Bug 21508 – Regression: ASSERT hit in FrameView::scheduleRelayout() when hitting "Back"

• Component: New Bugs
• Status: NEW

[Eric Seidel (no email)]

Regression: ASSERT hit in FrameView::scheduleRelayout() when hitting "Back"

To reproduce
1. go to:
http://philip.html5.org/tests/canvas/suite/tests/reportgen.html?175,0
2. click "Show all tests" (probably not necessary)
3.  Scroll down to the "security.pattern.create" test
4.  Click on the "security.pattern.create" link
5.  Click "back" (after the security.pattern.create test loads)
6.  ASSERT hit:

ASSERTION FAILED: !m_frame->document() || !m_frame->document()->inPageCache()

(gdb) p m_frame.get()->document()
$1 = (class WebCore::Document *) 0x1e47aa00
(gdb) p m_frame.get()->document()->inPageCache()
$2 = true

#0  0x038d5907 in WebCore::FrameView::scheduleRelayout (this=0x203e6410) at /Users/eseidel/Projects/WebKit/WebCore/page/FrameView.cpp:744
#1  0x03b84445 in WebCore::RenderObject::scheduleRelayout (this=0x22e36aac) at /Users/eseidel/Projects/WebKit/WebCore/rendering/RenderObject.cpp:2755
#2  0x03b86b77 in WebCore::RenderObject::markContainingBlocksForLayout (this=0x20ab1fbc, scheduleRelayout=true, newRoot=0x0) at /Users/eseidel/Projects/WebKit/WebCore/rendering/RenderObject.cpp:787
#3  0x03b86cdb in WebCore::RenderObject::setNeedsLayout (this=0x20ab1fbc, b=true, markParents=true) at /Users/eseidel/Projects/WebKit/WebCore/rendering/RenderObject.cpp:701
#4  0x0366e39d in WebCore::RenderObject::setNeedsLayoutAndPrefWidthsRecalc (this=0x20ab1fbc) at RenderObject.h:412
#5  0x03b4782f in WebCore::RenderContainer::appendChildNode (this=0x207a647c, newChild=0x20ab1fbc, fullAppend=true) at /Users/eseidel/Projects/WebKit/WebCore/rendering/RenderContainer.cpp:455
#6  0x03b478c9 in WebCore::RenderContainer::insertChildNode (this=0x207a647c, child=0x20ab1fbc, beforeChild=0x0, fullInsert=true) at /Users/eseidel/Projects/WebKit/WebCore/rendering/RenderContainer.cpp:466
#7  0x03b49735 in WebCore::RenderContainer::addChild (this=0x207a647c, newChild=0x20ab1fbc, beforeChild=0x0) at /Users/eseidel/Projects/WebKit/WebCore/rendering/RenderContainer.cpp:125
#8  0x03b1519c in WebCore::RenderBlock::addChildToFlow (this=0x207a647c, newChild=0x20ab1fbc, beforeChild=0x0) at /Users/eseidel/Projects/WebKit/WebCore/rendering/RenderBlock.cpp:251
#9  0x03b56ce0 in WebCore::RenderFlow::addChild (this=0x207a647c, newChild=0x20ab1fbc, beforeChild=0x0) at /Users/eseidel/Projects/WebKit/WebCore/rendering/RenderFlow.cpp:131
#10 0x03ae0752 in WebCore::Node::createRendererIfNeeded (this=0x205fc030) at /Users/eseidel/Projects/WebKit/WebCore/dom/Node.cpp:1039
#11 0x03866673 in WebCore::Element::attach (this=0x205fc030) at /Users/eseidel/Projects/WebKit/WebCore/dom/Element.cpp:660
#12 0x0392333a in WebCore::HTMLLIElement::attach (this=0x205fc030) at /Users/eseidel/Projects/WebKit/WebCore/html/HTMLLIElement.cpp:82
