Bug 121053

Summary:	fast/history/go-back-to-iframe-with-plugin.html asserts in FrameView::layout() !document->inPageCache()
Product:	WebKit	Reporter:	Beth Dakin <bdakin>
Component:	Layout and Rendering	Assignee:	Nobody <webkit-unassigned>
Status:	RESOLVED WORKSFORME
Severity:	Normal	CC:	ap, bdakin, beidson, changseok
Priority:	P2
Version:	528+ (Nightly build)
Hardware:	Unspecified
OS:	Unspecified

Description Beth Dakin 2013-09-09 15:10:05 PDT

fast/history/go-back-to-iframe-with-plugin.html is a newly-added test http://trac.webkit.org/changeset/155361 that has been crashing since it was added. I'm going to skip it for now. Here is the stack trace. I confirmed that the change that introduces the test did not also introduce the crash. 

Process:         DumpRenderTree [19810]
Path:            /Volumes/VOLUME/*/DumpRenderTree
Identifier:      DumpRenderTree
Version:         0
Code Type:       X86-64 (Native)
Parent Process:  Python [18442]
User ID:         501

Date/Time:       2013-09-09 13:23:54.250 -0700
OS Version:      Mac OS X 10.8.4 (12E55)
Report Version:  10

Crashed Thread:  0  Dispatch queue: com.apple.main-thread

Exception Type:  EXC_BAD_ACCESS (SIGSEGV)
Exception Codes: KERN_INVALID_ADDRESS at 0x00000000bbadbeef

VM Regions Near 0xbbadbeef:
--> 
    __TEXT                 0000000104833000-00000001048d7000 [  656K] r-x/rwx SM=COW  /Volumes/VOLUME/*

Application Specific Information:
CRASHING TEST: fast/history/go-back-to-iframe-with-plugin.html

