Bug 109935 – REGRESSION (r138858?!): Crash in WebCore::FrameLoader::~FrameLoader() when opening page in a background tab

• Component: WebCore Misc.
• Status: RESOLVED FIXED

[Dieter Komendera]

Created attachment 188551 [details]
full crash report

Tested with Safari 6.0.2 with WebKit nightly r142980 on Mac OS X 10.8.2

To reproduce:
* open http://www.featherrazorblades.com/ in a background tab (cmd+click)

Thread 0 Crashed:: Dispatch queue: com.apple.main-thread
0   com.apple.WebCore             	0x00000001020a21b1 WebCore::FrameLoader::~FrameLoader() + 673
1   com.apple.WebCore             	0x000000010209e8a1 WebCore::Frame::~Frame() + 465
2   com.apple.WebCore             	0x00000001020be8f7 WebCore::FrameView::clearFrame() + 55
3   com.apple.WebCore             	0x0000000101da4972 WebCore::CachedFrame::destroy() + 210
4   com.apple.WebCore             	0x0000000101da4920 WebCore::CachedFrame::destroy() + 128
5   com.apple.WebCore             	0x0000000101da7372 WebCore::CachedPage::destroy() + 34
6   com.apple.WebCore             	0x0000000102681238 WebCore::PageCache::releaseAutoreleasedPagesNow() + 168
7   com.apple.WebCore             	0x0000000102a1e54f WebCore::ThreadTimers::sharedTimerFiredInternal() + 175
8   com.apple.WebCore             	0x00000001028ab2e3 WebCore::timerFired(__CFRunLoopTimer*, void*) + 51
9   com.apple.CoreFoundation      	0x00007fff92e96da4 __CFRUNLOOP_IS_CALLING_OUT_TO_A_TIMER_CALLBACK_FUNCTION__ + 20

[Alexey Proskuryakov]

I find it hard to believe, but bisecting blames <http://trac.webkit.org/changeset/138858> with no uncertainty.

[Alexey Proskuryakov]

<rdar://problem/13225963>

[Simon Fraser (smfr)]

In a debug build the UI process first asserts: ASSERTION FAILED: m_loadState == LoadStateFinished

[Simon Fraser (smfr)]

WebProcess hits:

ASSERTION FAILED: !m_inProgress || m_frame->page()
/Volumes/SSData/Development/OSX/webkit/OpenSource/Source/WebCore/loader/FrameLoader.cpp(178) : WebCore::FrameLoader::FrameProgressTracker::~FrameProgressTracker()
1   0x103d32cea WebCore::FrameLoader::FrameProgressTracker::~FrameProgressTracker()
2   0x103d32c85 WebCore::FrameLoader::FrameProgressTracker::~FrameProgressTracker()
3   0x103d32c4a void WTF::deleteOwnedPtr<WebCore::FrameLoader::FrameProgressTracker>(WebCore::FrameLoader::FrameProgressTracker*)
4   0x103d36588 WTF::OwnPtr<WebCore::FrameLoader::FrameProgressTracker>::~OwnPtr()
5   0x103d2de55 WTF::OwnPtr<WebCore::FrameLoader::FrameProgressTracker>::~OwnPtr()
6   0x103d1e1d5 WebCore::FrameLoader::~FrameLoader()
7   0x103d1e015 WebCore::FrameLoader::~FrameLoader()
8   0x103d11979 WebCore::Frame::~Frame()
9   0x103d11795 WebCore::Frame::~Frame()
10  0x1035d8859 WTF::RefCounted<WebCore::Frame>::deref()
11  0x1035d8805 void WTF::derefIfNotNull<WebCore::Frame>(WebCore::Frame*)
12  0x103bb0aec WTF::RefPtr<WebCore::Frame>::operator=(WebCore::Frame*)
13  0x103d497f6 WebCore::FrameView::clearFrame()
14  0x1036e1be0 WebCore::CachedFrame::destroy()
15  0x1036e1acb WebCore::CachedFrame::destroy()
16  0x1036edb6b WebCore::CachedPage::destroy()
17  0x1048e218f WebCore::PageCache::releaseAutoreleasedPagesNow()
18  0x1048e08d7 WebCore::PageCache::releaseAutoreleasedPagesNowDueToTimer(WebCore::Timer<WebCore::PageCache>*)
19  0x1048e5e13 WebCore::Timer<WebCore::PageCache>::fired()
20  0x105071ceb WebCore::ThreadTimers::sharedTimerFiredInternal()
21  0x105071a79 WebCore::ThreadTimers::sharedTimerFired()
22  0x104d95a73 WebCore::timerFired(__CFRunLoopTimer*, void*)

[Brady Eidson]

How does "opening a page in a background tab" cause a page cache cleanup to get triggered?

[Simon Fraser (smfr)]

http://www.featherrazorblades.com/ is using JS to load http://featherrazorblades.storenvy.com in _top I think

[Tim Horton]

Created attachment 196684 [details]
patch

[Tim Horton]

Created attachment 196688 [details]
more descriptive

[Tim Horton]

Created attachment 196955 [details]
fix a test

[Tim Horton]

Created attachment 196956 [details]
fix a test less

[Tim Horton]

http://trac.webkit.org/changeset/147955