70827 2011-10-25 10:34:36 -0700 REGRESSION(97821): HistoryController::itemsAreClones crashes a lot 2011-10-25 13:45:14 -0700 1 1 1 Unclassified WebKit History 528+ (Nightly build) Unspecified Unspecified RESOLVED FIXED InRadar P2 Normal --- 1 abarth andersca andersca japhet webkit-bug-importer webkit.review.bot oldest_to_newest 490125 0 abarth 2011-10-25 10:34:36 -0700 Anders, I'm told your change http://trac.webkit.org/changeset/97821 created a top crasher: Product: Chrome Stack Signature: WebCore::HistoryController::itemsAreClones(WebCore::HistoryItem *,WebCore::HistoryItem *)-41C257A New Signature Label: WebCore::HistoryController::itemsAreClones(WebCore::HistoryItem *,WebCore::HistoryItem *) New Signature Hash: f4054a06_1839c36f_6d8bbae7_b1081798_cfda059a Report link: http://go/crash/reportdetail?reportid=a45fb4601b0a005c Meta information: Product Name: Chrome Product Version: 17.0.917.0 Report ID: a45fb4601b0a005c Report Time: 2011/10/24 19:50:28, Mon Uptime: 2557 sec Cumulative Uptime: 0 sec OS Name: Windows NT OS Version: 6.1.7600 CPU Architecture: x86 CPU Info: GenuineIntel family 6 model 22 stepping 1 ptype: renderer Thread 0 *CRASHED* ( EXCEPTION_ACCESS_VIOLATION_READ @ 0x00000078 ) 0x61af732e [chrome.dll - historycontroller.cpp:744 WebCore::HistoryController::itemsAreClones(WebCore::HistoryItem *,WebCore::HistoryItem *) 0x61af6c42 [chrome.dll - historycontroller.cpp:475 WebCore::HistoryController::recursiveUpdateForCommit() 0x61af6cae [chrome.dll - historycontroller.cpp:498 WebCore::HistoryController::recursiveUpdateForCommit() 0x61af6cae [chrome.dll - historycontroller.cpp:498 WebCore::HistoryController::recursiveUpdateForCommit() 0x61af6cae [chrome.dll - historycontroller.cpp:498 WebCore::HistoryController::recursiveUpdateForCommit() 0x61af6cae [chrome.dll - historycontroller.cpp:498 WebCore::HistoryController::recursiveUpdateForCommit() 0x61b2bc8b [chrome.dll - frameloader.cpp:1839 WebCore::FrameLoader::transitionToCommitted(WTF::PassRefPtr<WebCore::CachedPage>) 0x61b2ba07 [chrome.dll - frameloader.cpp:1761 WebCore::FrameLoader::commitProvisionalLoad() 0x61b2f819 [chrome.dll - documentloader.cpp:274 WebCore::DocumentLoader::commitIfReady() 0x61b2f85b [chrome.dll - documentloader.cpp:295 WebCore::DocumentLoader::commitLoad(char const *,int) 0x61d4f1c8 [chrome.dll - mainresourceloader.cpp:168 WebCore::MainResourceLoader::addData(char const *,int,bool) 0x61d70bc3 [chrome.dll - resourceloader.cpp:287 WebCore::ResourceLoader::didReceiveData(char const *,int,__int64,bool) 0x61d4fa92 [chrome.dll - mainresourceloader.cpp:467 WebCore::MainResourceLoader::didReceiveData(char const *,int,__int64,bool) 0x61d70f45 [chrome.dll - resourceloader.cpp:441 WebCore::ResourceLoader::didReceiveData(WebCore::ResourceHandle *,char const *,int,int) 0x6157b4f9 [chrome.dll - resourcehandle.cpp:140 