Summary: | REGRESSION (r196892): Crash in DocumentLoader::startLoadingMainResource() | ||||||
---|---|---|---|---|---|---|---|
Product: | WebKit | Reporter: | Daniel Bates <dbates> | ||||
Component: | Page Loading | Assignee: | Daniel Bates <dbates> | ||||
Status: | RESOLVED FIXED | ||||||
Severity: | Normal | CC: | ap, beidson, bfulgham, cdumez, commit-queue, japhet, mkwst, webkit-bug-importer | ||||
Priority: | P2 | Keywords: | InRadar | ||||
Version: | WebKit Local Build | ||||||
Hardware: | All | ||||||
OS: | All | ||||||
Bug Depends on: | 154520 | ||||||
Bug Blocks: | |||||||
Attachments: |
|
Description
Daniel Bates
2016-02-22 16:11:11 PST
Thread 0 Crashed:: Dispatch queue: com.apple.main-thread 0 com.apple.WebCore 0x00000001050a66d4 WebCore::DocumentLoader::startLoadingMainResource() + 932 1 com.apple.WebKit 0x0000000103b770ce WebKit::WebFrame::didReceivePolicyDecision(unsigned long long, WebCore::PolicyAction, unsigned long long, WebKit::DownloadID) + 192 2 com.apple.WebKit 0x0000000103bbc9d6 void IPC::handleMessage<Messages::WebPage::DidReceivePolicyDecision, WebKit::WebPage, void (WebKit::WebPage::*)(unsigned long long, unsigned long long, unsigned int, unsigned long long, WebKit::DownloadID)>(IPC::MessageDecoder&, WebKit::WebPage*, void (WebKit::WebPage::*)(unsigned long long, unsigned long long, unsigned int, unsigned long long, WebKit::DownloadID)) + 107 3 com.apple.WebKit 0x0000000103a887d1 IPC::MessageReceiverMap::dispatchMessage(IPC::Connection&, IPC::MessageDecoder&) + 113 4 com.apple.WebKit 0x0000000103bfe36e WebKit::WebProcess::didReceiveMessage(IPC::Connection&, IPC::MessageDecoder&) + 28 5 com.apple.WebKit 0x0000000103a4a52f IPC::Connection::dispatchMessage(std::__1::unique_ptr<IPC::MessageDecoder, std::__1::default_delete<IPC::MessageDecoder> >) + 127 6 com.apple.WebKit 0x0000000103a4ce4a IPC::Connection::dispatchOneMessage() + 126 7 com.apple.JavaScriptCore 0x0000000104daa2f5 WTF::RunLoop::performWork() + 437 8 com.apple.JavaScriptCore 0x0000000104daa6a2 WTF::RunLoop::performWork(void*) + 34 9 com.apple.CoreFoundation 0x00007fff9149afe1 __CFRUNLOOP_IS_CALLING_OUT_TO_A_SOURCE0_PERFORM_FUNCTION__ + 17 10 com.apple.CoreFoundation 0x00007fff9147a71c __CFRunLoopDoSources0 + 556 11 com.apple.CoreFoundation 0x00007fff91479c3f __CFRunLoopRun + 927 12 com.apple.CoreFoundation 0x00007fff91479638 CFRunLoopRunSpecific + 296 13 com.apple.HIToolbox 0x00007fff8c62a935 RunCurrentEventLoopInMode + 235 14 com.apple.HIToolbox 0x00007fff8c62a76f ReceiveNextEventCommon + 432 15 com.apple.HIToolbox 0x00007fff8c62a5af _BlockUntilNextEventMatchingListInModeWithFilter + 71 16 com.apple.AppKit 0x00007fff94f10f3a _DPSNextEvent + 1067 17 com.apple.AppKit 0x00007fff94f1036a -[NSApplication _nextEventMatchingEventMask:untilDate:inMode:dequeue:] + 454 18 com.apple.AppKit 0x00007fff94f04ec4 -[NSApplication run] + 682 19 com.apple.AppKit 0x00007fff94ece4ac NSApplicationMain + 1176 20 libxpc.dylib 0x00007fff9634a45e _xpc_objc_main + 793 21 libxpc.dylib 0x00007fff96348e8a xpc_main + 494 22 com.apple.WebKit.WebContent 0x000000010398e7df 0x10398d000 + 6111 23 libdyld.dylib 0x00007fff8f8a85ad start + 1 This crash only seems to occur when using WebKit2 (why?). When the test is run using WebKitTestRunner (WebKit2) DocumentLoader::refCount() == 1 before calling DocumentLoader::willSendRequest() in DocumentLoader::startLoadingMainResource(). When run using DumpRenderTree (WebKit1) DocumentLoader::refCount() == 3 at the same position. Regardless of the ref count differences, DocumentLoader::startLoadingMainResource() should hold a ref of itself because DocumentLoader::willSendRequest() may deref us if we are the provisional loader and the load is cancelled. Created attachment 271966 [details]
Patch
Comment on attachment 271966 [details] Patch Clearing flags on attachment: 271966 Committed r196965: <http://trac.webkit.org/changeset/196965> All reviewed patches have been landed. Closing bug. |