Bug 99267 – ASSERTION FAILED: !childItemWithTarget(child->target()) : void WebCore::HistoryItem::addChildItem(PassRefPtr<WebCore::HistoryItem>)

• Component: History
• Status: RESOLVED WORKSFORME

[Dimitris Apostolou]

Created attachment 168581 [details]
Crash log.

r131199

Reproducibility: once

Pre-steps:
Have a Live account.

Steps:
1. Go to http://www.outlook.com/
2. Click on the cogwheel on the top right to open context menu -> More mail settings

What happened:
2. Assert failure.

ASSERTION FAILED: !childItemWithTarget(child->target())
/Users/rex/WebKit/Source/WebCore/history/HistoryItem.cpp(463) : void WebCore::HistoryItem::addChildItem(PassRefPtr<WebCore::HistoryItem>)
1   0x10c5fe194 WebCore::HistoryItem::addChildItem(WTF::PassRefPtr<WebCore::HistoryItem>)
2   0x10c5fbcb9 WebCore::HistoryController::createItemTree(WebCore::Frame*, bool)
3   0x10c5f9041 WebCore::HistoryController::updateBackForwardListClippedAtTarget(bool)
4   0x10c5f8efa WebCore::HistoryController::updateBackForwardListForFragmentScroll()
5   0x10c532919 WebCore::FrameLoader::loadInSameDocument(WebCore::KURL const&, WebCore::SerializedScriptValue*, bool)
6   0x10c539cf6 WebCore::FrameLoader::continueFragmentScrollAfterNavigationPolicy(WebCore::ResourceRequest const&, bool)
7   0x10c533c94 WebCore::FrameLoader::callContinueFragmentScrollAfterNavigationPolicy(void*, WebCore::ResourceRequest const&, WTF::PassRefPtr<WebCore::FormState>, bool)
8   0x10cff6b4c WebCore::PolicyCallback::call(bool)
9   0x10cff774c WebCore::PolicyChecker::continueAfterNavigationPolicy(WebCore::PolicyAction)
10  0x10a0f309d WebKit::WebFrame::didReceivePolicyDecision(unsigned long long, WebCore::PolicyAction, unsigned long long)
11  0x10a0fa393 WebKit::WebFrameLoaderClient::dispatchDecidePolicyForNavigationAction(void (WebCore::PolicyChecker::*)(WebCore::PolicyAction), WebCore::NavigationAction const&, WebCore::ResourceRequest const&, WTF::PassRefPtr<WebCore::FormState>)
12  0x10cff746c WebCore::PolicyChecker::checkNavigationPolicy(WebCore::ResourceRequest const&, WebCore::DocumentLoader*, WTF::PassRefPtr<WebCore::FormState>, void (*)(void*, WebCore::ResourceRequest const&, WTF::PassRefPtr<WebCore::FormState>, bool), void*)
13  0x10c531905 WebCore::FrameLoader::loadURL(WebCore::KURL const&, WTF::String const&, WTF::String const&, bool, WebCore::FrameLoadType, WTF::PassRefPtr<WebCore::Event>, WTF::PassRefPtr<WebCore::FormState>)
14  0x10c52de01 WebCore::FrameLoader::loadFrameRequest(WebCore::FrameLoadRequest const&, bool, bool, WTF::PassRefPtr<WebCore::Event>, WTF::PassRefPtr<WebCore::FormState>, WebCore::ShouldSendReferrer)
15  0x10c52d61e WebCore::FrameLoader::urlSelected(WebCore::FrameLoadRequest const&, WTF::PassRefPtr<WebCore::Event>, bool, bool, WebCore::ShouldSendReferrer, WebCore::ShouldReplaceDocumentIfJavaScriptURL)
16  0x10c52d308 WebCore::FrameLoader::changeLocation(WebCore::SecurityOrigin*, WebCore::KURL const&, WTF::String const&, bool, bool, bool)
17  0x10cf3e4d2 WebCore::NavigationScheduler::scheduleLocationChange(WebCore::SecurityOrigin*, WTF::String const&, WTF::String const&, bool, bool)
18  0x10c3cc5a9 WebCore::DOMWindow::setLocation(WTF::String const&, WebCore::DOMWindow*, WebCore::DOMWindow*, WebCore::SetLocationLocking)
19  0x10ceace6a WebCore::Location::setLocation(WTF::String const&, WebCore::DOMWindow*, WebCore::DOMWindow*)
20  0x10cead3ad WebCore::Location::setHash(WTF::String const&, WebCore::DOMWindow*, WebCore::DOMWindow*)
21  0x10cb76aad WebCore::JSLocation::setHash(JSC::ExecState*, JSC::JSValue)
22  0x10cb743f5 WebCore::setJSLocationHash(JSC::ExecState*, JSC::JSObject*, JSC::JSValue)
23  0x10cb75729 bool JSC::lookupPut<WebCore::JSLocation>(JSC::ExecState*, JSC::PropertyName, JSC::JSValue, JSC::HashTable const*, WebCore::JSLocation*, bool)
24  0x10cb75308 void JSC::lookupPut<WebCore::JSLocation, WebCore::JSDOMWrapper>(JSC::ExecState*, JSC::PropertyName, JSC::JSValue, JSC::HashTable const*, WebCore::JSLocation*, JSC::PutPropertySlot&)
25  0x10cb73542 WebCore::JSLocation::put(JSC::JSCell*, JSC::ExecState*, JSC::PropertyName, JSC::JSValue, JSC::PutPropertySlot&)
26  0x10b0e98e9 JSC::JSValue::put(JSC::ExecState*, JSC::PropertyName, JSC::JSValue, JSC::PutPropertySlot&)
27  0x10b380590 llint_slow_path_put_by_id
28  0x10b389662 llint_op_put_by_id
29  0x10b195294 JSC::JITCode::execute(JSC::JSStack*, JSC::ExecState*, JSC::JSGlobalData*)
30  0x10b1916df JSC::Interpreter::execute(JSC::ProgramExecutable*, JSC::ExecState*, JSC::JSObject*)
31  0x10b06a9f3 JSC::evaluate(JSC::ExecState*, JSC::SourceCode const&, JSC::JSValue, JSC::JSValue*)

Expected result:
2. No assert failure.

[Brent Fulgham]

I cannot reproduce this problem on any current Safari or WebKit variant. If you are able to reproduce, please reopen the bug with relevant steps to reproduce the problem.