We're seeing many crash reports for bug 52819 in HistoryController::itemsAreClones. The crashes happen when fromItem in recursiveSetProvisionalItem is null, which happens if the parent HistoryItem does not have a child item with the target frame name.
The crash reports suggest that fromItem has 0 children, which should be impossible. (The previous call to itemsAreClones should verify that fromItem and item have the same number of children, and item clearly has children.) On the flip side, it's possible for the crash to happen if fromItem has ended up with two children of the same name, though the crash reports don't seen to be consistent with that.
This bug is for adding a sanity check to help diagnose which (if either) of these is happening in practice, since we don't have any information about how to reproduce the crash yet.
Created attachment 80599 [details]
Comment on attachment 80599 [details]
Clearing flags on attachment: 80599
Committed r77210: <http://trac.webkit.org/changeset/77210>
All reviewed patches have been landed. Closing bug.