9952 2006-07-16 06:22:57 -0700 REGRESSION: Repro crash when dragging an image from the window to the address bar 2007-01-18 17:21:00 -0800 1 1 1 Unclassified WebKit Page Loading 420+ Mac OS X 10.4 RESOLVED FIXED http://animatedtv.about.com/library/gallerysimpsons/blphoto_other_hibbert.htm?terms=dr.+hibbert HasReduction, InRadar, Regression P1 Normal --- 1 mitz webkit-unassigned alice.barraclough andersca ddkilzer oldest_to_newest 50030 0 mitz 2006-07-16 06:22:57 -0700 To reproduce: 1. Go to the URL. Wait for it to finish loading. 2. Drag the image of Dr. Hibbert from the page into the address bar (notice that sometimes the cursor does not change to the "copy" cursor when over the address bar). 3. Click in the window. Actual results: Safari crashes or asserts in step 2, or doesn't display the image, then crashes in step 3. Backtrace: #0  0x01cb0b0c in WebCore::RenderObject::document (this=0x0) at WebCore/rendering/RenderObject.h:333 #1  0x01a496dc in WebCore::RenderObject::view (this=0x0) at WebCore/rendering/RenderObject.cpp:2275 #2  0x01972790 in -[WebCoreFrameBridge drawRect:] (self=0x19971260, _cmd=0x90a8f4a0, rect={origin = {x = 0, y = 0}, size = {width = 985, height = 840}}) at WebCore/bridge/mac/WebCoreFrameBridge.mm:905 #3  0x003714dc in -[WebHTMLView drawSingleRect:] (self=0x19c35f10, _cmd=0x406538, rect={origin = {x = 0, y = 0}, size = {width = 985, height = 840}}) at WebKit/WebView/WebHTMLView.m:2572 #4  0x0037190c in -[WebHTMLView drawRect:] (self=0x19c35f10, _cmd=0x90a8f4a0, rect={origin = {x = 0, y = 0}, size = {width = 985, height = 840}}) at WebKit/WebView/WebHTMLView.m:2623 #5  0x93734858 in -[NSView _drawRect:clip:] () #6  0x93733e18 in -[NSView _recursiveDisplayAllDirtyWithLockFocus:visRect:] () #7  0x00366508 in -[WebHTMLView(WebPrivate) _recursiveDisplayAllDirtyWithLockFocus:visRect:] (self=0x19c35f10, _cmd=0x90a6fea8, needsLockFocus=1 '\001', visRect={origin = {x = 0, y = 0}, size = {width = 985, height = 840}}) at WebKit/WebView/WebHTMLView.m:877 #8  0x93736b60 in _recursiveDisplayInRect2 () #9  0x907eb3c4 in CFArrayApplyFunction () #10 0x93733f2c in -[NSView _recursiveDisplayAllDirtyWithLockFocus:visRect:] () #11 0x93736b60 in _recursiveDisplayInRect2 () #12 0x907eb3c4 in CFArrayApplyFunction () #13 0x93733f2c in -[NSView _recursiveDisplayAllDirtyWithLockFocus:visRect:] () #14 0x937333e0 in -[NSView _recursiveDisplayRectIfNeededIgnoringOpacity:isVisibleRect:rectIsVisibleRectForView:topView:] () #15 