#13 0x0371f282 in WebCore::ContainerNode::appendChild (this=0x204bfc20, newChild=@0xbfffda3c, ec=@0xbfffda90, shouldLazyAttach=false) at /Users/eseidel/Projects/WebKit/WebCore/dom/ContainerNode.cpp:508
#14 0x038fe767 in replaceChildrenWithFragment (element=0x204bfc20, fragment=@0xbfffda6c, ec=@0xbfffda90) at /Users/eseidel/Projects/WebKit/WebCore/html/HTMLElement.cpp:325
#15 0x03901fa2 in WebCore::HTMLElement::setInnerHTML (this=0x204bfc20, html=@0xbfffda94, ec=@0xbfffda90) at /Users/eseidel/Projects/WebKit/WebCore/html/HTMLElement.cpp:354
#16 0x039f2968 in WebCore::setJSHTMLElementInnerHTML (exec=0x1c84f0e8, thisObject=0x1c52b4a0, value=0x1c52b480) at /Users/eseidel/Projects/build/Debug/DerivedSources/WebCore/JSHTMLElement.cpp:270
#17 0x039f35d5 in JSC::lookupPut<WebCore::JSHTMLElement> (exec=0x1c84f0e8, propertyName=@0x205185dc, value=0x1c52b480, table=0x498dcc4, thisObj=0x1c52b4a0) at lookup.h:218
#18 0x039f360f in JSC::lookupPut<WebCore::JSHTMLElement, WebCore::JSElement> (exec=0x1c84f0e8, propertyName=@0x205185dc, value=0x1c52b480, table=0x498dcc4, thisObj=0x1c52b4a0, slot=@0xbfffdc08) at lookup.h:232
#19 0x039f30b0 in WebCore::JSHTMLElement::put (this=0x1c52b4a0, exec=0x1c84f0e8, propertyName=@0x205185dc, value=0x1c52b480, slot=@0xbfffdc08) at /Users/eseidel/Projects/build/Debug/DerivedSources/WebCore/JSHTMLElement.cpp:227
#20 0x03a292fd in JSC::lookupPut<WebCore::JSHTMLUListElement, WebCore::JSHTMLElement> (exec=0x1c84f0e8, propertyName=@0x205185dc, value=0x1c52b480, table=0x498e324, thisObj=0x1c52b4a0, slot=@0xbfffdc08) at lookup.h:233
#21 0x03a28e28 in WebCore::JSHTMLUListElement::put (this=0x1c52b4a0, exec=0x1c84f0e8, propertyName=@0x205185dc, value=0x1c52b480, slot=@0xbfffdc08) at /Users/eseidel/Projects/build/Debug/DerivedSources/WebCore/JSHTMLUListElement.cpp:135
#22 0x0054626a in JSC::JSValue::put (this=0x1c52b4a0, exec=0x1c84f0e8, propertyName=@0x205185dc, value=0x1c52b480, slot=@0xbfffdc08) at JSObject.h:484
#23 0x0052ea1f in JSC::Machine::cti_op_put_by_id (args=0x0) at /Users/eseidel/Projects/WebKit/JavaScriptCore/VM/Machine.cpp:4368
#24 0x23948a56 in ?? ()
#25 0x00532e97 in JSC::Machine::execute (this=0x721e000, functionBodyNode=0x207a3e70, callFrame=0x1dc34e04, function=0x1fdf3280, thisObj=0x1c520000, args=@0xbfffddb0, scopeChain=0x22d53e30, exception=0x721da0c) at /Users/eseidel/Projects/WebKit/JavaScriptCore/VM/Machine.cpp:986
#26 0x0048399b in JSC::JSFunction::call (this=0x1fdf3280, exec=0x1dc34e04, thisValue=0x1c520000, args=@0xbfffddb0) at JSFunction.cpp:70
#27 0x00483a37 in JSC::call (exec=0x1dc34e04, functionObject=0x1fdf3280, callType=JSC::CallTypeJS, callData=@0xbfffde10, thisValue=0x1c520000, args=@0xbfffddb0) at CallData.cpp:39
#28 0x03d36112 in WebCore::JSAbstractEventListener::handleEvent (this=0x1dc09060, event=0x20480cd0, isWindowEvent=true) at /Users/eseidel/Projects/WebKit/WebCore/bindings/js/JSEventListener.cpp:98
