Bug 19518

Summary: Webkit crashes at www.trader.ca
Product: WebKit Reporter: Blair Thiessen <blair.thiessen>
Component: Page LoadingAssignee: Nobody <webkit-unassigned>
Status: RESOLVED DUPLICATE    
Severity: Normal CC: dieter, webkit
Priority: P1 Keywords: NeedsReduction
Version: 528+ (Nightly build)   
Hardware: Mac   
OS: OS X 10.5   
URL: http://www.trader.ca
Attachments:
Description Flags
Crash log none

Description Blair Thiessen 2008-06-12 07:27:52 PDT
When I do a search on trader.ca Webkit crashes.
Comment 1 Robert Blaut 2008-06-12 11:11:42 PDT
Thank you for reporting the crash bug. For crash bugs like this we need crash logs attached to a bug report. Details how to get crash log are available here: http://webkit.org/quality/crashlogs.html

Is the crash replicable? Is it possible to provide us exact steps to reproduce the problem?
Comment 2 Blair Thiessen 2008-06-12 11:35:01 PDT
Created attachment 21664 [details]
Crash log

Here is the steps to repeat the crash.

1. go to www.trader.ca
2. select Ontario as your Province
3. Click the Advance Search button
4. At this point the crash happens.
Comment 3 Alexey Proskuryakov 2008-06-12 21:39:05 PDT
With a debug build,

ASSERTION FAILED: !pendingScripts.isEmpty()
(/Users/ap/Safari/OpenSource/WebCore/html/HTMLTokenizer.cpp:1956 virtual void WebCore::HTMLTokenizer::notifyFinished(WebCore::CachedResource*))

Comment 4 Dieter Komendera 2008-11-22 08:21:38 PST
I also can confirm that it crashes Webkit r38688. Sometimes I get a slightly different stack trace:

0   com.apple.WebCore             	0x012ffce0 WebCore::String::operator JSC::UString() const + 64
1   com.apple.WebCore             	0x00ff57ab WebCore::HTMLTokenizer::notifyFinished(WebCore::CachedResource*) + 651
2   com.apple.WebCore             	0x00fea9c0 WebCore::HTMLTokenizer::executeScriptsWaitingForStylesheets() + 48
3   com.apple.WebCore             	0x00f04fa1 WebCore::Document::removePendingSheet() + 49 
Comment 5 Cameron Zwarich (cpst) 2008-11-30 09:47:51 PST
This is the same issue as in bug 22073, which was fixed in r38748.

*** This bug has been marked as a duplicate of 22073 ***