Summary: | REGRESSION (r138858?!): Crash in WebCore::FrameLoader::~FrameLoader() when opening page in a background tab | ||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
Product: | WebKit | Reporter: | Dieter Komendera <dieter> | ||||||||||||
Component: | WebCore Misc. | Assignee: | Nobody <webkit-unassigned> | ||||||||||||
Status: | RESOLVED FIXED | ||||||||||||||
Severity: | Normal | CC: | beidson, simon.fraser, thorton, webkit-bug-importer | ||||||||||||
Priority: | P2 | Keywords: | InRadar | ||||||||||||
Version: | 528+ (Nightly build) | ||||||||||||||
Hardware: | Unspecified | ||||||||||||||
OS: | OS X 10.8 | ||||||||||||||
URL: | http://www.featherrazorblades.com/ | ||||||||||||||
Attachments: |
|
Description
Dieter Komendera
2013-02-15 06:34:39 PST
I find it hard to believe, but bisecting blames <http://trac.webkit.org/changeset/138858> with no uncertainty. In a debug build the UI process first asserts: ASSERTION FAILED: m_loadState == LoadStateFinished WebProcess hits: ASSERTION FAILED: !m_inProgress || m_frame->page() /Volumes/SSData/Development/OSX/webkit/OpenSource/Source/WebCore/loader/FrameLoader.cpp(178) : WebCore::FrameLoader::FrameProgressTracker::~FrameProgressTracker() 1 0x103d32cea WebCore::FrameLoader::FrameProgressTracker::~FrameProgressTracker() 2 0x103d32c85 WebCore::FrameLoader::FrameProgressTracker::~FrameProgressTracker() 3 0x103d32c4a void WTF::deleteOwnedPtr<WebCore::FrameLoader::FrameProgressTracker>(WebCore::FrameLoader::FrameProgressTracker*) 4 0x103d36588 WTF::OwnPtr<WebCore::FrameLoader::FrameProgressTracker>::~OwnPtr() 5 0x103d2de55 WTF::OwnPtr<WebCore::FrameLoader::FrameProgressTracker>::~OwnPtr() 6 0x103d1e1d5 WebCore::FrameLoader::~FrameLoader() 7 0x103d1e015 WebCore::FrameLoader::~FrameLoader() 8 0x103d11979 WebCore::Frame::~Frame() 9 0x103d11795 WebCore::Frame::~Frame() 10 0x1035d8859 WTF::RefCounted<WebCore::Frame>::deref() 11 0x1035d8805 void WTF::derefIfNotNull<WebCore::Frame>(WebCore::Frame*) 12 0x103bb0aec WTF::RefPtr<WebCore::Frame>::operator=(WebCore::Frame*) 13 0x103d497f6 WebCore::FrameView::clearFrame() 14 0x1036e1be0 WebCore::CachedFrame::destroy() 15 0x1036e1acb WebCore::CachedFrame::destroy() 16 0x1036edb6b WebCore::CachedPage::destroy() 17 0x1048e218f WebCore::PageCache::releaseAutoreleasedPagesNow() 18 0x1048e08d7 WebCore::PageCache::releaseAutoreleasedPagesNowDueToTimer(WebCore::Timer<WebCore::PageCache>*) 19 0x1048e5e13 WebCore::Timer<WebCore::PageCache>::fired() 20 0x105071ceb WebCore::ThreadTimers::sharedTimerFiredInternal() 21 0x105071a79 WebCore::ThreadTimers::sharedTimerFired() 22 0x104d95a73 WebCore::timerFired(__CFRunLoopTimer*, void*) How does "opening a page in a background tab" cause a page cache cleanup to get triggered? http://www.featherrazorblades.com/ is using JS to load http://featherrazorblades.storenvy.com in _top I think Created attachment 196684 [details]
patch
Created attachment 196688 [details]
more descriptive
Created attachment 196955 [details]
fix a test
Created attachment 196956 [details]
fix a test less
|