0x937339a8 in -[NSView _recursiveDisplayRectIfNeededIgnoringOpacity:isVisibleRect:rectIsVisibleRectForView:topView:] () #16 0x937339a8 in -[NSView _recursiveDisplayRectIfNeededIgnoringOpacity:isVisibleRect:rectIsVisibleRectForView:topView:] () #17 0x937339a8 in -[NSView _recursiveDisplayRectIfNeededIgnoringOpacity:isVisibleRect:rectIsVisibleRectForView:topView:] () #18 0x937339a8 in -[NSView _recursiveDisplayRectIfNeededIgnoringOpacity:isVisibleRect:rectIsVisibleRectForView:topView:] () #19 0x937339a8 in -[NSView _recursiveDisplayRectIfNeededIgnoringOpacity:isVisibleRect:rectIsVisibleRectForView:topView:] () #20 0x93754044 in -[NSThemeFrame _recursiveDisplayRectIfNeededIgnoringOpacity:isVisibleRect:rectIsVisibleRectForView:topView:] () #21 0x9372d054 in -[NSView _displayRectIgnoringOpacity:isVisibleRect:rectIsVisibleRectForView:] () #22 0x93722348 in -[NSView displayIfNeeded] () #23 0x937221b8 in -[NSWindow displayIfNeeded] () #24 0x0001a5f8 in ?? () #25 0x93722064 in _handleWindowNeedsDisplay () #26 0x907db73c in __CFRunLoopDoObservers () #27 0x907db9dc in __CFRunLoopRun () #28 0x907db47c in CFRunLoopRunSpecific () #29 0x931eb740 in RunCurrentEventLoopInMode () #30 0x931ead4c in ReceiveNextEventCommon () #31 0x931eac40 in BlockUntilNextEventMatchingListInMode () #32 0x936eeae4 in _DPSNextEvent () #33 0x936ee7a8 in -[NSApplication nextEventMatchingMask:untilDate:inMode:dequeue:] () #34 0x00006740 in ?? () #35 0x936eacec in -[NSApplication run] () #36 0x937db87c in NSApplicationMain () #37 0x0005c77c in ?? () #38 0x0005c624 in ?? () 50047 1 ddkilzer 2006-07-16 07:31:50 -0700 Is this a regression from Bug 9466? 50053 2 mitz 2006-07-16 07:47:18 -0700 (In reply to comment #1) > Is this a regression from Bug 9466? > Just prior to fixing bug 9466 it was obviously impossible to reproduce this bug, but I think fixing bug 9466 just lifted the mask from this one, which was caused earlier (perhaps by the same change that cause bug 9466?). 50237 3 9539 darin 2006-07-17 21:43:36 -0700 Created attachment 9539 reduction 50238 4 9540 darin 2006-07-17 21:44:07 -0700 Created attachment 9540 file needed to use reduction (put this next to it on the local disk) 50239 5 darin 2006-07-17 21:44:52 -0700 Very simple reduction -- I predict this will be easy to fix. 50351 6 mitz 2006-07-19 08:05:30 -0700 Here's what I've found out so far. The problem happens because the image document is detached. The detach