Bug 31998

Summary: REGRESSION (r49564): Crash in updateGlobalHistory when running Javascript iBench test
Product: WebKit Reporter: Adam Roben (:aroben) <aroben>
Component: WebKit Misc.Assignee: Nobody <webkit-unassigned>
Severity: Normal CC: abarth
Priority: P2 Keywords: InRadar
Version: 528+ (Nightly build)   
Hardware: Other   
OS: Windows XP   
Description Flags
Patch none

Description Adam Roben (:aroben) 2009-11-30 13:32:22 PST
Created attachment 44039 [details]

Looks like there's a double-delete of the BSTRs here. updateGlobalHistory creates WebCore::BStrings and passes them to WebNavigationData::createInstance, which tries to adopt the BSTRs that the BStrings wrap. But the BStrings haven't given up ownership!
Comment 1 Adam Roben (:aroben) 2009-11-30 13:33:58 PST
Comment 2 Adam Barth 2009-11-30 13:37:03 PST
style-queue ran check-webkit-style on attachment 44039 [details] without any errors.
Comment 3 Adam Roben (:aroben) 2009-11-30 13:41:46 PST
Committed r51510: <http://trac.webkit.org/changeset/51510>
Comment 4 Eric Seidel (no email) 2009-11-30 21:42:39 PST
Comment on attachment 44039 [details]

Clearing r? on a committed patch.