WebCore::ResourceHandleInternal::didReceiveData(WebKit::WebURLLoader *,char const *,int,int) 0x6134cd1d [chrome.dll - weburlloader_impl.cc:584 webkit_glue::WebURLLoaderImpl::Context::OnReceivedData(char const *,int,int) 0x60de1771 [chrome.dll - resource_dispatcher.cc:375 ResourceDispatcher::OnReceivedData(IPC::Message const &,int,void *,int,int) 0x60de1d13 [chrome.dll - resource_dispatcher.cc:523 ResourceDispatcher::DispatchMessageW(IPC::Message const &) 0x60de1584 [chrome.dll - resource_dispatcher.cc:302 ResourceDispatcher::OnMessageReceived(IPC::Message const &) 0x60de04c3 [chrome.dll - child_thread.cc:169 ChildThread::OnMessageReceived(IPC::Message const &) 0x61837b68 [chrome.dll - task.h:374 RunnableMethod<notifier::MediatorThreadImpl::Core,void ( notifier::MediatorThreadImpl::Core::*)(std::vector<notifier::Subscription,std::allocator<notifier::Subscription> > const &),Tuple1<std::vector<notifier::Subscription,std::allocator<notifier::Subscription> > > >::Run() 0x60efc5f6 [chrome.dll - task.cc:71 base::subtle::TaskClosureAdapter::Run() 0x60ef5057 [chrome.dll - message_loop.cc:495 MessageLoop::RunTask(MessageLoop::PendingTask const &) 0x60ef50d3 [chrome.dll - message_loop.cc:508 MessageLoop::DeferOrRunPendingTask(MessageLoop::PendingTask const &) 0x60ef5459 [chrome.dll - message_loop.cc:698 MessageLoop::DoWork() 0x60f0e57c [chrome.dll - message_pump_default.cc:50 base::MessagePumpDefault::Run(base::MessagePump::Delegate *) 0x60ef4f81 [chrome.dll - message_loop.cc:453 MessageLoop::RunInternal() 0x60ef4f06 [chrome.dll - message_loop.cc:426 MessageLoop::RunHandler() 0x60ef4e89 [chrome.dll - message_loop.cc:341 MessageLoop::Run() 0x6135ad70 [chrome.dll - renderer_main.cc:228 RendererMain(MainFunctionParams const &) 0x60f1740e [chrome.dll - content_main.cc:252 `anonymous namespace'::RunNamedProcessTypeMain(std::basic_string<char,std::char_traits<char>,std::allocator<char> > const &,MainFunctionParams const &,content::ContentMainDelegate *) 0x60f177a4 [chrome.dll - content_main.cc:442 content::ContentMain(HINSTANCE__ *,sandbox::SandboxInterfaceInfo *,content::ContentMainDelegate *) 0x60dd4c63 [chrome.dll - chrome_main.cc:28 ChromeMain 0x010b1e16 [chrome.exe - client_util.cc:346 MainDllLoader::Launch(HINSTANCE__ *,sandbox::SandboxInterfaceInfo *) 0x010b10c8 [chrome.exe - chrome_exe_main_win.cc:36 wWinMain 0x0110a017 [chrome.exe - crt0.c:263 __tmainCRTStartup 0x76231113 [kernel32.dll + 0x00051113] BaseThreadInitThunk 0x77a6b428 [ntdll.dll + 0x0005b428] __RtlUserThreadStart 0x77a6b3fb [ntdll.dll + 0x0005b3fb] _RtlUserThreadStart See http://code.google.com/p/chromium/issues/detail?id=101411. 