Bug 13098 – REGRESSION (r17365): ASSERTION FAILED: !pageState || pageState->document() == m_frame->document() in WebCore/loader/FrameLoader.cpp:3666 invalidateCurrentItemPageCache

• Component: Page Loading
• Status: RESOLVED WORKSFORME

Summary:
Hit the above assertion in Safari.

Steps to reproduce:
1) Open the URL.
2) Scroll to the bottom, where there is a table with numbered rows.
3) Click row 10. It will open a small popup window. Wait for the popup's contents to finish loading.
4) Without closing the popup, click row 10 again. Wait for it to load.
5) Without closing the popup, click row 9.

Backtrace:
#0  0x014882d8 in WebCore::FrameLoader::invalidateCurrentItemPageCache (this=0x2971a00) at WebCore/loader/FrameLoader.cpp:3666
#1  0x01498d20 in WebCore::FrameLoader::receivedMainResourceError (this=0x2971a00, error=@0xbfffc8d8, isComplete=true) at WebCore/loader/FrameLoader.cpp:3107
#2  0x0149e474 in WebCore::MainResourceLoader::didCancel (this=0x2a79200, error=@0xbfffc8d8) at WebCore/loader/MainResourceLoader.cpp:91
#3  0x014a0a44 in WebCore::ResourceLoader::cancel (this=0x2a79200, error=@0xbfffc948) at WebCore/loader/ResourceLoader.cpp:300
#4  0x014a0b08 in WebCore::ResourceLoader::cancel (this=0x2a79200) at WebCore/loader/ResourceLoader.cpp:290
#5  0x0149d0d0 in WebCore::DocumentLoader::stopLoading (this=0x293d000) at WebCore/loader/DocumentLoader.cpp:278
#6  0x014915b8 in WebCore::FrameLoader::stopAllLoaders (this=0x2971a00) at WebCore/loader/FrameLoader.cpp:2130
#7  0x01491970 in WebCore::FrameLoader::continueLoadAfterNavigationPolicy (this=0x2971a00, request=@0xbfffcdc0, formState=@0xbfffcbec, shouldContinue=true) at WebCore/loader/FrameLoader.cpp:3330
#8  0x01491b2c in WebCore::FrameLoader::callContinueLoadAfterNavigationPolicy (argument=0x2971a00, request=@0xbfffcdc0, formState=@0xbfffcc4c, shouldContinue=true) at WebCore/loader/FrameLoader.cpp:3291
#9  0x0148cf9c in WebCore::PolicyCheck::call (this=0xbfffcdc0, shouldContinue=true) at WebCore/loader/FrameLoader.cpp:4204
#10 0x01491310 in WebCore::FrameLoader::continueAfterNavigationPolicy (this=0x2971a00, policy=WebCore::PolicyUse) at WebCore/loader/FrameLoader.cpp:3284
#11 0x003cddec in WebFrameLoaderClient::receivedPolicyDecison (this=0x72b0530, action=WebCore::PolicyUse) at /WebKit/WebKit/WebCoreSupport/WebFrameLoaderClient.mm:988
#12 0x003ce9a0 in -[WebFramePolicyListener receivedPolicyDecision:] (self=0x728f7a0, _cmd=0x414f08, action=WebCore::PolicyUse) at /WebKit/WebKit/WebCoreSupport/WebFrameLoaderClient.mm:1182
#13 0x003cd720 in -[WebFramePolicyListener use] (self=0x728f7a0, _cmd=0x90abca5c) at /WebKit/WebKit/WebCoreSupport/WebFrameLoaderClient.mm:1197
#14 0x90a461f4 in objc_msgSendv ()
#15 0x92bdec94 in -[NSInvocation invoke] ()
#16 0x92bdf244 in -[NSInvocation invokeWithTarget:] ()
#17 0x0038160c in -[_WebSafeForwarder forwardInvocation:] (self=0x7273f40, _cmd=0x90a95ac8, anInvocation=0x9462490) at /WebKit/WebKit/WebView/WebView.mm:1455
#18 0x92bd7040 in -[NSObject(NSForwardInvocation) forward::] ()
#19 0x90a460b0 in _objc_msgForward ()
#20 0x003ce0c8 in WebFrameLoaderClient::dispatchDecidePolicyForNavigationAction (this=0x72b0530, function={__pfn = 0x1491148 <WebCore::FrameLoader::continueAfterNavigationPolicy(WebCore::PolicyAction)>, __delta = 0}, action=@0xbfffd7cc, request=@0x2a4b684) at /WebKit/WebKit/WebCoreSupport/WebFrameLoaderClient.mm:533