#29 0x0380d989 in WebCore::Document::handleWindowEvent (this=0x1e47aa00, evt=0x20480cd0, useCapture=false) at /Users/eseidel/Projects/WebKit/WebCore/dom/Document.cpp:2723
#30 0x0387aa41 in WebCore::EventTargetNode::dispatchWindowEvent (this=0x1e47aa00, e=@0xbfffdefc) at /Users/eseidel/Projects/WebKit/WebCore/dom/EventTargetNode.cpp:420
#31 0x0387dd5e in WebCore::EventTargetNode::dispatchWindowEvent (this=0x1e47aa00, eventType=@0x4a0be78, canBubbleArg=false, cancelableArg=false) at /Users/eseidel/Projects/WebKit/WebCore/dom/EventTargetNode.cpp:427
#32 0x038143f3 in WebCore::Document::implicitClose (this=0x1e47aa00) at /Users/eseidel/Projects/WebKit/WebCore/dom/Document.cpp:1589
#33 0x038bb19a in WebCore::FrameLoader::checkCallImplicitClose (this=0x70ac824) at /Users/eseidel/Projects/WebKit/WebCore/loader/FrameLoader.cpp:1353
#34 0x038c7646 in WebCore::FrameLoader::checkCompleted (this=0x70ac824) at /Users/eseidel/Projects/WebKit/WebCore/loader/FrameLoader.cpp:1305
#35 0x038c775b in WebCore::FrameLoader::tokenizerProcessedData (this=0x70ac824) at /Users/eseidel/Projects/WebKit/WebCore/loader/FrameLoader.cpp:3354
#36 0x0395998d in WebCore::HTMLTokenizer::stopParsing (this=0x1e4d7800) at /Users/eseidel/Projects/WebKit/WebCore/html/HTMLTokenizer.cpp:1808
#37 0x038ca28d in WebCore::FrameLoader::stopLoading (this=0x70ac824, sendUnload=true) at /Users/eseidel/Projects/WebKit/WebCore/loader/FrameLoader.cpp:587
#38 0x038caa54 in WebCore::FrameLoader::closeURL (this=0x70ac824) at /Users/eseidel/Projects/WebKit/WebCore/loader/FrameLoader.cpp:670
#39 0x038ccdbc in WebCore::FrameLoader::transitionToCommitted (this=0x70ac824, cachedPage=@0xbfffe188) at /Users/eseidel/Projects/WebKit/WebCore/loader/FrameLoader.cpp:2761
#40 0x038cd3e2 in WebCore::FrameLoader::commitProvisionalLoad (this=0x70ac824, prpCachedPage=@0xbfffe1bc) at /Users/eseidel/Projects/WebKit/WebCore/loader/FrameLoader.cpp:2719
#41 0x03842ef6 in WebCore::DocumentLoader::commitIfReady (this=0x7422800) at /Users/eseidel/Projects/WebKit/WebCore/loader/DocumentLoader.cpp:333
#42 0x03842f27 in WebCore::DocumentLoader::commitLoad (this=0x7422800, data=0x1e6e7220 "<!DOCTYPE HTML>\n<title>Canvas tests - report generator</title>\n<link rel=\"stylesheet\" href=\"../reportgen.css\">\n<script src=\"../reportgen.js\"></script>\n<p>This is mainly for my own use, so it is not de"..., length=11644) at /Users/eseidel/Projects/WebKit/WebCore/loader/DocumentLoader.cpp:353
#43 0x03843168 in WebCore::DocumentLoader::receivedData (this=0x7422800, data=0x1e6e7220 "<!DOCTYPE HTML>\n<title>Canvas tests - report generator</title>\n<link rel=\"stylesheet\" href=\"../reportgen.css\">\n<script src=\"../reportgen.js\"></script>\n<p>This is mainly for my own use, so it is not de"..., length=11644) at /Users/eseidel/Projects/WebKit/WebCore/loader/DocumentLoader.cpp:367