490263 1 webkit-bug-importer 2011-10-25 12:53:04 -0700 <rdar://problem/10342925> 490311 2 112393 andersca 2011-10-25 13:39:05 -0700 Created attachment 112393 Patch 490319 3 andersca 2011-10-25 13:45:14 -0700 Committed r98389: <http://trac.webkit.org/changeset/98389> 112393 2011-10-25 13:39:05 -0700 2011-10-25 13:39:30 -0700 Patch bug-70827-20111025133909.patch text/plain 1948 andersca U3VidmVyc2lvbiBSZXZpc2lvbjogOTgzNDkKZGlmZiAtLWdpdCBhL1NvdXJjZS9XZWJDb3JlL0No YW5nZUxvZyBiL1NvdXJjZS9XZWJDb3JlL0NoYW5nZUxvZwppbmRleCA0MjFjNzZhNTY2ZmY3MjQz ZjE5MzEyOGYyOTU5Njc1OGZjMDkyYTE1Li5jYzczMTA5YTdiNWFkMjVhMmYyZjljMjc0Mzk4ODNm MjdhMzA3ODZkIDEwMDY0NAotLS0gYS9Tb3VyY2UvV2ViQ29yZS9DaGFuZ2VMb2cKKysrIGIvU291 cmNlL1dlYkNvcmUvQ2hhbmdlTG9nCkBAIC0xLDMgKzEsMTggQEAKKzIwMTEtMTAtMjUgIEFuZGVy cyBDYXJsc3NvbiAgPGFuZGVyc2NhQGFwcGxlLmNvbT4KKworICAgICAgICBSRUdSRVNTSU9OKDk3 ODIxKTogSGlzdG9yeUNvbnRyb2xsZXI6Oml0ZW1zQXJlQ2xvbmVzIGNyYXNoZXMgYSBsb3QKKyAg ICAgICAgaHR0cHM6Ly9idWdzLndlYmtpdC5vcmcvc2hvd19idWcuY2dpP2lkPTcwODI3CisgICAg ICAgIDxyZGFyOi8vcHJvYmxlbS8xMDM0MjkyNT4KKworICAgICAgICBSZXZpZXdlZCBieSBOT0JP RFkgKE9PUFMhKS4KKworICAgICAgICBDaGVjayB0aGF0IG1fY3VycmVudEl0ZW0gaXMgbm9uLW51 bGwgYmVmb3JlIHBhc3NpbmcgaXQgdG8gaXRlbXNBcmVDbG9uZXMuIFdoaWxlIEkgd2Fzbid0Cisg ICAgICAgIGFibGUgdG8gbWFrZSBhIHRlc3QgY2FzZSB0aGF0IHdvdWxkIHJlcHJvZHVjZSB0aGlz IGNyYXNoLCB3ZSBkbyBjaGVjayBtX2N1cnJlbnRJdGVtIGZvciBudWxsCisgICAgICAgIGV2ZXJ5 d2hlcmUgZWxzZSwgYW5kIHRoZSBjcmFzaCBsb2cgaW5kaWNhdGVzIHRoYXQgdGhpcyB3b3VsZCBm aXggdGhlIGNyYXNoLgorCisgICAgICAgICogbG9hZGVyL0hpc3RvcnlDb250cm9sbGVyLmNwcDoK KyAgICAgICAgKFdlYkNvcmU6Okhpc3RvcnlDb250cm9sbGVyOjpyZWN1cnNpdmVVcGRhdGVGb3JD b21taXQpOgorCiAyMDExLTEwLTI1ICBZdXJ5IFNlbWlraGF0c2t5ICA8eXVyeXNAY2hyb21pdW0u b3JnPgogCiAgICAgICAgIFdlYiBJbnNwZWN0b3I6IHJlZGVzaWduIHdvcmtlcnMgc2lkZWJhciBw YW5lCmRpZmYgLS1naXQgYS9Tb3VyY2UvV2ViQ29yZS9sb2FkZXIvSGlzdG9yeUNvbnRyb2xsZXIu Y3BwIGIvU291cmNlL1dlYkNvcmUvbG9hZGVyL0hpc3RvcnlDb250cm9sbGVyLmNwcAppbmRleCBj NmM3YjAyN2Q0ZjZlMDlmNmM5YzFiM2VkZDM5OWRmMjNlZTVmNGU5Li41M2Q2NGQ4YWM3N2Y2Zjk5 OTE2ZjI3NWZjODYyMzhjOTIxOTY5ZDY2IDEwMDY0NAotLS0gYS9Tb3VyY2UvV2ViQ29yZS9sb2Fk ZXIvSGlzdG9yeUNvbnRyb2xsZXIuY3BwCisrKyBiL1NvdXJjZS9XZWJDb3JlL2xvYWRlci9IaXN0 b3J5Q29udHJvbGxlci5jcHAKQEAgLTQ3Miw3ICs0NzIsNyBAQCB2b2lkIEhpc3RvcnlDb250cm9s bGVyOjpyZWN1cnNpdmVVcGRhdGVGb3JDb21taXQoKQogICAgIC8vIEZvciBlYWNoIGZyYW1lIHRo YXQgYWxyZWFkeSBoYWQgdGhlIGNvbnRlbnQgdGhlIGl0ZW0gcmVxdWVzdGVkIChiYXNlZCBvbgog ICAgIC8vIChhIG1hdGNoaW5nIFVSTCBhbmQgZnJhbWUgdHJlZSBzbmFwc2hvdCksIGp1c3QgcmVz dG9yZSB0aGUgc2Nyb2xsIHBvc2l0aW9uLgogICAgIC8vIFNhdmUgZm9ybSBzdGF0ZSAod29ya3Mg ZnJvbSBjdXJyZW50SXRlbSwgc2luY2UgbV9mcmFtZUxvYWRDb21wbGV0ZSBpcyB0cnVlKQotICAg IGlmIChpdGVtc0FyZUNsb25lcyhtX2N1cnJlbnRJdGVtLmdldCgpLCBtX3Byb3Zpc2lvbmFsSXRl bS5nZXQoKSkpIHsKKyAgICBpZiAobV9jdXJyZW50SXRlbSAmJiBpdGVtc0FyZUNsb25lcyhtX2N1 cnJlbnRJdGVtLmdldCgpLCBtX3Byb3Zpc2lvbmFsSXRlbS5nZXQoKSkpIHsKICAgICAgICAgQVNT RVJUKG1fZnJhbWVMb2FkQ29tcGxldGUpOwogICAgICAgICBzYXZlRG9jdW1lbnRTdGF0ZSgpOwog ICAgICAgICBzYXZlU2Nyb2xsUG9zaXRpb25BbmRWaWV3U3RhdGVUb0l0ZW0obV9jdXJyZW50SXRl bS5nZXQoKSk7Cg==