Bug 110724 – REGRESSION(r143797): Causes assertion failures in multiple tests. (Requested by vsevik on #webkit).

• Status: RESOLVED
• Resolution: FIXED
• Component: New Bugs

[WebKit Review Bot]

http://trac.webkit.org/changeset/143797 broke the build:
Causes assertion failures in multiple tests. (Requested by vsevik on #webkit).

This is an automatic bug report generated by the sheriff-bot. If this bug
report was created because of a flaky test, please file a bug for the flaky
test (if we don't already have one on file) and dup this bug against that bug
so that we can track how often these flaky tests case pain.

"Only you can prevent forest fires." -- Smokey the Bear

[WebKit Review Bot]

Created attachment 189998 [details]
ROLLOUT of r143797

Any committer can land this patch automatically by marking it commit-queue+.  The commit-queue will build and test the patch before landing to ensure that the rollout will be successful.  This process takes approximately 15 minutes.

If you would like to land the rollout faster, you can use the following command:

  webkit-patch land-attachment ATTACHMENT_ID

where ATTACHMENT_ID is the ID of this attachment.

[Vsevolod Vlasov]

The following layout tests are crashing on assertion on chromium

fast/dom (6 tests)
fast/loader (4 tests)
http/tests/security/javascriptURL (14 tests)
fast/events/frame-programmatic-focus.html
fast/frames/javascript-url-as-framesrc-crash.html
fast/frames/take-focus-from-iframe.html
fast/frames/set-parent-src-synchronously.xhtml
fast/parser/iframe-sets-parent-to-javascript-url.html
fast/parser/javascript-url-compat-mode.html
http/tests/inspector/network/network-iframe-load-and-delete.html
http/tests/misc/javascript-url-stop-loaders.html
http/tests/security/xss-DENIED-synchronous-frame-load-in-javascript-url.html
http/tests/security/aboutBlank/xss-DENIED-navigate-opener-javascript-url.html
http/tests/security/aboutBlank/window-open-self-about-blank.html
http/tests/security/cookies/cookie-theft-with-javascript-doc.html
http/tests/security/postMessage/javascript-page-still-sends-origin.html
http/tests/security/xssAuditor/non-block-javascript-url-frame.html
svg/as-object/svg-embedded-in-html-in-iframe.html

Crash log:

crash log for DumpRenderTree (pid 26899):
STDOUT: <empty>
STDERR: ASSERTION FAILED: !m_tokenizer
STDERR: ../../third_party/WebKit/Source/WebCore/html/parser/HTMLDocumentParser.cpp(135) : virtual void WebCore::HTMLDocumentParser::pinToMainThread()
STDERR: 1   0x7ff2888134f0
STDERR: 2   0x7ff2884ce25e
STDERR: 3   0x7ff287fffac0
STDERR: 4   0x7ff2885130a7
STDERR: 5   0x7ff288729d30
STDERR: 6   0x7ff28872a65c
STDERR: 7   0x7ff288729e7c
STDERR: 8   0x7ff28872de7d
STDERR: 9   0x7ff287794a47
STDERR: 10  0x7ff28783f5a5
STDERR: 11  0x7ff28779b3ab
STDERR: 12  0x7ff287798655
STDERR: 13  0x7ff2877a0c8a
STDERR: 14  0x7ff28779480e
STDERR: 15  0x7ff288c4230f
STDERR: 16  0x7ff28d816894
STDERR: 17  0x7ff28d81aae3
STDERR: 18  0x7ff28d81870a
STDERR: 19  0x7ff28d816479
STDERR: 20  0x7ff28d794503
STDERR: 21  0x7ff28d7966ea
STDERR: 22  0x10efa32062ee
STDERR: Received signal 11 SEGV_MAPERR 0000bbadbeef
STDERR:  [0x7ff28c029280] base::debug::StackTrace::StackTrace()
STDERR:  [0x7ff28c028b2a] base::debug::(anonymous namespace)::StackDumpSignalHandler()
STDERR:  [0x7ff280f5b8f0] <unknown>
STDERR:  [0x7ff2888134fa] WebCore::HTMLDocumentParser::pinToMainThread()
STDERR:  [0x7ff2884ce25e] WebCore::DocumentWriter::replaceDocument()
STDERR:  [0x7ff287fffac0] WebCore::ScriptController::executeIfJavaScriptURL()
STDERR:  [0x7ff2885130a7] WebCore::SubframeLoader::requestFrame()
STDERR:  [0x7ff288729d30] WebCore::HTMLFrameElementBase::openURL()
STDERR:  [0x7ff28872a65c] WebCore::HTMLFrameElementBase::setLocation()
STDERR:  [0x7ff288729e7c] WebCore::HTMLFrameElementBase::parseAttribute()
STDERR:  [0x7ff28872de7d] WebCore::HTMLIFrameElement::parseAttribute()
STDERR:  [0x7ff287794a47] WebCore::Element::attributeChanged()
STDERR:  [0x7ff28783f5a5] WebCore::StyledElement::attributeChanged()
STDERR:  [0x7ff28779b3ab] WebCore::Element::didAddAttribute()
STDERR:  [0x7ff287798655] WebCore::Element::addAttributeInternal()
STDERR:  [0x7ff2877a0c8a] WebCore::Element::setAttributeInternal()
STDERR:  [0x7ff28779480e] WebCore::Element::setAttribute()
STDERR:  [0x7ff288c4230f] WebCore::HTMLIFrameElementV8Internal::srcAttrSetter()
STDERR:  [0x7ff28d816894] v8::internal::JSObject::SetPropertyWithCallback()
STDERR:  [0x7ff28d81aae3] v8::internal::JSObject::SetPropertyForResult()
STDERR:  [0x7ff28d81870a] v8::internal::JSReceiver::SetProperty()
STDERR:  [0x7ff28d816479] v8::internal::JSReceiver::SetProperty()
STDERR:  [0x7ff28d794503] v8::internal::StoreIC::Store()
STDERR:  [0x7ff28d7966ea] v8::internal::StoreIC_Miss()
STDERR:  [0x10efa32062ee] <unknown>
STDERR:   r8: 00007ff27a9867e0  r9: 00007ff288fb7d3e r10: 0000000000000001 r11: 0000000000000000
STDERR:  r12: 00003dd0b258cb18 r13: 00003dd0b258cb20 r14: 0000000000000000 r15: 0000000000000000
STDERR:   di: 0000000000000000  si: 00000000efcdab90  bp: 00007fff11aae0d0  bx: 00003dd0b251d2a0
STDERR:   dx: 00007ff280f47e00  ax: 00000000bbadbeef  cx: 00007ff280ca1acd  sp: 00007fff11aae090
STDERR:   ip: 00007ff2888134fa efl: 0000000000010246 cgf: 0000000000000033 erf: 0000000000000006
STDERR:  trp: 000000000000000e msk: 0000000000000000 cr2: 00000000bbadbeef

[WebKit Review Bot]

Comment on attachment 189998 [details]
ROLLOUT of r143797

Clearing flags on attachment: 189998

Committed r143886: <http://trac.webkit.org/changeset/143886>

[WebKit Review Bot]

All reviewed patches have been landed.  Closing bug.