#21 0x01490d64 in WebCore::FrameLoader::checkNavigationPolicy (this=0x2971a00, request=@0x2a4b684, loader=0x2a4b400, formState=@0xbfffd88c, function=0x1491ad8 <WebCore::FrameLoader::callContinueLoadAfterNavigationPolicy(void*, WebCore::ResourceRequest const&, WTF::PassRefPtr<WebCore::FormState>, bool)>, argument=0x2971a00) at WebCore/loader/FrameLoader.cpp:3257
#22 0x01492ad8 in WebCore::FrameLoader::load (this=0x2971a00, loader=0x2a4b400, type=WebCore::FrameLoadTypeStandard, formState=@0xbfffd8e8) at WebCore/loader/FrameLoader.cpp:1907
#23 0x01493ce4 in WebCore::FrameLoader::load (this=0x2971a00, request=@0xbfffdac4, action=@0xbfffda64, type=WebCore::FrameLoadTypeStandard, formState=@0xbfffd9e0) at WebCore/loader/FrameLoader.cpp:1860
#24 0x01494844 in WebCore::FrameLoader::load (this=0x2971a00, URL=@0xbfffdf54, referrer=@0xbfffded0, newLoadType=WebCore::FrameLoadTypeStandard, frameName=@0xbfffdcb4, event=0x0, form=0x0, values=@0xbfffdf38) at WebCore/loader/FrameLoader.cpp:1808
#25 0x01494618 in WebCore::FrameLoader::load (this=0x2971a00, URL=@0xbfffdf54, referrer=@0xbfffded0, newLoadType=WebCore::FrameLoadTypeStandard, frameName=@0xbfffe040, event=0x0, form=0x0, values=@0xbfffdf38) at WebCore/loader/FrameLoader.cpp:1772
#26 0x01494bbc in WebCore::FrameLoader::load (this=0x2971a00, request=@0xbfffdf54, userGesture=true, event=0x0, submitForm=0x0, formValues=@0xbfffdf38) at WebCore/loader/FrameLoader.cpp:1741
#27 0x01499b98 in WebCore::FrameLoader::urlSelected (this=0x2971a00, request=@0xbfffe16c, event=0x0) at WebCore/loader/FrameLoader.cpp:2822
#28 0x0149a724 in WebCore::FrameLoader::urlSelected (this=0x2971a00, request=@0xbfffe388, _target=@0xbfffe2c0, triggeringEvent=0x0, lockHistory=false) at WebCore/loader/FrameLoader.cpp:355
#29 0x0149a964 in WebCore::FrameLoader::changeLocation (this=0x2971a00, URL=@0x96314bc, referrer=@0x96314c0, lockHistory=false, userGesture=true) at WebCore/loader/FrameLoader.cpp:332
#30 0x0149aa7c in WebCore::FrameLoader::redirectionTimerFired (this=0x2971a00) at WebCore/loader/FrameLoader.cpp:1279
#31 0x017efbb8 in WebCore::Timer<WebCore::FrameLoader>::fired (this=0x2971cc8) at Timer.h:96
#32 0x0127b3e4 in WebCore::TimerBase::fireTimers (fireTime=1174121672.7130251, firingTimers=@0xbfffe700) at WebCore/platform/Timer.cpp:336
#33 0x0127b4b0 in WebCore::TimerBase::sharedTimerFired () at WebCore/platform/Timer.cpp:353
#34 0x0127a85c in timerFired () at WebCore/platform/mac/SharedTimerMac.cpp:46
#35 0x907f2578 in __CFRunLoopDoTimer ()
#36 0x907deef8 in __CFRunLoopRun ()
#37 0x907de4ac in CFRunLoopRunSpecific ()
#38 0x9329bb20 in RunCurrentEventLoopInMode ()
#39 0x9329b1b4 in ReceiveNextEventCommon ()
#40 0x9329b020 in BlockUntilNextEventMatchingListInMode ()
#41 0x937a1ae4 in _DPSNextEvent ()
#42 0x937a17a8 in -[NSApplication nextEventMatchingMask:untilDate:inMode:dequeue:] ()
#43 0x00006740 in ?? ()
#44 0x9379dcec in -[NSApplication run] ()
#45 0x9388e87c in NSApplicationMain ()
#46 0x0005c77c in ?? ()
#47 0x0005c624 in ?? ()

Notes:
According to the comment just before the ASSERT, the condition is expected and apparently taken care of, so this may not be P1. Still, it is a regression that it happens on the given URL.

Created attachment 13678 [details]
Reduced test case

[Maciej Stachowiak]

<rdar://problem/5072328>

Regressed in <http://trac.webkit.org/projects/webkit/changeset/17365>.

[Eric Seidel (no email)]

I wonder if this should have ended up as FrameLoadTypeSame.  That would have avoided creating the PageCache.  Not sure though, especially since this is a data: url.

[Maxime BRITTO]

I can't reproduce it with r22090. Both regular URL and reduced test case.

[Brady Eidson]

I can't reproduce this anymore, either.

Closing.