Bug 190320 – Regression(r236862): Crash under DOMWindowExtension::willDetachGlobalObjectFromFrame()

• Status: RESOLVED
• Resolution: FIXED
• Component: DOM

[Chris Dumez]

Crash under DOMWindowExtension::willDetachGlobalObjectFromFrame() since r236862:
Thread 0 Crashed:: Dispatch queue: com.apple.main-thread
0   com.apple.JavaScriptCore      	0x00000004110a95e0 WTFCrash + 16 (Assertions.cpp:255)
1   com.apple.WebCore             	0x000000040000de8b WTFCrashWithInfo(int, char const*, char const*, int) + 27
2   com.apple.WebCore             	0x00000004029e78e0 WebCore::DOMWindowExtension::willDetachGlobalObjectFromFrame() + 208 (DOMWindowExtension.cpp:104)
3   com.apple.WebCore             	0x00000004029dc1a3 WebCore::DOMWindow::willDetachDocumentFromFrame() + 131 (DOMWindow.cpp:510)
4   com.apple.WebCore             	0x00000004020294c1 WebCore::Document::detachFromFrame() + 49
5   com.apple.WebCore             	0x000000040202a093 WebCore::Document::prepareForDestruction() + 1539 (Document.cpp:2501)
6   com.apple.WebCore             	0x0000000402a3a560 WebCore::Frame::setView(WTF::RefPtr<WebCore::FrameView, WTF::DumbPtrTraits<WebCore::FrameView> >&&) + 192 (Frame.cpp:242)
7   com.apple.WebCore             	0x0000000402a3e80b WebCore::Frame::createView(WebCore::IntSize const&, WebCore::Color const&, bool, WebCore::IntSize const&, WebCore::IntRect const&, bool, WebCore::ScrollbarMode, bool, WebCore::ScrollbarMode, bool) + 299 (Frame.cpp:913)
8   com.apple.WebKit              	0x00000001104191ca WebKit::WebFrameLoaderClient::transitionToCommittedForNewPage() + 842 (WebFrameLoaderClient.cpp:1430)
9   com.apple.WebCore             	0x000000040287f4b8 WebCore::FrameLoader::transitionToCommitted(WebCore::CachedPage*) + 1160 (FrameLoader.cpp:2131)
10  com.apple.WebCore             	0x000000040287e550 WebCore::FrameLoader::commitProvisionalLoad() + 2128 (FrameLoader.cpp:1957)
11  com.apple.WebCore             	0x0000000402817bcc WebCore::DocumentLoader::commitIfReady() + 60 (DocumentLoader.cpp:359)
12  com.apple.WebCore             	0x000000040281e04c WebCore::DocumentLoader::commitLoad(char const*, int) + 76 (DocumentLoader.cpp:965)
13  com.apple.WebCore             	0x000000040281dff5 WebCore::DocumentLoader::dataReceived(char const*, int) + 613 (DocumentLoader.cpp:1114)
14  com.apple.WebCore             	0x000000040281e866 WebCore::DocumentLoader::dataReceived(WebCore::CachedResource&, char const*, int) + 150 (DocumentLoader.cpp:1087)

[Chris Dumez]

<rdar://problem/45044814>

[Chris Dumez]

Created attachment 351693 [details]
WIP Patch (needs tests)

[Chris Dumez]

Created attachment 351697 [details]
Patch

[Geoffrey Garen]

Comment on attachment 351697 [details]
Patch

r=me

legacy-animation-engine/fast/css-generated-content/noscript-pseudo-anim-crash.html doesn't have frames, so the failure seems unrelated.

[Chris Dumez]

Comment on attachment 351697 [details]
Patch

Clearing flags on attachment: 351697

Committed r236888: <https://trac.webkit.org/changeset/236888>

[Chris Dumez]

All reviewed patches have been landed.  Closing bug.