#44 0x038bba85 in WebCore::FrameLoader::receivedData (this=0x70ac824, data=0x1e6e7220 "<!DOCTYPE HTML>\n<title>Canvas tests - report generator</title>\n<link rel=\"stylesheet\" href=\"../reportgen.css\">\n<script src=\"../reportgen.js\"></script>\n<p>This is mainly for my own use, so it is not de"..., length=11644) at /Users/eseidel/Projects/WebKit/WebCore/loader/FrameLoader.cpp:2342
#45 0x03acc3f4 in WebCore::MainResourceLoader::addData (this=0x76b9000, data=0x1e6e7220 "<!DOCTYPE HTML>\n<title>Canvas tests - report generator</title>\n<link rel=\"stylesheet\" href=\"../reportgen.css\">\n<script src=\"../reportgen.js\"></script>\n<p>This is mainly for my own use, so it is not de"..., length=11644, allAtOnce=false) at /Users/eseidel/Projects/WebKit/WebCore/loader/MainResourceLoader.cpp:145
#46 0x03be59a7 in WebCore::ResourceLoader::didReceiveData (this=0x76b9000, data=0x1e6e7220 "<!DOCTYPE HTML>\n<title>Canvas tests - report generator</title>\n<link rel=\"stylesheet\" href=\"../reportgen.css\">\n<script src=\"../reportgen.js\"></script>\n<p>This is mainly for my own use, so it is not de"..., length=11644, lengthReceived=11644, allAtOnce=false) at /Users/eseidel/Projects/WebKit/WebCore/loader/ResourceLoader.cpp:251
#47 0x03acc510 in WebCore::MainResourceLoader::didReceiveData (this=0x76b9000, data=0x1e6e7220 "<!DOCTYPE HTML>\n<title>Canvas tests - report generator</title>\n<link rel=\"stylesheet\" href=\"../reportgen.css\">\n<script src=\"../reportgen.js\"></script>\n<p>This is mainly for my own use, so it is not de"..., length=11644, lengthReceived=11644, allAtOnce=false) at /Users/eseidel/Projects/WebKit/WebCore/loader/MainResourceLoader.cpp:305
#48 0x03be568c in WebCore::ResourceLoader::didReceiveData (this=0x76b9000, data=0x1e6e7220 "<!DOCTYPE HTML>\n<title>Canvas tests - report generator</title>\n<link rel=\"stylesheet\" href=\"../reportgen.css\">\n<script src=\"../reportgen.js\"></script>\n<p>This is mainly for my own use, so it is not de"..., length=11644, lengthReceived=11644) at /Users/eseidel/Projects/WebKit/WebCore/loader/ResourceLoader.cpp:393
#49 0x03be2b3f in -[WebCoreResourceHandleAsDelegate connection:didReceiveData:lengthReceived:] (self=0x21cb8770, _cmd=0x9706e2cc, con=0x21cb91e0, data=0x1e6e7200, lengthReceived=11644) at /Users/eseidel/Projects/WebKit/WebCore/platform/network/mac/ResourceHandleMac.mm:510
#50 0x91209ac7 in -[NSURLConnection(NSURLConnectionReallyInternal) sendDidReceiveData:originalLength:] ()
#51 0x91209a11 in _NSURLConnectionDidReceiveData ()
#52 0x934cebfd in sendDidReceiveDataCallback ()
#53 0x934cbfb2 in _CFURLConnectionSendCallbacks ()
#54 0x934cba25 in muxerSourcePerform ()
#55 0x9619b615 in CFRunLoopRunSpecific ()
#56 0x9619bcf8 in CFRunLoopRunInMode ()
#57 0x93c61480 in RunCurrentEventLoopInMode ()
#58 0x93c61299 in ReceiveNextEventCommon ()
#59 0x93c6110d in BlockUntilNextEventMatchingListInMode ()