happens in the ~FrameView destructor (which contains this comment: "FIXME: Is this really the right place to call detach on the document?"). The FrameView in question has the same Frame as the FrameView that is coming in (Frame::setView() does not update the back pointer from the FrameView to the Frame), and hence the same document. The Iframe in the reduction serves the sole purpose of not allowing the page to go into the page cache, thus leading to the FrameView being deref'ed (and destructed) at that particular point. I think the fix should be along the lines of addressing the FIXME, but it's also possible that there's some way to manage the pointers from FrameViews to Frame to avoid the detach. 52564 7 alice.barraclough 2006-08-14 15:31:51 -0700 <rdar://problem/4680476> 55210 8 mitz 2006-09-10 14:28:39 -0700 I just found out that essentially the same crash can be reproduced in shipping Safari by clicking a link to about:blank with the back/forward cache disabled. To reproduce, go to data:text/html,<a%20href="about:blank">Turn%20off%20the%20Back/Forward%20cache%20and%20click%20me</a> then in Safari's Debug menu deselect Use Back/Forward Cache and click the link. The image case is a regression because of the new image document implementation. 55211 9 mitz 2006-09-10 14:30:26 -0700 manual-tests/form-value-restore.html fails because of this bug. 34331 10 12536 mitz 2007-01-18 08:26:02 -0800 Created attachment 12536 Patch, including change log This patch makes sure that the view does not mess with the frame when it is not its active view. No layout test regressions. 34334 11 12536 darin 2007-01-18 08:40:15 -0800 Comment on attachment 12536 Patch, including change log r=me! 34274 12 mrowe 2007-01-18 17:21:00 -0800 Landed in r18965. 9539 2006-07-17 21:43:36 -0700 2006-07-17 21:43:36 -0700 reduction 9952-reduction.html text/html 108 darin RHJhZyB0aGlzIGdyZWVuIGJveCB0byB0aGUgYWRkcmVzcyBiYXIsIHRoZW4gY2xpY2sgb24gdGhl IGJveDogPGltZyBzcmM9ImdyZWVuYm94LnBuZyI+PGJyPjxpZnJhbWU+PC9pZnJhbWU+ 9540 2006-07-17 21:44:07 -0700 2006-07-17 21:44:07 -0700 file needed to use reduction (put this next to it on the local disk) greenbox.png text/html 95 darin iVBORw0KGgoAAAANSUhEUgAAABkAAAAZCAIAAABLixI0AAAAJklEQVR4nGJg+M9ANTRq1qhZo2aN mjVq1qhZo2ZhIAAAAAD//wMA1XBuro0zsokAAAAASUVORK5CYII= 12536 2007-01-18 08:26:02 -0800 2007-01-18 08:40:15 -0800 Patch, including change log 9952_r1.patch text/plain 3680 mitz