Bug 16607

Summary: Random crashes in FrameView::scheduleRelayout while surfing Thinkgeek
Product: WebKit Reporter: Cameo Wood <cameowood>
Component: New BugsAssignee: Nobody <webkit-unassigned>
Status: RESOLVED FIXED    
Severity: Normal CC: aroben, dev+webkit
Priority: P2 Keywords: InRadar
Version: 528+ (Nightly build)   
Hardware: PC   
OS: Windows XP   
URL: http://www.thinkgeek.com
Bug Depends on: 16808    
Bug Blocks:    
Attachments:
Description Flags
crash dump none

Description Cameo Wood 2007-12-25 13:04:12 PST
After surfing about 8 pages on thinkgeek (using the back button to navigate back to the main page occasionally, I've had safari crash nearly every 10 minutes.  I'm including a crash dump here in case it has any useful information
Comment 1 Cameo Wood 2007-12-25 13:04:35 PST
Created attachment 18112 [details]
crash dump
Comment 2 Matt Lilek 2007-12-26 10:55:35 PST
According to the user.dmp file, it's crashing in FrameView::scheduleRelayout:

WebKit!WebCore::FrameView::scheduleRelayout+0x38 [c:\cygwin\home\buildbot\slave\win32-release-archive\build\opensource\webcore\page\frameview.cpp @ 708]
WebKit!WebCore::Document::finishedParsing+0x23 [c:\cygwin\home\buildbot\slave\win32-release-archive\build\opensource\webcore\dom\document.cpp @ 3519]
WebKit!WebCore::HTMLParser::finished+0x99 [c:\cygwin\home\buildbot\slave\win32-release-archive\build\opensource\webcore\html\htmlparser.cpp @ 1436]
WebKit!WebCore::HTMLTokenizer::end+0x95 [c:\cygwin\home\buildbot\slave\win32-release-archive\build\opensource\webcore\html\htmltokenizer.cpp @ 1554]
WebKit!WebCore::HTMLTokenizer::finish+0x418 [c:\cygwin\home\buildbot\slave\win32-release-archive\build\opensource\webcore\html\htmltokenizer.cpp @ 1592]
WebKit!WTF::RefCounter<WTF::PairBaseHashTraits<WTF::HashTraits<WebCore::String>,WTF::HashTraits<WTF::HashSet<WebCore::Page *,WTF::PtrHash<WebCore::Page *>,WTF::HashTraits<WebCore::Page *> > *> >,WTF::PairHashTraits<WTF::HashTraits<WebCore::StringImpl *>,WTF::HashTraits<int> > >::deref+0x37 [c:\cygwin\home\buildbot\slave\win32-release-archive\build\build-release\include\javascriptcore\hashtable.h @ 1173]
WebKit!WebCore::FrameLoader::write+0x2ae [c:\cygwin\home\buildbot\slave\win32-release-archive\build\opensource\webcore\loader\frameloader.cpp @ 1000]
WebKit!WebFrame::committedLoad+0x46 [c:\cygwin\home\buildbot\slave\win32-release-archive\build\opensource\webkit\win\webframe.cpp @ 2022]
WebKit!WebCore::FrameLoader::endIfNotLoadingMainResource+0x5f [c:\cygwin\home\buildbot\slave\win32-release-archive\build\opensource\webcore\loader\frameloader.cpp @ 1042]

Comment 3 Matt Lilek 2007-12-26 11:07:48 PST
See bug 16612 for an ASSERT I hit while trying to reproduce this.
Comment 4 David Kilzer (:ddkilzer) 2007-12-26 20:57:51 PST
<rdar://problem/5663654>
Comment 5 Adam Roben (:aroben) 2008-01-07 11:50:23 PST
Comment on attachment 18112 [details]
crash dump

Was this dump created while running a nightly? If so, which nightly?
Comment 6 Matt Lilek 2008-01-07 12:03:41 PST
(In reply to comment #5)
> (From update of attachment 18112 [details] [edit])
> Was this dump created while running a nightly? If so, which nightly?
> 

I believe this was from the r28899 nightly.
Comment 7 Cameo Wood 2008-01-07 12:08:05 PST
Yes, mine was from the r28899 nightly
Comment 8 Adam Roben (:aroben) 2008-01-10 13:25:20 PST
Fixed by r29369