Bug 168237 – Regression(r211455): ASSERTION FAILED: frameView || pageCacheState() == InPageCache in com.apple.WebCore: WebCore::Document::destroyRenderTree

• Component: WebCore Misc.
• Status: RESOLVED FIXED

[Chris Dumez]

ASSERTION FAILED: frameView || pageCacheState() == InPageCache
Source/WebCore/dom/Document.cpp(2243) : void WebCore::Document::destroyRenderTree()
1   0x10e377c3d WTFCrash
2   0x11650ff9d WebCore::Document::destroyRenderTree()
3   0x11651083d WebCore::Document::prepareForDestruction()
4   0x11607cea9 WebCore::CachedFrame::destroy()
5   0x11608df69 WebCore::CachedPage::~CachedPage()
6   0x11608e055 WebCore::CachedPage::~CachedPage()
7   0x117b9153c WebCore::PageCache::prune(WebCore::PruningReason)
8   0x117b913c3 WebCore::PageCache::pruneToSizeNow(unsigned int, WebCore::PruningReason)
9   0x1181eb748 WebCore::Settings::setUsesPageCache(bool)
10  0x109555fb8 WebKit::InjectedBundle::overrideBoolPreferenceForTestRunner(WebKit::WebPageGroupProxy*, WTF::String const&, bool)
11  0x109f53d6f WKBundleOverrideBoolPreferenceForTestRunner
12  0x1137fd080 WTR::TestRunner::overridePreference(OpaqueJSString*, OpaqueJSString*)
13  0x1137f6793 WTR::JSTestRunner::overridePreference(OpaqueJSContext const*, OpaqueJSValue*, OpaqueJSValue*, unsigned long, OpaqueJSValue const* const*, OpaqueJSValue const**)
14  0x10ddd1ad7 long long JSC::APICallbackFunction::call<JSC::JSCallbackFunction>(JSC::ExecState*)
15  0x10df63f9a JSC::LLInt::handleHostCall(JSC::ExecState*, JSC::Instruction*, JSC::JSValue, JSC::CodeSpecializationKind)
16  0x10df5fe1d JSC::LLInt::setUpCall(JSC::ExecState*, JSC::Instruction*, JSC::CodeSpecializationKind, JSC::JSValue, JSC::LLIntCallLinkInfo*)
17  0x10df5f0e3 JSC::LLInt::genericCall(JSC::ExecState*, JSC::Instruction*, JSC::CodeSpecializationKind)
18  0x10df5efd3 llint_slow_path_call
19  0x10df6d283 llint_entry
20  0x10df65b5e vmEntryToJavaScript
21  0x10dd75ed9 JSC::JITCode::execute(JSC::VM*, JSC::ProtoCallFrame*)
22  0x10dd2b5ef JSC::Interpreter::executeCall(JSC::ExecState*, JSC::JSObject*, JSC::CallType, JSC::CallData const&, JSC::JSValue, JSC::ArgList const&)
23  0x10d554238 JSC::call(JSC::ExecState*, JSC::JSValue, JSC::CallType, JSC::CallData const&, JSC::JSValue, JSC::ArgList const&)
24  0x10d554349 JSC::call(JSC::ExecState*, JSC::JSValue, JSC::CallType, JSC::CallData const&, JSC::JSValue, JSC::ArgList const&, WTF::NakedPtr<JSC::Exception>&)
25  0x10d5545dd JSC::profiledCall(JSC::ExecState*, JSC::ProfilingReason, JSC::JSValue, JSC::CallType, JSC::CallData const&, JSC::JSValue, JSC::ArgList const&, WTF::NakedPtr<JSC::Exception>&)
26  0x116f12cdb WebCore::JSMainThreadExecState::profiledCall(JSC::ExecState*, JSC::ProfilingReason, JSC::JSValue, JSC::CallType, JSC::CallData const&, JSC::JSValue, JSC::ArgList const&, WTF::NakedPtr<JSC::Exception>&)
27  0x1171ab379 WebCore::JSEventListener::handleEvent(WebCore::ScriptExecutionContext*, WebCore::Event*)
28  0x1166fda56 WebCore::EventTarget::fireEventListeners(WebCore::Event&, WTF::Vector<WTF::RefPtr<WebCore::RegisteredEventListener>, 1ul, WTF::CrashOnOverflow, 16ul>)
29  0x1166fd707 WebCore::EventTarget::fireEventListeners(WebCore::Event&)
30  0x117b386c4 WebCore::Node::handleLocalEvents(WebCore::Event&)
31  0x1166c9feb WebCore::EventContext::handleLocalEvents(WebCore::Event&) const

[Chris Dumez]

<rdar://problem/30494165>

[Chris Dumez]

Created attachment 301364 [details]
Patch

[Chris Dumez]

CachedFrame::destroy():
    m_document->setPageCacheState(Document::NotInPageCache);
    m_document->prepareForDestruction();

[Chris Dumez]

Comment on attachment 301364 [details]
Patch

Clearing flags on attachment: 301364

Committed r212238: <http://trac.webkit.org/changeset/212238>

[Chris Dumez]

All reviewed patches have been landed.  Closing bug.