Failed assertion on GtkLauncher close

[Anatoly Borodin]

Closing GtkLauncher produces a failed assertion message (almost every time, on different sites including acid3.acidtests.org).

The tail of the debug log:

UNIMPLEMENTED:
(WebKit/gtk/WebCoreSupport/FrameLoaderClientGtk.cpp:416 virtual void WebKit::FrameLoaderClient::saveViewStateToItem(WebCore::HistoryItem*))
UNIMPLEMENTED:
(WebKit/gtk/WebCoreSupport/FrameLoaderClientGtk.cpp:454 virtual void WebKit::FrameLoaderClient::detachedFromParent2())
UNIMPLEMENTED:
(WebKit/gtk/WebCoreSupport/FrameLoaderClientGtk.cpp:459 virtual void WebKit::FrameLoaderClient::detachedFromParent3())
ASSERTION FAILED: !m_singlePageGroup
(WebCore/page/Page.cpp:243 void WebCore::Page::initGroup())

From gdb:

#0  0x345f7937 in WebCore::Page::initGroup (this=0x8135180) at WebCore/page/Page.cpp:243
#1  0x342a77e7 in WebCore::Page::group (this=0x8135180) at Page.h:98
#2  0x342a3e24 in WebCore::ScriptController::clearWindowShell (this=0x811babc) at WebCore/bindings/js/ScriptController.cpp:137
#3  0x345e0b1f in WebCore::Frame::pageDestroyed (this=0x81c2c50) at WebCore/page/Frame.cpp:1637
#4  0x345f7dd5 in ~Page (this=0x8135180) at WebCore/page/Page.cpp:159
#5  0x342465c5 in webkit_web_view_finalize (object=0x8118830) at WebKit/gtk/webkit/webkitwebview.cpp:762

PS It's actually FreeBSD 7, commit 96c6f2a97164b1d2f86239943b456783e4ae9bfe, GTK/X11.

[Anatoly Borodin]

With a help of git-bisect I've found that the problem appears in the commit 57022614462c74b67cb573ba78f0065e4ea3773e:

--- a/WebCore/page/Frame.cpp
+++ b/WebCore/page/Frame.cpp
@@ -1618,6 +1618,8 @@ void Frame::pageDestroyed()
     if (page() && page()->focusController()->focusedFrame() == this)
         page()->focusController()->setFocusedFrame(0);

+    script()->clearWindowShell();
+
     // This will stop any JS timers
     if (script()->haveWindowShell())
         script()->windowShell()->disconnectFrame();

[Jan Alonzo]

This bug was fixed in http://trac.webkit.org/changeset/41037. Closing..