#60 0x9277d3ed in _DPSNextEvent ()
#61 0x9277cca0 in -[NSApplication nextEventMatchingMask:untilDate:inMode:dequeue:] ()
#62 0x000086be in ?? ()
#63 0x92775cdb in -[NSApplication run] ()
#64 0x92742f14 in NSApplicationMain ()
#65 0x000ba4d6 in ?? ()
Current language:  auto; currently c++
#0  0x038d5907 in WebCore::FrameView::scheduleRelayout (this=0x203e6410) at /Users/eseidel/Projects/WebKit/WebCore/page/FrameView.cpp:744
#1  0x03b84445 in WebCore::RenderObject::scheduleRelayout (this=0x22e36aac) at /Users/eseidel/Projects/WebKit/WebCore/rendering/RenderObject.cpp:2755
#2  0x03b86b77 in WebCore::RenderObject::markContainingBlocksForLayout (this=0x20ab1fbc, scheduleRelayout=true, newRoot=0x0) at /Users/eseidel/Projects/WebKit/WebCore/rendering/RenderObject.cpp:787
#3  0x03b86cdb in WebCore::RenderObject::setNeedsLayout (this=0x20ab1fbc, b=true, markParents=true) at /Users/eseidel/Projects/WebKit/WebCore/rendering/RenderObject.cpp:701
#4  0x0366e39d in WebCore::RenderObject::setNeedsLayoutAndPrefWidthsRecalc (this=0x20ab1fbc) at RenderObject.h:412
#5  0x03b4782f in WebCore::RenderContainer::appendChildNode (this=0x207a647c, newChild=0x20ab1fbc, fullAppend=true) at /Users/eseidel/Projects/WebKit/WebCore/rendering/RenderContainer.cpp:455
#6  0x03b478c9 in WebCore::RenderContainer::insertChildNode (this=0x207a647c, child=0x20ab1fbc, beforeChild=0x0, fullInsert=true) at /Users/eseidel/Projects/WebKit/WebCore/rendering/RenderContainer.cpp:466
#7  0x03b49735 in WebCore::RenderContainer::addChild (this=0x207a647c, newChild=0x20ab1fbc, beforeChild=0x0) at /Users/eseidel/Projects/WebKit/WebCore/rendering/RenderContainer.cpp:125
#8  0x03b1519c in WebCore::RenderBlock::addChildToFlow (this=0x207a647c, newChild=0x20ab1fbc, beforeChild=0x0) at /Users/eseidel/Projects/WebKit/WebCore/rendering/RenderBlock.cpp:251
#9  0x03b56ce0 in WebCore::RenderFlow::addChild (this=0x207a647c, newChild=0x20ab1fbc, beforeChild=0x0) at /Users/eseidel/Projects/WebKit/WebCore/rendering/RenderFlow.cpp:131
#10 0x03ae0752 in WebCore::Node::createRendererIfNeeded (this=0x205fc030) at /Users/eseidel/Projects/WebKit/WebCore/dom/Node.cpp:1039
#11 0x03866673 in WebCore::Element::attach (this=0x205fc030) at /Users/eseidel/Projects/WebKit/WebCore/dom/Element.cpp:660
#12 0x0392333a in WebCore::HTMLLIElement::attach (this=0x205fc030) at /Users/eseidel/Projects/WebKit/WebCore/html/HTMLLIElement.cpp:82
#13 0x0371f282 in WebCore::ContainerNode::appendChild (this=0x204bfc20, newChild=@0xbfffda3c, ec=@0xbfffda90, shouldLazyAttach=false) at /Users/eseidel/Projects/WebKit/WebCore/dom/ContainerNode.cpp:508
#14 0x038fe767 in replaceChildrenWithFragment (element=0x204bfc20, fragment=@0xbfffda6c, ec=@0xbfffda90) at /Users/eseidel/Projects/WebKit/WebCore/html/HTMLElement.cpp:325
#15 0x03901fa2 in WebCore::HTMLElement::setInnerHTML (this=0x204bfc20, html=@0xbfffda94, ec=@0xbfffda90) at /Users/eseidel/Projects/WebKit/WebCore/html/HTMLElement.cpp:354
