Bug 35081 – fast/frames/iframe-reparenting.html crashing on GTK Debug bots

• Status: RESOLVED
• Resolution: FIXED
• Component: WebKitGTK

[Philippe Normand]

ASSERTION FAILED: !m_deletionHasBegun
(../../JavaScriptCore/wtf/RefCounted.h:36 void WTF::RefCountedBase::ref())

Program received signal SIGSEGV, Segmentation fault.
0x00007ffff5e61fce in WTF::RefCountedBase::ref (this=0x7fffffffbf78)
    at ../../JavaScriptCore/wtf/RefCounted.h:36
36	        ASSERT(!m_deletionHasBegun);
(gdb) bt
#0  0x00007ffff5e61fce in WTF::RefCountedBase::ref (this=0x7fffffffbf78)
    at ../../JavaScriptCore/wtf/RefCounted.h:36
#1  0x00007ffff624dc3c in WTF::refIfNotNull<WebCore::ResourceLoader> (ptr=0x7fffffffbf70)
    at ../../JavaScriptCore/wtf/PassRefPtr.h:43
#2  0x00007ffff624c737 in RefPtr (this=0x7fffffffbc50, ptr=0x7fffffffbf70)
    at ../../JavaScriptCore/wtf/RefPtr.h:41
#3  0x00007ffff673b142 in parseDataUrl (callback_data=0x7fffffffbfa0)
    at ../../WebCore/platform/network/soup/ResourceHandleSoup.cpp:364
#4  0x00007ffff1e5cee0 in g_main_dispatch (context=0x683860) at gmain.c:1960
#5  IA__g_main_context_dispatch (context=0x683860) at gmain.c:2513
#6  0x00007ffff1e60d18 in g_main_context_iterate (context=0x683860, block=<value optimized out>, 
    dispatch=<value optimized out>, self=<value optimized out>) at gmain.c:2591
#7  0x00007ffff1e6125d in IA__g_main_loop_run (loop=0xd73b10) at gmain.c:2799
#8  0x00007ffff6739e53 in WebCore::WebCoreSynchronousLoader::run (this=0x7fffffffbf70)
    at ../../WebCore/platform/network/soup/ResourceHandleSoup.cpp:120
#9  0x00007ffff673c669 in WebCore::ResourceHandle::loadResourceSynchronously (request=..., error=..., 
    response=..., data=..., frame=0x6f4100) at ../../WebCore/platform/network/soup/ResourceHandleSoup.cpp:674
#10 0x00007ffff626cb4a in WebCore::FrameLoader::loadResourceSynchronously (this=0x6f4150, request=..., 
    storedCredentials=WebCore::AllowStoredCredentials, error=..., response=..., data=...)
    at ../../WebCore/loader/FrameLoader.cpp:3358
#11 0x00007ffff625415e in WebCore::DocumentThreadableLoader::loadRequest (this=0xdfd790, request=..., 
    securityCheck=WebCore::DoSecurityCheck) at ../../WebCore/loader/DocumentThreadableLoader.cpp:314
#12 0x00007ffff6252887 in DocumentThreadableLoader (this=0xdfd790, document=0x6b8b40, client=0xdf5730, 
    blockingBehavior=WebCore::DocumentThreadableLoader::LoadSynchronously, request=..., options=...)
    at ../../WebCore/loader/DocumentThreadableLoader.cpp:73
#13 0x00007ffff625216c in WebCore::DocumentThreadableLoader::loadResourceSynchronously (document=0x6b8b40, 
    request=..., client=..., options=...) at ../../WebCore/loader/DocumentThreadableLoader.cpp:50
#14 0x00007ffff628f4e5 in WebCore::ThreadableLoader::loadResourceSynchronously (context=0x6b8b98, request=..., 
    client=..., options=...) at ../../WebCore/loader/ThreadableLoader.cpp:69
#15 0x00007ffff6504718 in WebCore::XMLHttpRequest::createRequest (this=0xdf5720, ec=@0x7fffffffc8dc)
    at ../../WebCore/xml/XMLHttpRequest.cpp:521
#16 0x00007ffff6503f65 in WebCore::XMLHttpRequest::send (this=0xdf5720, body=..., ec=@0x7fffffffc8dc)
    at ../../WebCore/xml/XMLHttpRequest.cpp:435
#17 0x00007ffff6503a31 in WebCore::XMLHttpRequest::send (this=0xdf5720, ec=@0x7fffffffc8dc)
    at ../../WebCore/xml/XMLHttpRequest.cpp:378
#18 0x00007ffff5ef0c44 in WebCore::JSXMLHttpRequest::send (this=0x7fffe81d52c0, exec=0x7fffe82340b0, args=...)
    at ../../WebCore/bindings/js/JSXMLHttpRequestCustom.cpp:109
