluIHBsYWNlLCBDaHJvbWUgcmVsaWFiaWxpdHkg Ym90IGNyYXNoZXMgaW4KKyAgICAgICAgV2ViQ29yZTo6SFRNTExpbmtFbGVtZW50OjpvbmxvYWRU aW1lckZpcmVkLgorCisgICAgICAgIFRoaXMgaXMgYmVjYXVzZSB0aGUgY2hhbmdlIG1ha2VzIFdl YkNvcmU6OkNhY2hlZFJlc291cmNlOjpzZXRSZXF1ZXN0IHRvCisgICAgICAgIGNhbGwgY2hlY2tO b3RpZnkgb24gcmVxdWVzdCByZXNldC4gIEhUTUxMaW5rRWxlbWVudCByZWdpc3RlcnMgaXRzZWxm IGFzCisgICAgICAgIENhY2hlZFJlc291cmNlIGNsaWVudCB2aWEgbV9jYWNoZWRTaGVldCwgd2hp Y2ggY2FuIGhhcHBlbiBldmVuIGlmCisgICAgICAgIG1fY2FjaGVkTGlua1Jlc291cmNlIHdhc24n dCBzZXQuICBBcyBhIHJlc3VsdCwKKyAgICAgICAgV2ViQ29yZTo6SFRNTExpbmtFbGVtZW50Ojpu b3RpZnlGaW5pc2hlZCBpcyBnb3QgY2FsbGVkIHdpdGggdW5zZXQKKyAgICAgICAgbV9jYWNoZWRM aW5rUmVzb3VyY2UsIHdoaWNoIGNhdXNlcyBhIGNyYXNoIGluCisgICAgICAgIEhUTUxMaW5rRWxl bWVudDo6b25sb2FkVGltZXJGaXJlZAorCisgICAgICAgICogaHRtbC9IVE1MTGlua0VsZW1lbnQu Y3BwOgorICAgICAgICAoV2ViQ29yZTo6SFRNTExpbmtFbGVtZW50Ojpub3RpZnlGaW5pc2hlZCk6 CisKIDIwMTEtMDUtMzAgIEdhdmluIFBldGVycyAgPGdhdmlucEBjaHJvbWl1bS5vcmc+CiAKICAg ICAgICAgUmV2aWV3ZWQgYnkgQWRhbSBCYXJ0aC4KSW5kZXg6IFNvdXJjZS9XZWJDb3JlL2h0bWwv SFRNTExpbmtFbGVtZW50LmNwcAo9PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09Ci0tLSBTb3VyY2UvV2ViQ29yZS9odG1sL0hU TUxMaW5rRWxlbWVudC5jcHAJKHJldmlzaW9uIDg3NjkxKQorKysgU291cmNlL1dlYkNvcmUvaHRt bC9IVE1MTGlua0VsZW1lbnQuY3BwCSh3b3JraW5nIGNvcHkpCkBAIC03NSw3ICs3NSw3IEBAIEhU TUxMaW5rRWxlbWVudDo6fkhUTUxMaW5rRWxlbWVudCgpCiAgICAgICAgIG1fc2hlZXQtPmNsZWFy T3duZXJOb2RlKCk7CiAKICAgICBpZiAobV9jYWNoZWRTaGVldCkgewotICAgICAgICBtX2NhY2hl ZFNoZWV0LT5yZW1vdmVDbGllbnQodGhpcyk7ICAgIAorICAgICAgICBtX2NhY2hlZFNoZWV0LT5y ZW1vdmVDbGllbnQodGhpcyk7CiAgICAgICAgIHJlbW92ZVBlbmRpbmdTaGVldCgpOwogICAgIH0K ICAgICAKQEAgLTQ1Nyw4ICs0NTcsOSBAQCB2b2lkIEhUTUxMaW5rRWxlbWVudDo6b25sb2FkVGlt ZXJGaXJlZChUCiAKIHZvaWQgSFRNTExpbmtFbGVtZW50Ojpub3RpZnlGaW5pc2hlZChDYWNoZWRS ZXNvdXJjZSogcmVzb3VyY2UpCiB7Ci0gICAgbV9vbmxvYWRUaW1lci5zdGFydE9uZVNob3QoMCk7 Ci0gICAgQVNTRVJUKG1fY2FjaGVkTGlua1Jlc291cmNlLmdldCgpID09IHJlc291cmNlKTsKKyAg ICBBU1NFUlQobV9jYWNoZWRMaW5rUmVzb3VyY2UuZ2V0KCkgPT0gcmVzb3VyY2UgfHwgbV9jYWNo ZWRTaGVldC5nZXQoKSA9PSByZXNvdXJjZSk7CisgICAgaWYgKG1fY2FjaGVkTGlua1Jlc291cmNl LmdldCgpID09IHJlc291cmNlKQorICAgICAgICBtX29ubG9hZFRpbWVyLnN0YXJ0T25lU2hvdCgw KTsKIH0KICNlbmRpZgogCg==