#16 0x039f2968 in WebCore::setJSHTMLElementInnerHTML (exec=0x1c84f0e8, thisObject=0x1c52b4a0, value=0x1c52b480) at /Users/eseidel/Projects/build/Debug/DerivedSources/WebCore/JSHTMLElement.cpp:270
#17 0x039f35d5 in JSC::lookupPut<WebCore::JSHTMLElement> (exec=0x1c84f0e8, propertyName=@0x205185dc, value=0x1c52b480, table=0x498dcc4, thisObj=0x1c52b4a0) at lookup.h:218
#18 0x039f360f in JSC::lookupPut<WebCore::JSHTMLElement, WebCore::JSElement> (exec=0x1c84f0e8, propertyName=@0x205185dc, value=0x1c52b480, table=0x498dcc4, thisObj=0x1c52b4a0, slot=@0xbfffdc08) at lookup.h:232
#19 0x039f30b0 in WebCore::JSHTMLElement::put (this=0x1c52b4a0, exec=0x1c84f0e8, propertyName=@0x205185dc, value=0x1c52b480, slot=@0xbfffdc08) at /Users/eseidel/Projects/build/Debug/DerivedSources/WebCore/JSHTMLElement.cpp:227
#20 0x03a292fd in JSC::lookupPut<WebCore::JSHTMLUListElement, WebCore::JSHTMLElement> (exec=0x1c84f0e8, propertyName=@0x205185dc, value=0x1c52b480, table=0x498e324, thisObj=0x1c52b4a0, slot=@0xbfffdc08) at lookup.h:233
#21 0x03a28e28 in WebCore::JSHTMLUListElement::put (this=0x1c52b4a0, exec=0x1c84f0e8, propertyName=@0x205185dc, value=0x1c52b480, slot=@0xbfffdc08) at /Users/eseidel/Projects/build/Debug/DerivedSources/WebCore/JSHTMLUListElement.cpp:135
#22 0x0054626a in JSC::JSValue::put (this=0x1c52b4a0, exec=0x1c84f0e8, propertyName=@0x205185dc, value=0x1c52b480, slot=@0xbfffdc08) at JSObject.h:484
#23 0x0052ea1f in JSC::Machine::cti_op_put_by_id (args=0x0) at /Users/eseidel/Projects/WebKit/JavaScriptCore/VM/Machine.cpp:4368
#24 0x23948a56 in ?? ()
#25 0x00532e97 in JSC::Machine::execute (this=0x721e000, functionBodyNode=0x207a3e70, callFrame=0x1dc34e04, function=0x1fdf3280, thisObj=0x1c520000, args=@0xbfffddb0, scopeChain=0x22d53e30, exception=0x721da0c) at /Users/eseidel/Projects/WebKit/JavaScriptCore/VM/Machine.cpp:986
#26 0x0048399b in JSC::JSFunction::call (this=0x1fdf3280, exec=0x1dc34e04, thisValue=0x1c520000, args=@0xbfffddb0) at JSFunction.cpp:70
#27 0x00483a37 in JSC::call (exec=0x1dc34e04, functionObject=0x1fdf3280, callType=JSC::CallTypeJS, callData=@0xbfffde10, thisValue=0x1c520000, args=@0xbfffddb0) at CallData.cpp:39
#28 0x03d36112 in WebCore::JSAbstractEventListener::handleEvent (this=0x1dc09060, event=0x20480cd0, isWindowEvent=true) at /Users/eseidel/Projects/WebKit/WebCore/bindings/js/JSEventListener.cpp:98
#29 0x0380d989 in WebCore::Document::handleWindowEvent (this=0x1e47aa00, evt=0x20480cd0, useCapture=false) at /Users/eseidel/Projects/WebKit/WebCore/dom/Document.cpp:2723
#30 0x0387aa41 in WebCore::EventTargetNode::dispatchWindowEvent (this=0x1e47aa00, e=@0xbfffdefc) at /Users/eseidel/Projects/WebKit/WebCore/dom/EventTargetNode.cpp:420
