Bug 31998 - REGRESSION (r49564): Crash in updateGlobalHistory when running Javascript iBench test
Summary: REGRESSION (r49564): Crash in updateGlobalHistory when running Javascript iBe...
Alias: None
Product: WebKit
Classification: Unclassified
Component: WebKit Misc. (show other bugs)
Version: 528+ (Nightly build)
Hardware: Other Windows XP
: P2 Normal
Assignee: Nobody
Keywords: InRadar
Depends on:
Reported: 2009-11-30 13:32 PST by Adam Roben (:aroben)
Modified: 2009-11-30 21:42 PST (History)
1 user (show)

See Also:

Patch (5.75 KB, patch)
2009-11-30 13:32 PST, Adam Roben (:aroben)
no flags Details | Formatted Diff | Diff

Note You need to log in before you can comment on or make changes to this bug.
Description Adam Roben (:aroben) 2009-11-30 13:32:22 PST
Created attachment 44039 [details]

Looks like there's a double-delete of the BSTRs here. updateGlobalHistory creates WebCore::BStrings and passes them to WebNavigationData::createInstance, which tries to adopt the BSTRs that the BStrings wrap. But the BStrings haven't given up ownership!
Comment 1 Adam Roben (:aroben) 2009-11-30 13:33:58 PST
Comment 2 Adam Barth 2009-11-30 13:37:03 PST
style-queue ran check-webkit-style on attachment 44039 [details] without any errors.
Comment 3 Adam Roben (:aroben) 2009-11-30 13:41:46 PST
Committed r51510: <http://trac.webkit.org/changeset/51510>
Comment 4 Eric Seidel (no email) 2009-11-30 21:42:39 PST
Comment on attachment 44039 [details]

Clearing r? on a committed patch.