Bug 24133 – Crash when loading GMail and stop loading

• Component: Page Loading
• Status: RESOLVED FIXED

[Adam Treat]

Loading up Gmail.com and then canceling the load while it is still loading results in a crash and ASSERT:

ASSERTION FAILED: docLoader->requestCount() == 0
(../../../../WebCore/loader/loader.cpp:178 void WebCore::Loader::cancelRequests(WebCore::DocLoader*))

Patch forthcoming.

[Adam Treat]

Created attachment 27933 [details]
Fixes crash

I'm trying to come up with reproducible test, but if not this is the fix.

[Alexey Proskuryakov]

This is exactly the kind of fix that really needs automated tests.

We have some examples of slow loading e.g. in http/tests/incremental

[Adam Treat]

I've been working on a test all morning.  In fact, I did all of this precisely to try and generate a layout test:

http://trac.webkit.org/changeset/41211

However, now that the Qt port can do such a slow loading tests, I haven't been able to come up with one that causes the crash.  Here's why:

The theory behind the crash is that if the user stops the loading while the preloader is active, then this results in a crash.

However, with a layout test I can not automate this stoppage of loading since I'd have to be able to do it via JavaScript.  Well, no JavaScript is executed in this preloading stage.  That's the whole point of the preloader actually.  While a script is loading the preloader goes ahead and continues tokenizing and initiates the network loading of other resources, but it does not allow to execute scripts out of order.  Thus, while a script is loading and the tokenizer is thus blocked, I can not programmatically stop the load via JavaScript.

I don't know how to get around this.

[Alexey Proskuryakov]

Could preloading be stopped with JS running in a different frame?

[Adam Treat]

Created attachment 28022 [details]
New version that includes a layout test

I've added a layout test that crashes reproducibly and reliably without this patch.

[Adam Treat]

Created attachment 28029 [details]
New version crashes more reliably

[Darin Adler]

Comment on attachment 28029 [details]
New version crashes more reliably

Too bad we have to add another function to DocLoader! Good fix, though, and great to have a high quality test for it.

r=me

[Alexey Proskuryakov]

Comment on attachment 28029 [details]
New version crashes more reliably

> +        * http/tests/misc/slow-preload-cancel-expected.txt: Added.
> +        * http/tests/misc/slow-preload-cancel.html: Added.

Please fix the ChangeLog to mention new files.

> +</script>
> \ No newline at end of file

Please add one.

[Adam Treat]

Fixed with r41265.