Bug 70827 – REGRESSION(97821): HistoryController::itemsAreClones crashes a lot

• Component: History
• Status: RESOLVED FIXED

[Adam Barth]

Anders,

I'm told your change http://trac.webkit.org/changeset/97821 created a top crasher:

Product: Chrome
Stack Signature: WebCore::HistoryController::itemsAreClones(WebCore::HistoryItem *,WebCore::HistoryItem *)-41C257A
New Signature Label: WebCore::HistoryController::itemsAreClones(WebCore::HistoryItem *,WebCore::HistoryItem *)
New Signature Hash: f4054a06_1839c36f_6d8bbae7_b1081798_cfda059a

Report link: http://go/crash/reportdetail?reportid=a45fb4601b0a005c

Meta information:
Product Name: Chrome
Product Version: 17.0.917.0
Report ID: a45fb4601b0a005c
Report Time: 2011/10/24 19:50:28, Mon
Uptime: 2557 sec
Cumulative Uptime: 0 sec
OS Name: Windows NT
OS Version: 6.1.7600 
CPU Architecture: x86
CPU Info: GenuineIntel family 6 model 22 stepping 1
ptype: renderer


Thread 0 *CRASHED* ( EXCEPTION_ACCESS_VIOLATION_READ @ 0x00000078 )

0x61af732e	 [chrome.dll	 - historycontroller.cpp:744	WebCore::HistoryController::itemsAreClones(WebCore::HistoryItem *,WebCore::HistoryItem *)
0x61af6c42	 [chrome.dll	 - historycontroller.cpp:475	WebCore::HistoryController::recursiveUpdateForCommit()
0x61af6cae	 [chrome.dll	 - historycontroller.cpp:498	WebCore::HistoryController::recursiveUpdateForCommit()
0x61af6cae	 [chrome.dll	 - historycontroller.cpp:498	WebCore::HistoryController::recursiveUpdateForCommit()
0x61af6cae	 [chrome.dll	 - historycontroller.cpp:498	WebCore::HistoryController::recursiveUpdateForCommit()
0x61af6cae	 [chrome.dll	 - historycontroller.cpp:498	WebCore::HistoryController::recursiveUpdateForCommit()
0x61b2bc8b	 [chrome.dll	 - frameloader.cpp:1839	WebCore::FrameLoader::transitionToCommitted(WTF::PassRefPtr<WebCore::CachedPage>)
0x61b2ba07	 [chrome.dll	 - frameloader.cpp:1761	WebCore::FrameLoader::commitProvisionalLoad()
0x61b2f819	 [chrome.dll	 - documentloader.cpp:274	WebCore::DocumentLoader::commitIfReady()
0x61b2f85b	 [chrome.dll	 - documentloader.cpp:295	WebCore::DocumentLoader::commitLoad(char const *,int)
0x61d4f1c8	 [chrome.dll	 - mainresourceloader.cpp:168	WebCore::MainResourceLoader::addData(char const *,int,bool)
0x61d70bc3	 [chrome.dll	 - resourceloader.cpp:287	WebCore::ResourceLoader::didReceiveData(char const *,int,__int64,bool)
0x61d4fa92	 [chrome.dll	 - mainresourceloader.cpp:467	WebCore::MainResourceLoader::didReceiveData(char const *,int,__int64,bool)
0x61d70f45	 [chrome.dll	 - resourceloader.cpp:441	WebCore::ResourceLoader::didReceiveData(WebCore::ResourceHandle *,char const *,int,int)
0x6157b4f9	 [chrome.dll	 - resourcehandle.cpp:140	WebCore::ResourceHandleInternal::didReceiveData(WebKit::WebURLLoader *,char const *,int,int)
0x6134cd1d	 [chrome.dll	 - weburlloader_impl.cc:584	webkit_glue::WebURLLoaderImpl::Context::OnReceivedData(char const *,int,int)
0x60de1771	 [chrome.dll	 - resource_dispatcher.cc:375	ResourceDispatcher::OnReceivedData(IPC::Message const &,int,void *,int,int)
0x60de1d13	 [chrome.dll	 - resource_dispatcher.cc:523	ResourceDispatcher::DispatchMessageW(IPC::Message const &)
0x60de1584	 [chrome.dll	 - resource_dispatcher.cc:302	ResourceDispatcher::OnMessageReceived(IPC::Message const &)
0x60de04c3	 [chrome.dll	 - child_thread.cc:169	ChildThread::OnMessageReceived(IPC::Message const &)
0x61837b68	 [chrome.dll	 - task.h:374	RunnableMethod<notifier::MediatorThreadImpl::Core,void ( notifier::MediatorThreadImpl::Core::*)(std::vector<notifier::Subscription,std::allocator<notifier::Subscription> > const &),Tuple1<std::vector<notifier::Subscription,std::allocator<notifier::Subscription> > > >::Run()
0x60efc5f6	 [chrome.dll	 - task.cc:71	base::subtle::TaskClosureAdapter::Run()
0x60ef5057	 [chrome.dll	 - message_loop.cc:495	MessageLoop::RunTask(MessageLoop::PendingTask const &)
0x60ef50d3	 [chrome.dll	 - message_loop.cc:508	MessageLoop::DeferOrRunPendingTask(MessageLoop::PendingTask const &)
0x60ef5459	 [chrome.dll	 - message_loop.cc:698	MessageLoop::DoWork()
0x60f0e57c	 [chrome.dll	 - message_pump_default.cc:50	base::MessagePumpDefault::Run(base::MessagePump::Delegate *)
0x60ef4f81	 [chrome.dll	 - message_loop.cc:453	MessageLoop::RunInternal()
0x60ef4f06	 [chrome.dll	 - message_loop.cc:426	MessageLoop::RunHandler()
0x60ef4e89	 [chrome.dll	 - message_loop.cc:341	MessageLoop::Run()
0x6135ad70	 [chrome.dll	 - renderer_main.cc:228	RendererMain(MainFunctionParams const &)
0x60f1740e	 [chrome.dll	 - content_main.cc:252	`anonymous namespace'::RunNamedProcessTypeMain(std::basic_string<char,std::char_traits<char>,std::allocator<char> > const &,MainFunctionParams const &,content::ContentMainDelegate *)
0x60f177a4	 [chrome.dll	 - content_main.cc:442	content::ContentMain(HINSTANCE__ *,sandbox::SandboxInterfaceInfo *,content::ContentMainDelegate *)
0x60dd4c63	 [chrome.dll	 - chrome_main.cc:28	ChromeMain
0x010b1e16	 [chrome.exe	 - client_util.cc:346	MainDllLoader::Launch(HINSTANCE__ *,sandbox::SandboxInterfaceInfo *)
0x010b10c8	 [chrome.exe	 - chrome_exe_main_win.cc:36	wWinMain
0x0110a017	 [chrome.exe	 - crt0.c:263	__tmainCRTStartup
0x76231113	 [kernel32.dll	 + 0x00051113]	BaseThreadInitThunk
0x77a6b428	 [ntdll.dll	 + 0x0005b428]	__RtlUserThreadStart
0x77a6b3fb	 [ntdll.dll	 + 0x0005b3fb]	_RtlUserThreadStart

See http://code.google.com/p/chromium/issues/detail?id=101411.

[Radar WebKit Bug Importer]

<rdar://problem/10342925>

[Anders Carlsson]

Created attachment 112393 [details]
Patch

[Anders Carlsson]

Committed r98389: <http://trac.webkit.org/changeset/98389>