SW5kZXg6IFdlYkNvcmUvQ2hhbmdlTG9nCj09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT0KLS0tIFdlYkNvcmUvQ2hhbmdlTG9n CShyZXZpc2lvbiAxODkzNCkKKysrIFdlYkNvcmUvQ2hhbmdlTG9nCSh3b3JraW5nIGNvcHkpCkBA IC0xLDMgKzEsMjQgQEAKKzIwMDctMDEtMTggIE1pdHogUGV0dGVsICA8bWl0ekB3ZWJraXQub3Jn PgorCisgICAgICAgIFJldmlld2VkIGJ5IE5PQk9EWSAoT09QUyEpLgorCisgICAgICAgIC0gZml4 IGh0dHA6Ly9idWdzLndlYmtpdC5vcmcvc2hvd19idWcuY2dpP2lkPTk5NTIKKyAgICAgICAgICBS RUdSRVNTSU9OOiBSZXBybyBjcmFzaCB3aGVuIGRyYWdnaW5nIGFuIGltYWdlIGZyb20gdGhlIHdp bmRvdyB0byB0aGUgYWRkcmVzcyBiYXIKKworICAgICAgICAqIHBhZ2UvRnJhbWVWaWV3LmNwcDoK KyAgICAgICAgKFdlYkNvcmU6OkZyYW1lVmlldzo6fkZyYW1lVmlldyk6IFJlbW92ZWQgdGhlIGNh bGwgdG8gRG9jdW1lbnQ6OmRldGFjaCgpLiBJZiB0aGlzCisgICAgICAgIHZpZXcgaXMgdGhlIGN1 cnJlbnQgdmlldywgdGhlbiB0aGUgRnJhbWUgc2hvdWxkIGhhdmUgYWxyZWFkeSBkZXRhY2hlZCB0 aGUgZG9jdW1lbnQuCisgICAgICAgIEFkZGVkIGFuIGFzc2VydGlvbiB0aGF0IHRoaXMgaXMgdGhl IGNhc2UuIElmIHRoaXMgdmlldyBpcyBub3QgdGhlIGN1cnJlbnQgdmlldywKKyAgICAgICAgdGhl biBpdCBjYW5ub3QgYWNjZXNzIGl0cyBkb2N1bWVudCwgYnV0IHRoZSBwYWdlIGNhY2hlIHNob3Vs ZCBoYXZlIGRldGFjaGVkIGl0IGFscmVhZHkuCisgICAgICAgIFNpbWlsYXJseSwgY2hhbmdlZCB0 byBjYWxsIFJlbmRlclBhcnQ6OnNldFdpZGdldCgpIG9ubHkgaWYgdGhpcyBpcyB0aGUgY3VycmVu dCB2aWV3CisgICAgICAgIGluIHRoZSBmcmFtZS4KKyAgICAgICAgKFdlYkNvcmU6OkZyYW1lVmll dzo6YWRqdXN0Vmlld1NpemUpOiBBZGRlZCBhbiBhc3NlcnRpb24gdGhhdCB0aGlzIHZpZXcgaXMg dGhlIGN1cnJlbnQKKyAgICAgICAgdmlldyBpbiB0aGUgZnJhbWUuCisgICAgICAgIChXZWJDb3Jl OjpGcmFtZVZpZXc6OmxheW91dCk6IERpdHRvLgorICAgICAgICAoV2ViQ29yZTo6RnJhbWVWaWV3 OjpzY2hlZHVsZVJlbGF5b3V0KTogRGl0dG8uCisgICAgICAgIChXZWJDb3JlOjpGcmFtZVZpZXc6 OnNjaGVkdWxlUmVsYXlvdXRPZlN1YnRyZWUpOiBEaXR0by4KKyAgICAgICAgKFdlYkNvcmU6OkZy YW1lVmlldzo6d2luZG93Q2xpcFJlY3QpOiBEaXR0by4KKwogMjAwNy0wMS0xOCAgU2ltb24gSGF1 c21hbm4gIDxoYXVzbWFubkBrZGUub3JnPgogCiAgICAgICAgIFJldmlld2VkIGJ5IFphY2suCklu ZGV4OiBXZWJDb3JlL3BhZ2UvRnJhbWVWaWV3LmNwcAo9PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09Ci0tLSBXZWJDb3JlL3Bh Z2UvRnJhbWVWaWV3LmNwcAkocmV2aXNpb24gMTg5MzIpCisrKyBXZWJDb3JlL3BhZ2UvRnJhbWVW aWV3LmNwcAkod29ya2luZyBjb3B5KQpAQCAtMTMyLDEwICsxMzIsOSBAQCBGcmFtZVZpZXc6On5G cmFtZVZpZXcoKQogICAgIEFTU0VSVChtX3JlZkNvdW50ID09IDApOwogCiAgICAgaWYgKG1fZnJh bWUpIHsKLSAgICAgICAgLy8gRklYTUU6IElzIHRoaXMgcmVhbGx5IHRoZSByaWdodCBwbGFjZSB0 byBjYWxsIGRldGFjaCBvbiB0aGUgZG9jdW1lbnQ/Ci0gICAgICAgIGlmIChEb2N1bWVudCogZG9j ID0gbV9mcmFtZS0+ZG9jdW1lbnQoKSkKLSAgICAgICAgICAgIGRvYy0+ZGV0YWNoKCk7Ci0gICAg ICAgIGlmIChSZW5kZXJQYXJ0KiByZW5kZXJlciA9IG1fZnJhbWUtPm93bmVyUmVuZGVyZXIoKSkK