#19 0x00007ffff6a63327 in WebCore::jsXMLHttpRequestPrototypeFunctionSend (exec=0x7fffe82340b0, thisValue=..., 
    args=...) at DerivedSources/JSXMLHttpRequest.cpp:382
#20 0x00007ffff7e0c1b4 in ?? ()
#21 0x00007fffe8234068 in ?? ()
#22 0x0000000000000001 in ?? ()
#23 0x00007fffffffc9a0 in ?? ()
#24 0x00007fffe81d5380 in ?? ()
#25 0x00007ffff7e0a0cb in ?? ()
#26 0x00007fff00000002 in ?? ()
#27 0x00007fffe81d5280 in ?? ()
#28 0x0000000000000004 in ?? ()
#29 0x00007fffffffc9c0 in ?? ()
#30 0x00007ffff684cc4d in WTF::Vector<JSC::Instruction, 0ul>::clear (this=0x7ffff7ddebf0)
    at ../../JavaScriptCore/wtf/Vector.h:545
#31 0x00007ffff683170c in JSC::JITCode::execute (this=0xd49c88, registerFile=0x75e4b8, 
    callFrame=0x7fffe8234048, globalData=0x75b420, exception=0x75c6f0) at ../../JavaScriptCore/jit/JITCode.h:79
#32 0x00007ffff6823cd9 in JSC::Interpreter::execute (this=0x75e4a0, functionExecutable=0xd49c70, 
    callFrame=0xd84088, function=0x7fffe81c2f00, thisObj=0x7fffe81cf040, args=..., scopeChain=0xd49cf0, 
    exception=0x75c6f0) at ../../JavaScriptCore/interpreter/Interpreter.cpp:686
#33 0x00007ffff68f772f in JSC::JSFunction::call (this=0x7fffe81c2f00, exec=0xd84088, thisValue=..., args=...)
    at ../../JavaScriptCore/runtime/JSFunction.cpp:122
#34 0x00007ffff68d85b7 in JSC::call (exec=0xd84088, functionObject=..., callType=JSC::CallTypeJS, 
    callData=..., thisValue=..., args=...) at ../../JavaScriptCore/runtime/CallData.cpp:39
#35 0x00007ffff5ef8827 in WebCore::ScheduledAction::executeFunctionInContext (this=0xdd23c0, 
    globalObject=0x7fffe81cf0c0, thisValue=...) at ../../WebCore/bindings/js/ScheduledAction.cpp:106
#36 0x00007ffff5ef89b5 in WebCore::ScheduledAction::execute (this=0xdd23c0, document=0xdd8ea0)
    at ../../WebCore/bindings/js/ScheduledAction.cpp:126
---Type <return> to continue, or q <return> to quit---
#37 0x00007ffff5ef8608 in WebCore::ScheduledAction::execute (this=0xdd23c0, context=0xdd8ef8)
    at ../../WebCore/bindings/js/ScheduledAction.cpp:77
#38 0x00007ffff62abf24 in WebCore::DOMTimer::fired (this=0xddc3a0) at ../../WebCore/page/DOMTimer.cpp:149
#39 0x00007ffff63517b8 in WebCore::ThreadTimers::sharedTimerFiredInternal (this=0x653500)
    at ../../WebCore/platform/ThreadTimers.cpp:112
#40 0x00007ffff63516eb in WebCore::ThreadTimers::sharedTimerFired ()
    at ../../WebCore/platform/ThreadTimers.cpp:90
#41 0x00007ffff6720e3e in timeout_cb () at ../../WebCore/platform/gtk/SharedTimerGtk.cpp:48
#42 0x00007ffff1e5cee0 in g_main_dispatch (context=0xffff000000000002) at gmain.c:1960
#43 IA__g_main_context_dispatch (context=0xffff000000000002) at gmain.c:2513
#44 0x00007ffff1e60d18 in g_main_context_iterate (context=0x683860, block=<value optimized out>, 
    dispatch=<value optimized out>, self=<value optimized out>) at gmain.c:2591
#45 0x00007ffff1e6125d in IA__g_main_loop_run (loop=0x6fb900) at gmain.c:2799
#46 0x00007ffff3d3b287 in IA__gtk_main () at gtkmain.c:1219
#47 0x0000000000412d30 in runTest (testPathOrURL=...)
    at ../../WebKitTools/DumpRenderTree/gtk/DumpRenderTree.cpp:503
#48 0x0000000000414023 in main (argc=2, argv=0x7fffffffdb08)
    at ../../WebKitTools/DumpRenderTree/gtk/DumpRenderTree.cpp:869

[Gustavo Noronha (kov)]

Created attachment 48998 [details]
simpler fix for the data URL download crash, that also fixes this

[Gustavo Noronha (kov)]

Landed as r54955, after getting it reviewed by xan on IRC.

[Adam Roben (:aroben)]

Comment on attachment 48998 [details]
simpler fix for the data URL download crash, that also fixes this

Clearing review flag, since this has been landed.