Bug 141436

Summary:	[iOS] Crash in WKBundleBackForwardListItemCopyURL when running all tests
Product:	WebKit	Reporter:	David Kilzer (:ddkilzer) <ddkilzer>
Component:	Tools / Tests	Assignee:	Nobody <webkit-unassigned>
Status:	NEW ---
Severity:	Normal	CC:	ap, beidson, webkit-bug-importer
Priority:	P2	Keywords:	InRadar
Version:	528+ (Nightly build)
Hardware:	Unspecified
OS:	Unspecified

Description David Kilzer (:ddkilzer) 2015-02-10 09:23:51 PST

fast/loader/subframe-navigate-during-main-frame-load.html crashes when running all tests, but passes when run by itself.

Crashing stack:

Thread 0 Crashed:: Dispatch queue: com.apple.main-thread
0   com.apple.WebKit              	0x0000000110602a76 WKBundleBackForwardListItemCopyURL + 8
1   WebKitTestRunnerInjectedBundle	0x000000011d06e421 WTR::dumpBackForwardListItem(OpaqueWKBundleBackForwardListItem const*, unsigned int, bool, WTF::StringBuilder&) + 105
2   WebKitTestRunnerInjectedBundle	0x000000011d06e349 WTR::InjectedBundlePage::dumpBackForwardList(WTF::StringBuilder&) + 459
3   WebKitTestRunnerInjectedBundle	0x000000011d063e41 WTR::InjectedBundle::dumpBackForwardListsForAllPages(WTF::StringBuilder&) + 63
4   WebKitTestRunnerInjectedBundle	0x000000011d0696f0 WTR::InjectedBundlePage::dump() + 888
5   com.apple.WebKit              	0x000000011044b2e0 WebKit::InjectedBundlePageLoaderClient::didFinishLoadForFrame(WebKit::WebPage*, WebKit::WebFrame*, WTF::RefPtr<API::Object>&) + 48
6   com.apple.WebKit              	0x00000001105112cc WebKit::WebFrameLoaderClient::dispatchDidFinishLoad() + 72
7   com.apple.WebCore             	0x0000000113af5308 WebCore::FrameLoader::checkLoadCompleteForThisFrame() + 264 (FrameLoader.cpp:2270)
8   com.apple.WebCore             	0x0000000113aea2f8 WebCore::FrameLoader::checkLoadComplete() + 264 (FrameLoader.cpp:2445)
9   com.apple.WebCore             	0x000000011396472b WebCore::DocumentLoader::finishedLoading(double) + 619 (DocumentLoader.cpp:449)
10  com.apple.WebCore             	0x000000011378f7c1 WebCore::CachedResource::checkNotify() + 353 (CachedResource.cpp:293)
11  com.apple.WebCore             	0x000000011378b115 WebCore::CachedRawResource::finishLoading(WebCore::SharedBuffer*) + 229 (CachedRawResource.cpp:105)
12  com.apple.WebCore             	0x00000001145fb7ed WebCore::SubresourceLoader::didFinishLoading(double) + 1069 (ResourceLoader.h:154)
13  com.apple.WebKit              	0x00000001105e9965 WebKit::WebResourceLoader::didReceiveWebResourceLoaderMessage(IPC::Connection&, IPC::MessageDecoder&) + 645
14  com.apple.WebKit              	0x0000000110417584 IPC::Connection::dispatchMessage(std::__1::unique_ptr<IPC::MessageDecoder, std::__1::default_delete<IPC::MessageDecoder> >) + 102
15  com.apple.WebKit              	0x0000000110419f30 IPC::Connection::dispatchOneMessage() + 114
16  JavaScriptCore                	0x000000011302a476 WTF::RunLoop::performWork() + 454 (RunLoop.cpp:106)
17  JavaScriptCore                	0x000000011302ad2a WTF::RunLoop::performWork(void*) + 26 (RunLoopCF.cpp:38)
18  com.apple.CoreFoundation      	0x000000010c1f1ab1 __CFRUNLOOP_IS_CALLING_OUT_TO_A_SOURCE0_PERFORM_FUNCTION__ + 17
19  com.apple.CoreFoundation      	0x000000010c1e763d __CFRunLoopDoSources0 + 269
20  com.apple.CoreFoundation      	0x000000010c1e6c0b __CFRunLoopRun + 827
21  com.apple.CoreFoundation      	0x000000010c1e664c CFRunLoopRunSpecific + 476
22  com.apple.Foundation          	0x000000010b538d72 -[NSRunLoop(NSRunLoop) runMode:beforeDate:] + 275
23  com.apple.Foundation          	0x000000010b5c4472 -[NSRunLoop(NSRunLoop) run] + 76
24  libxpc.dylib                  	0x000000010d088996 _xpc_objc_main + 380
25  libxpc.dylib                  	0x000000010d08ad20 xpc_main + 189
26  com.apple.WebKit.WebContent.Development	0x000000010b46a2e0 main + 16 (XPCServiceMain.Development.mm:90)
27  libdyld.dylib                 	0x000000010cde9a05 start + 1

Comment 1 David Kilzer (:ddkilzer) 2015-02-10 09:24:06 PST

<rdar://problem/19760850>

Comment 2 David Kilzer (:ddkilzer) 2015-02-28 13:55:44 PST

This crash is still occurring.  Enabling run-webkit-test debugging shows these tests frequently crash in this order on the same worker process:

http/tests/navigation/success200-subframeload.html
http/tests/navigation/target-blank-opener.html
http/tests/navigation/timerredirect-basic.html  # Crash

And:

fast/loader/start-load-in-unload.html
fast/loader/stop-provisional-loads.html
fast/loader/subframe-navigate-during-main-frame-load.html  # Crash