Thread 0 Crashed:: Dispatch queue: com.apple.main-thread
0   com.apple.JavaScriptCore      	0x0000000104f26aca WTFCrash + 42 (Assertions.cpp:342)
1   com.apple.WebCore             	0x0000000106d590c7 WebCore::FrameView::layout(bool) + 583 (FrameView.cpp:1134)
2   com.apple.WebCore             	0x0000000106d635e5 WebCore::FrameView::forceLayout(bool) + 37 (FrameView.cpp:3779)
3   com.apple.WebKit              	0x0000000105fdfad4 -[WebHTMLView layoutToMinimumPageWidth:height:originalPageWidth:originalPageHeight:maximumShrinkRatio:adjustingViewSize:] + 468 (WebHTMLView.mm:3026)
4   com.apple.WebKit              	0x0000000105fdfb4c -[WebHTMLView layout] + 76 (WebHTMLView.mm:3040)
5   com.apple.WebKit              	0x0000000105f7e1e8 -[WebDynamicScrollBarsView(WebInternal) updateScrollers] + 264 (WebDynamicScrollBarsView.mm:296)
6   com.apple.WebKit              	0x0000000105f7ee74 -[WebDynamicScrollBarsView(WebInternal) reflectScrolledClipView:] + 228 (WebDynamicScrollBarsView.mm:435)
7   com.apple.AppKit              	0x00007fff921fa4bb -[NSClipView _selfBoundsChanged] + 689
8   com.apple.AppKit              	0x00007fff9226ca46 -[NSClipView setBoundsSize:] + 59
9   com.apple.AppKit              	0x00007fff9226c8e5 -[NSView setBounds:] + 153
10  com.apple.AppKit              	0x00007fff9226c7c1 -[NSScrollView viewDidChangeBackingProperties] + 173
11  com.apple.AppKit              	0x00007fff92796f79 -[NSView(NSInternal) _recursiveSendViewDidChangeBackingPropertiesFrom:toScaleFactor:colorSpace:invokingForSurfacePropertiesChange:alreadyUpdatedSurfaceProperties:] + 1206
12  com.apple.AppKit              	0x00007fff92797030 -[NSView(NSInternal) _recursiveSendViewDidChangeBackingPropertiesFrom:toScaleFactor:colorSpace:invokingForSurfacePropertiesChange:alreadyUpdatedSurfaceProperties:] + 1389
13  com.apple.AppKit              	0x00007fff92797030 -[NSView(NSInternal) _recursiveSendViewDidChangeBackingPropertiesFrom:toScaleFactor:colorSpace:invokingForSurfacePropertiesChange:alreadyUpdatedSurfaceProperties:] + 1389
14  com.apple.AppKit              	0x00007fff921a4fd1 -[NSView addSubview:] + 1777
15  com.apple.AppKit              	0x00007fff92269763 -[NSClipView setDocumentView:] + 390
16  com.apple.AppKit              	0x00007fff922694de -[NSScrollView setDocumentView:] + 38
17  com.apple.WebKit              	0x0000000105fab0a0 -[WebFrameView(WebInternal) _setDocumentView:] + 400 (WebFrameView.mm:158)
18  com.apple.WebKit              	0x0000000105f9e333 WebFrameLoaderClient::transitionToCommittedFromCachedFrame(WebCore::CachedFrame*) + 355 (WebFrameLoaderClient.mm:1238)
19  com.apple.WebCore             	0x0000000106d36efa WebCore::FrameLoader::transitionToCommitted(WebCore::CachedPage*) + 1098 (FrameLoader.cpp:1864)
20  com.apple.WebCore             	0x0000000106d363ee WebCore::FrameLoader::commitProvisionalLoad() + 1070 (FrameLoader.cpp:1728)
21  com.apple.WebCore             	0x0000000106d3a037 WebCore::FrameLoader::loadProvisionalItemFromCachedPage() + 295 (FrameLoader.cpp:3036)
22  com.apple.WebCore             	0x0000000106d34c8b WebCore::FrameLoader::continueLoadAfterNavigationPolicy(WebCore::ResourceRequest const&, WTF::PassRefPtr<WebCore::FormState>, bool) + 827 (FrameLoader.cpp:2878)
23  com.apple.WebCore             	0x0000000106d34d77 WebCore::FrameLoader::callContinueLoadAfterNavigationPolicy(void*, WebCore::ResourceRequest const&, WTF::PassRefPtr<WebCore::FormState>, bool) + 87 (FrameLoader.cpp:2714)
24  com.apple.WebCore             	0x0000000107835992 WebCore::PolicyChecker::checkNavigationPolicy(WebCore::ResourceRequest const&, WebCore::DocumentLoader*, WTF::PassRefPtr<WebCore::FormState>, void (*)(void*, WebCore::ResourceRequest const&, WTF::PassRefPtr<WebCore::FormState>, bool), void*) + 370 (PolicyChecker.cpp:72)
25  com.apple.WebCore             	0x0000000106d3475c WebCore::FrameLoader::loadWithDocumentLoader(WebCore::DocumentLoader*, WebCore::FrameLoadType, WTF::PassRefPtr<WebCore::FormState>) + 1436 (FrameLoader.cpp:1422)
26  com.apple.WebCore             	0x0000000106d30f54 WebCore::FrameLoader::loadDifferentDocumentItem(WebCore::HistoryItem*, WebCore::FrameLoadType, WebCore::FrameLoader::FormSubmissionCacheLoadPolicy) + 164 (FrameLoader.cpp:3130)
27  com.apple.WebCore             	0x0000000106d3af36 WebCore::FrameLoader::loadItem(WebCore::HistoryItem*, WebCore::FrameLoadType) + 166 (FrameLoader.cpp:3219)
28  com.apple.WebCore             	0x0000000106e4b5ef WebCore::HistoryController::recursiveGoToItem(WebCore::HistoryItem*, WebCore::HistoryItem*, WebCore::FrameLoadType) + 511 (HistoryController.cpp:747)
29  com.apple.WebCore             	0x0000000106e4b1c8 WebCore::HistoryController::goToItem(WebCore::HistoryItem*, WebCore::FrameLoadType) + 408 (HistoryController.cpp:290)
30  com.apple.WebCore             	0x00000001077c3429 WebCore::Page::goToItem(WebCore::HistoryItem*, WebCore::FrameLoadType) + 201 (Page.cpp:426)
31  com.apple.WebCore             	0x00000001077c3669 WebCore::Page::goBackOrForward(int) + 265 (Page.cpp:415)
32  com.apple.WebCore             	0x000000010673962e WebCore::BackForwardController::goBackOrForward(int) + 30 (BackForwardController.cpp:60)
33  com.apple.WebCore             	0x00000001077755a8 WebCore::ScheduledHistoryNavigation::fire(WebCore::Frame*) + 312 (NavigationScheduler.cpp:209)
34  com.apple.WebCore             	0x0000000107773386 WebCore::NavigationScheduler::timerFired(WebCore::Timer<WebCore::NavigationScheduler>*) + 198 (NavigationScheduler.cpp:428)
35  com.apple.WebCore             	0x0000000107775313 WebCore::Timer<WebCore::NavigationScheduler>::fired() + 115 (Timer.h:114)
36  com.apple.WebCore             	0x0000000107ed7cc3 WebCore::ThreadTimers::sharedTimerFiredInternal() + 307 (ThreadTimers.cpp:132)
37  com.apple.WebCore             	0x0000000107ed79d9 WebCore::ThreadTimers::sharedTimerFired() + 25 (ThreadTimers.cpp:106)
38  com.apple.WebCore             	0x0000000107c75de3 WebCore::timerFired(__CFRunLoopTimer*, void*) + 67 (SharedTimerMac.mm:134)
39  com.apple.CoreFoundation      	0x00007fff9542a804 __CFRUNLOOP_IS_CALLING_OUT_TO_A_TIMER_CALLBACK_FUNCTION__ + 20
40  com.apple.CoreFoundation      	0x00007fff9542a31d __CFRunLoopDoTimer + 557
41  com.apple.CoreFoundation      	0x00007fff9540fad9 __CFRunLoopRun + 1529
42  com.apple.CoreFoundation      	0x00007fff9540f0e2 CFRunLoopRunSpecific + 290
43  DumpRenderTree                	0x000000010484c870 runTest(std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> > const&) + 4912 (DumpRenderTree.mm:1406)
44  DumpRenderTree                	0x000000010484b4ca runTestingServerLoop() + 282 (DumpRenderTree.mm:857)
45  DumpRenderTree                	0x000000010484aeb5 dumpRenderTree(int, char const**) + 405 (DumpRenderTree.mm:912)
46  DumpRenderTree                	0x000000010484d069 main + 105 (DumpRenderTree.mm:950)
47  libdyld.dylib                 	0x00007fff8f6ef7e1 start + 1

Comment 1 Beth Dakin 2013-09-09 15:14:37 PDT

Skipped: http://trac.webkit.org/changeset/155389

Comment 2 Alexey Proskuryakov 2014-12-09 23:34:06 PST

This test appears to pass on bots at this time, will try unmarking.