editing/selection/selection-invalid-offset.html has been crashing with the following stack trace intermittently. http://build.webkit.org/results/Apple%20MountainLion%20Release%20WK1%20(Tests)/r144874%20(7586)/results.html Application Specific Information: CRASHING TEST: editing/selection/selection-in-iframe-removed-crash.html Thread 0 Crashed:: Dispatch queue: com.apple.main-thread 0 com.apple.WebCore 0x00000001103ee057 WebCore::FrameLoader::dispatchDidCommitLoad() + 135 (RefPtr.h:58) 1 com.apple.WebCore 0x00000001103eddc5 WebCore::FrameLoader::receivedFirstData() + 21 (FrameLoader.cpp:602) 2 com.apple.WebCore 0x000000011025ccef WebCore::DocumentLoader::commitData(char const*, unsigned long) + 239 (RefPtr.h:43) 3 com.apple.WebKit 0x000000010fda9bf4 -[WebHTMLRepresentation receivedData:withDataSource:] + 100 (WebHTMLRepresentation.mm:186) 4 com.apple.WebKit 0x000000010fd7cded -[WebDataSource(WebInternal) _receivedData:] + 77 (WebDataSource.mm:216) 5 com.apple.WebKit 0x000000010fd94c47 WebFrameLoaderClient::committedLoad(WebCore::DocumentLoader*, char const*, int) + 103 (WebFrameLoaderClient.mm:848) 6 com.apple.WebCore 0x000000011025cea0 WebCore::DocumentLoader::commitLoad(char const*, int) + 144 (RefCounted.h:148) 7 com.apple.WebCore 0x000000011097d5b3 WebCore::MainResourceLoader::dataReceived(WebCore::CachedResource*, char const*, int) + 819 (MainResourceLoader.cpp:529) 8 com.apple.WebCore 0x000000011097c729 WebCore::MainResourceLoader::continueAfterContentPolicy(WebCore::PolicyAction, WebCore::ResourceResponse const&) + 1257 (RefPtr.h:64) 9 com.apple.WebCore 0x000000011097d0c5 WebCore::MainResourceLoader::responseReceived(WebCore::CachedResource*, WebCore::ResourceResponse const&) + 1749 (RefCounted.h:148) 10 com.apple.WebCore 0x000000011097b516 WebCore::MainResourceLoader::handleSubstituteDataLoadNow(WebCore::RunLoopTimer<WebCore::MainResourceLoader>*) + 710 (RetainPtr.h:84) 11 com.apple.WebCore 0x0000000110bc1818 WebCore::timerFired(__CFRunLoopTimer*, void*) + 40 (RunLoopTimerCF.cpp:52) 12 com.apple.CoreFoundation 0x00007fff92ac7da4 __CFRUNLOOP_IS_CALLING_OUT_TO_A_TIMER_CALLBACK_FUNCTION__ + 20 13 com.apple.CoreFoundation 0x00007fff92ac78bd __CFRunLoopDoTimer + 557 14 com.apple.CoreFoundation 0x00007fff92aad099 __CFRunLoopRun + 1513 15 com.apple.CoreFoundation 0x00007fff92aac6b2 CFRunLoopRunSpecific + 290 16 com.apple.Foundation 0x00007fff87a8089e -[NSRunLoop(NSRunLoop) runMode:beforeDate:] + 268 17 DumpRenderTree 0x000000010f641122 runTest(std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> > const&) + 1639 (DumpRenderTree.mm:1375) 18 DumpRenderTree 0x000000010f6408b6 dumpRenderTree(int, char const**) + 1727 (DumpRenderTree.mm:832) 19 DumpRenderTree 0x000000010f64148b main + 86 (DumpRenderTree.mm:925) 20 libdyld.dylib 0x00007fff895837e1 start + 1
Any idea when this could start? Is this reproducible manually in browser?
(In reply to comment #1) > Any idea when this could start? Is this reproducible manually in browser? I think it's caused by http://trac.webkit.org/changeset/144400. Note that even though NRWT thinks selection-invalid-offset.html is crashing, the crash log indicates that editing/selection/selection-in-iframe-removed-crash.html is the one crashing.
Also see https://bugs.webkit.org/show_bug.cgi?id=111451. editing/selection/selection-in-iframe-removed-crash.html is hitting an assertion.
I'm having no luck reproducing this locally. I've tried release and debug, running just editing/selection/selection-in-iframe-removed-crash.html and editing/selection/selection-invalid-offset.html with a lot of iterations as well as the whole suite of tests, over and over again.
In a debug build, an assertion failure occurs: Thread 0 Crashed:: Dispatch queue: com.apple.main-thread 0 com.apple.WebCore 0x0000000109426f6c WTF::RefPtr<WebCore::Frame>::get() const + 12 (RefPtr.h:58) 1 com.apple.WebCore 0x0000000109558e6c WebCore::Page::mainFrame() const + 28 (Page.h:156) 2 com.apple.WebCore 0x0000000109ba13a2 WebCore::FrameLoader::dispatchDidCommitLoad() + 194 (FrameLoader.cpp:3292) 3 com.apple.WebCore 0x0000000109ba10bc WebCore::FrameLoader::receivedFirstData() + 28 (FrameLoader.cpp:602) 4 com.apple.WebCore 0x00000001098ba8a2 WebCore::DocumentLoader::commitData(char const*, unsigned long) + 210 (DocumentLoader.cpp:362)
*** Bug 112220 has been marked as a duplicate of this bug. ***
Updated the test expectation per https://bugs.webkit.org/show_bug.cgi?id=112220: http://trac.webkit.org/changeset/145671
Still happens, just got this crash today.
This is a pretty bad bug, which could be a root cause of certain common crashers. <rdar://problem/15159351>
Created attachment 232895 [details] proposed fix Let's see what EWS thinks, I'm not entirely sure what's the right way to check for cancellation here.
Comment on attachment 232895 [details] proposed fix Clearing flags on attachment: 232895 Committed r169866: <http://trac.webkit.org/changeset/169866>
All reviewed patches have been landed. Closing bug.