KyAgICAgICAgQVNTRVJUKG1fZnJhbWUtPnZpZXcoKSAhPSB0aGlzIHx8ICFtX2ZyYW1lLT5kb2N1 bWVudCgpIHx8ICFtX2ZyYW1lLT5kb2N1bWVudCgpLT5yZW5kZXJlcigpKTsKKyAgICAgICAgUmVu ZGVyUGFydCogcmVuZGVyZXIgPSBtX2ZyYW1lLT5vd25lclJlbmRlcmVyKCk7CisgICAgICAgIGlm IChyZW5kZXJlciAmJiByZW5kZXJlci0+d2lkZ2V0KCkgPT0gdGhpcykKICAgICAgICAgICAgIHJl bmRlcmVyLT5zZXRXaWRnZXQoMCk7CiAgICAgfQogCkBAIC0yMTUsOSArMjE0LDggQEAgdm9pZCBG cmFtZVZpZXc6OnNldE1hcmdpbkhlaWdodChpbnQgaCkKIAogdm9pZCBGcmFtZVZpZXc6OmFkanVz dFZpZXdTaXplKCkKIHsKLSAgICBpZiAobV9mcmFtZS0+ZG9jdW1lbnQoKSkgewotICAgICAgICBE b2N1bWVudCogZG9jdW1lbnQgPSBtX2ZyYW1lLT5kb2N1bWVudCgpOwotCisgICAgQVNTRVJUKG1f ZnJhbWUtPnZpZXcoKSA9PSB0aGlzKTsKKyAgICBpZiAoRG9jdW1lbnQqIGRvY3VtZW50ID0gbV9m cmFtZS0+ZG9jdW1lbnQoKSkgewogICAgICAgICBSZW5kZXJWaWV3KiByb290ID0gc3RhdGljX2Nh c3Q8UmVuZGVyVmlldyo+KGRvY3VtZW50LT5yZW5kZXJlcigpKTsKICAgICAgICAgaWYgKCFyb290 KQogICAgICAgICAgICAgcmV0dXJuOwpAQCAtMzEwLDYgKzMwOCw5IEBAIHZvaWQgRnJhbWVWaWV3 OjpsYXlvdXQoYm9vbCBhbGxvd1N1YnRyZWUKICAgICB9CiAKICAgICBib29sIHN1YnRyZWUgPSBk LT5sYXlvdXRSb290OworCisgICAgQVNTRVJUKG1fZnJhbWUtPnZpZXcoKSA9PSB0aGlzKTsKKwog ICAgIERvY3VtZW50KiBkb2N1bWVudCA9IG1fZnJhbWUtPmRvY3VtZW50KCk7CiAgICAgaWYgKCFk b2N1bWVudCkgewogICAgICAgICAvLyBGSVhNRTogU2hvdWxkIHdlIHNldCBtX3NpemUuaGVpZ2h0 IGhlcmUgdG9vPwpAQCAtNjM0LDYgKzYzNSw4IEBAIHZvaWQgRnJhbWVWaWV3OjpsYXlvdXRUaW1l ckZpcmVkKFRpbWVyPEYKIAogdm9pZCBGcmFtZVZpZXc6OnNjaGVkdWxlUmVsYXlvdXQoKQogewor ICAgIEFTU0VSVChtX2ZyYW1lLT52aWV3KCkgPT0gdGhpcyk7CisKICAgICBpZiAoZC0+bGF5b3V0 Um9vdCkgewogICAgICAgICBpZiAoZC0+bGF5b3V0Um9vdC0+cmVuZGVyZXIoKSkKICAgICAgICAg ICAgIGQtPmxheW91dFJvb3QtPnJlbmRlcmVyKCktPm1hcmtDb250YWluaW5nQmxvY2tzRm9yTGF5 b3V0KGZhbHNlKTsKQEAgLTY2Myw2ICs2NjYsOCBAQCB2b2lkIEZyYW1lVmlldzo6c2NoZWR1bGVS ZWxheW91dCgpCiAKIHZvaWQgRnJhbWVWaWV3OjpzY2hlZHVsZVJlbGF5b3V0T2ZTdWJ0cmVlKE5v ZGUqIG4pCiB7CisgICAgQVNTRVJUKG1fZnJhbWUtPnZpZXcoKSA9PSB0aGlzKTsKKwogICAgIGlm ICghZC0+bGF5b3V0U2NoZWR1bGluZ0VuYWJsZWQgfHwgKG1fZnJhbWUtPmRvY3VtZW50KCkKICAg ICAgICAgICAgICYmIG1fZnJhbWUtPmRvY3VtZW50KCktPnJlbmRlcmVyKCkKICAgICAgICAgICAg ICYmIG1fZnJhbWUtPmRvY3VtZW50KCktPnJlbmRlcmVyKCktPm5lZWRzTGF5b3V0KCkpKSB7CkBA IC04MTAsNiArODE1LDggQEAgSW50UmVjdCBGcmFtZVZpZXc6OndpbmRvd0NsaXBSZWN0KCkgY29u cwogCiBJbnRSZWN0IEZyYW1lVmlldzo6d2luZG93Q2xpcFJlY3QoYm9vbCBjbGlwVG9Db250ZW50 cykgY29uc3QKIHsKKyAgICBBU1NFUlQobV9mcmFtZS0+dmlldygpID09IHRoaXMpOworCiAgICAg Ly8gU2V0IG91ciBjbGlwIHJlY3QgdG8gYmUgb3VyIGNvbnRlbnRzLgogICAgIEludFJlY3QgY2xp cFJlY3Q7CiAgICAgaWYgKGNsaXBUb0NvbnRlbnRzKQo=