#31 0x0387dd5e in WebCore::EventTargetNode::dispatchWindowEvent (this=0x1e47aa00, eventType=@0x4a0be78, canBubbleArg=false, cancelableArg=false) at /Users/eseidel/Projects/WebKit/WebCore/dom/EventTargetNode.cpp:427
#32 0x038143f3 in WebCore::Document::implicitClose (this=0x1e47aa00) at /Users/eseidel/Projects/WebKit/WebCore/dom/Document.cpp:1589
#33 0x038bb19a in WebCore::FrameLoader::checkCallImplicitClose (this=0x70ac824) at /Users/eseidel/Projects/WebKit/WebCore/loader/FrameLoader.cpp:1353
#34 0x038c7646 in WebCore::FrameLoader::checkCompleted (this=0x70ac824) at /Users/eseidel/Projects/WebKit/WebCore/loader/FrameLoader.cpp:1305
#35 0x038c775b in WebCore::FrameLoader::tokenizerProcessedData (this=0x70ac824) at /Users/eseidel/Projects/WebKit/WebCore/loader/FrameLoader.cpp:3354
#36 0x0395998d in WebCore::HTMLTokenizer::stopParsing (this=0x1e4d7800) at /Users/eseidel/Projects/WebKit/WebCore/html/HTMLTokenizer.cpp:1808
#37 0x038ca28d in WebCore::FrameLoader::stopLoading (this=0x70ac824, sendUnload=true) at /Users/eseidel/Projects/WebKit/WebCore/loader/FrameLoader.cpp:587
#38 0x038caa54 in WebCore::FrameLoader::closeURL (this=0x70ac824) at /Users/eseidel/Projects/WebKit/WebCore/loader/FrameLoader.cpp:670
#39 0x038ccdbc in WebCore::FrameLoader::transitionToCommitted (this=0x70ac824, cachedPage=@0xbfffe188) at /Users/eseidel/Projects/WebKit/WebCore/loader/FrameLoader.cpp:2761
#40 0x038cd3e2 in WebCore::FrameLoader::commitProvisionalLoad (this=0x70ac824, prpCachedPage=@0xbfffe1bc) at /Users/eseidel/Projects/WebKit/WebCore/loader/FrameLoader.cpp:2719
#41 0x03842ef6 in WebCore::DocumentLoader::commitIfReady (this=0x7422800) at /Users/eseidel/Projects/WebKit/WebCore/loader/DocumentLoader.cpp:333
#42 0x03842f27 in WebCore::DocumentLoader::commitLoad (this=0x7422800, data=0x1e6e7220 "<!DOCTYPE HTML>\n<title>Canvas tests - report generator</title>\n<link rel=\"stylesheet\" href=\"../reportgen.css\">\n<script src=\"../reportgen.js\"></script>\n<p>This is mainly for my own use, so it is not de"..., length=11644) at /Users/eseidel/Projects/WebKit/WebCore/loader/DocumentLoader.cpp:353
#43 0x03843168 in WebCore::DocumentLoader::receivedData (this=0x7422800, data=0x1e6e7220 "<!DOCTYPE HTML>\n<title>Canvas tests - report generator</title>\n<link rel=\"stylesheet\" href=\"../reportgen.css\">\n<script src=\"../reportgen.js\"></script>\n<p>This is mainly for my own use, so it is not de"..., length=11644) at /Users/eseidel/Projects/WebKit/WebCore/loader/DocumentLoader.cpp:367
#44 0x038bba85 in WebCore::FrameLoader::receivedData (this=0x70ac824, data=0x1e6e7220 "<!DOCTYPE HTML>\n<title>Canvas tests - report generator</title>\n<link rel=\"stylesheet\" href=\"../reportgen.css\">\n<script src=\"../reportgen.js\"></script>\n<p>This is mainly for my own use, so it is not de"..., length=11644) at /Users/eseidel/Projects/WebKit/WebCore/loader/FrameLoader.cpp:2342
