I've started to see this on pages with video and svg: ASSERTION FAILED: frame().view() == this /Volumes/SSData/Development/OSX/webkit/OpenSource/Source/WebCore/page/FrameView.cpp(2422) : void WebCore::FrameView::scheduleRelayoutOfSubtree(WebCore::RenderObject *) 1 0x102b1aaf0 WTFCrash 2 0x103f629e9 WebCore::FrameView::scheduleRelayoutOfSubtree(WebCore::RenderObject*) 3 0x104c59af5 WebCore::RenderObject::scheduleRelayout() 4 0x104c59636 WebCore::RenderObject::markContainingBlocksForLayout(bool, WebCore::RenderObject*) 5 0x1039d3219 WebCore::RenderObject::setNeedsLayout(bool, WebCore::MarkingBehavior) 6 0x104ca7575 WebCore::RenderSVGResource::markForLayoutAndParentResourceInvalidation(WebCore::RenderObject*, bool) 7 0x104cace20 WebCore::RenderSVGResourceContainer::markAllClientsForInvalidation(WebCore::RenderSVGResourceContainer::InvalidationMode) 8 0x104cafd0c WebCore::RenderSVGResourceFilter::removeAllClientsFromCache(bool) 9 0x104cafd4c non-virtual thunk to WebCore::RenderSVGResourceFilter::removeAllClientsFromCache(bool) 10 0x104ca75fe WebCore::RenderSVGResource::markForLayoutAndParentResourceInvalidation(WebCore::RenderObject*, bool) 11 0x104ca1d34 WebCore::SVGResourcesCache::clientWillBeRemovedFromTree(WebCore::RenderObject*) 12 0x104ca1ce1 WebCore::RenderSVGContainer::removeChild(WebCore::RenderObject*) 13 0x104baa0b6 WebCore::RenderObject::remove() 14 0x104c6727d WebCore::RenderObject::willBeDestroyed() 15 0x104caa39b WebCore::RenderSVGModelObject::willBeDestroyed() 16 0x104c67b1d WebCore::RenderObject::destroy() 17 0x104c67a16 WebCore::RenderObject::destroyAndCleanupAnonymousWrappers() 18 0x1039d0d85 WebCore::Style::detachRenderTree(WebCore::Element&, WebCore::Style::DetachType) 19 0x1039d0f30 WebCore::Style::detachChildren(WebCore::ContainerNode&, WebCore::Style::DetachType) 20 0x1039d0d59 WebCore::Style::detachRenderTree(WebCore::Element&, WebCore::Style::DetachType) 21 0x1039d0f30 WebCore::Style::detachChildren(WebCore::ContainerNode&, WebCore::Style::DetachType) 22 0x1039d0d59 WebCore::Style::detachRenderTree(WebCore::Element&, WebCore::Style::DetachType) 23 0x1039d0f30 WebCore::Style::detachChildren(WebCore::ContainerNode&, WebCore::Style::DetachType) 24 0x1039d0d59 WebCore::Style::detachRenderTree(WebCore::Element&, WebCore::Style::DetachType) 25 0x1039d0f30 WebCore::Style::detachChildren(WebCore::ContainerNode&, WebCore::Style::DetachType) 26 0x1039d0d59 WebCore::Style::detachRenderTree(WebCore::Element&, WebCore::Style::DetachType) 27 0x1039d0f30 WebCore::Style::detachChildren(WebCore::ContainerNode&, WebCore::Style::DetachType) 28 0x1039d0d59 WebCore::Style::detachRenderTree(WebCore::Element&, WebCore::Style::DetachType) 29 0x1039d0f30 WebCore::Style::detachChildren(WebCore::ContainerNode&, WebCore::Style::DetachType) 30 0x1039d0d59 WebCore::Style::detachRenderTree(WebCore::Element&, WebCore::Style::DetachType) 31 0x1039d0f30 WebCore::Style::detachChildren(WebCore::ContainerNode&, WebCore::Style::DetachType) Steps: 1. Load http://ie.microsoft.com/testdrive/graphics/hands-on-css3/hands-on_svg-filter-effects.htm 2. Click Animations link in bottom right 3. Close window. asserts.
This is down under CachedPage::destroy().
Sweet catch! Looks like we're scheduling a relayout unnecessarily during page teardown.
This regressed in <http://trac.webkit.org/154546> when making RenderObject::view() return a reference. RenderSVGResourceContainer was checking for a null RenderView to see if tree teardown was in progress.
Sorry, <http://trac.webkit.org/r154546>
Created attachment 210399 [details] Quickfix
There's a video teardown equivalent for this bug too. I guess destroying a page i the page cache with video.
Comment on attachment 210399 [details] Quickfix Clearing flags on attachment: 210399 Committed r155018: <http://trac.webkit.org/changeset/155018>
All reviewed patches have been landed. Closing bug.