Bug 49116

Summary: Need to check if page is detached in Frame::transferChildFrameToNewDocument to avoid occasional crash
Product: WebKit Reporter: Jian Li <jianli>
Component: WebCore JavaScriptAssignee: Jian Li <jianli>
Status: RESOLVED FIXED    
Severity: Normal CC: abarth, commit-queue, dimich, levin
Priority: P2    
Version: 528+ (Nightly build)   
Hardware: PC   
OS: All   
Attachments:
Description Flags
Proposed Patch none

Jian Li
Reported 2010-11-05 17:19:20 PDT
We see some occasional crash happening in Frame::transferChildFrameToNewDocument when we try to transfer the frame and close the document at the same time.
Attachments
Proposed Patch (1.34 KB, patch)
2010-11-05 17:24 PDT, Jian Li 		no flags
DetailsFormatted DiffDiff
View All Add attachment proposed patch, testcase, etc.
Jian Li
Comment 1 2010-11-05 17:24:09 PDT
Created attachment 73148 [details] Proposed Patch
Dmitry Titov
Comment 2 2010-11-05 17:28:01 PDT
Comment on attachment 73148 [details] Proposed Patch I guess there is no way to test it from layout test... We don't even have a repro case for it, only crash stack. Anyways, the check looks reasonable. r=me
WebKit Commit Bot
Comment 3 2010-11-05 17:42:42 PDT
Comment on attachment 73148 [details] Proposed Patch Clearing flags on attachment: 73148 Committed r71460: <http://trac.webkit.org/changeset/71460>
WebKit Commit Bot
Comment 4 2010-11-05 17:42:47 PDT
All reviewed patches have been landed. Closing bug.
Adam Barth
Comment 5 2010-11-05 17:44:10 PDT
Why can't you test it? A +-B +-C +-D In A, grab B's document and then detach frame B from the DOM. Now, grab C and try to adopt it as a child of D.
Note You need to log in before you can comment on or make changes to this bug.