#45 0x03acc3f4 in WebCore::MainResourceLoader::addData (this=0x76b9000, data=0x1e6e7220 "<!DOCTYPE HTML>\n<title>Canvas tests - report generator</title>\n<link rel=\"stylesheet\" href=\"../reportgen.css\">\n<script src=\"../reportgen.js\"></script>\n<p>This is mainly for my own use, so it is not de"..., length=11644, allAtOnce=false) at /Users/eseidel/Projects/WebKit/WebCore/loader/MainResourceLoader.cpp:145
#46 0x03be59a7 in WebCore::ResourceLoader::didReceiveData (this=0x76b9000, data=0x1e6e7220 "<!DOCTYPE HTML>\n<title>Canvas tests - report generator</title>\n<link rel=\"stylesheet\" href=\"../reportgen.css\">\n<script src=\"../reportgen.js\"></script>\n<p>This is mainly for my own use, so it is not de"..., length=11644, lengthReceived=11644, allAtOnce=false) at /Users/eseidel/Projects/WebKit/WebCore/loader/ResourceLoader.cpp:251
#47 0x03acc510 in WebCore::MainResourceLoader::didReceiveData (this=0x76b9000, data=0x1e6e7220 "<!DOCTYPE HTML>\n<title>Canvas tests - report generator</title>\n<link rel=\"stylesheet\" href=\"../reportgen.css\">\n<script src=\"../reportgen.js\"></script>\n<p>This is mainly for my own use, so it is not de"..., length=11644, lengthReceived=11644, allAtOnce=false) at /Users/eseidel/Projects/WebKit/WebCore/loader/MainResourceLoader.cpp:305
#48 0x03be568c in WebCore::ResourceLoader::didReceiveData (this=0x76b9000, data=0x1e6e7220 "<!DOCTYPE HTML>\n<title>Canvas tests - report generator</title>\n<link rel=\"stylesheet\" href=\"../reportgen.css\">\n<script src=\"../reportgen.js\"></script>\n<p>This is mainly for my own use, so it is not de"..., length=11644, lengthReceived=11644) at /Users/eseidel/Projects/WebKit/WebCore/loader/ResourceLoader.cpp:393
#49 0x03be2b3f in -[WebCoreResourceHandleAsDelegate connection:didReceiveData:lengthReceived:] (self=0x21cb8770, _cmd=0x9706e2cc, con=0x21cb91e0, data=0x1e6e7200, lengthReceived=11644) at /Users/eseidel/Projects/WebKit/WebCore/platform/network/mac/ResourceHandleMac.mm:510
#50 0x91209ac7 in -[NSURLConnection(NSURLConnectionReallyInternal) sendDidReceiveData:originalLength:] ()
#51 0x91209a11 in _NSURLConnectionDidReceiveData ()
#52 0x934cebfd in sendDidReceiveDataCallback ()
#53 0x934cbfb2 in _CFURLConnectionSendCallbacks ()
#54 0x934cba25 in muxerSourcePerform ()
#55 0x9619b615 in CFRunLoopRunSpecific ()
#56 0x9619bcf8 in CFRunLoopRunInMode ()
#57 0x93c61480 in RunCurrentEventLoopInMode ()
#58 0x93c61299 in ReceiveNextEventCommon ()
#59 0x93c6110d in BlockUntilNextEventMatchingListInMode ()
#60 0x9277d3ed in _DPSNextEvent ()
#61 0x9277cca0 in -[NSApplication nextEventMatchingMask:untilDate:inMode:dequeue:] ()
#62 0x000086be in ?? ()
#63 0x92775cdb in -[NSApplication run] ()
#64 0x92742f14 in NSApplicationMain ()
#65 0x000ba4d6 in ?? ()

[Ryosuke Niwa]

This bug seems to now appear on DumpRenderTree.  Hits ASSERT(!m_frame->document()->inPageCache()) when I try to go back from one of html files listed on result.html after running run-webkit-tests.