Bug 81184 – ASSERTION FAILED: m_loadState == LoadStateCommitted in WebFrameProxy::didFinishLoad causing "crashes" on Lion Intel Debug WebKit2 Tests

• Status: RESOLVED
• Resolution: FIXED
• Component: Page Loading

[Jessie Berlin]

Do not be fooled by the URL. NRWT does not do a good job of associating crashes with the tests that crashed. I can reproduce this locally via:

run-webkit-tests -2 LayoutTests/fast/loader/reload-zero-byte-plugin.html

Unfortunately, due to the number of crashers we have in the tests right now, it is not easy to figure out when this regressed.

void WebFrameProxy::didFinishLoad()
{
    ASSERT(m_loadState == LoadStateCommitted);
    ASSERT(m_provisionalURL.isEmpty());
    m_loadState = LoadStateFinished;
}

http://build.webkit.org/results/Lion%20Intel%20Debug%20(WebKit2%20Tests)/r110783%20(4924)/fast/frames/iframe-reparenting-crash-log.txt

Process:         WebKitTestRunner [80501]
Path:            /Volumes/VOLUME/*/WebKitTestRunner
Identifier:      WebKitTestRunner
Version:         ??? (???)
Code Type:       X86-64 (Native)
Parent Process:  Python [80081]

Date/Time:       2012-03-14 17:17:10.996 -0700
OS Version:      Mac OS X 10.7.2 (11C74)
Report Version:  9

Crashed Thread:  0  Dispatch queue: com.apple.main-thread

Exception Type:  EXC_BAD_ACCESS (SIGSEGV)
Exception Codes: KERN_INVALID_ADDRESS at 0x00000000bbadbeef

VM Regions Near 0xbbadbeef:
--> 
    __TEXT                 0000000108d56000-0000000108d6c000 [   88K] r-x/rwx SM=COW  /Volumes/VOLUME/*

Application Specific Information:
objc[80501]: garbage collection is OFF

Thread 0 Crashed:: Dispatch queue: com.apple.main-thread
0   com.apple.WebKit2             	0x0000000108f7eaa0 WebKit::WebFrameProxy::didFinishLoad() + 96 (WebFrameProxy.cpp:176)
1   com.apple.WebKit2             	0x00000001090067ac WebKit::WebPageProxy::didFinishLoadForFrame(unsigned long long, CoreIPC::ArgumentDecoder*) + 316 (WebPageProxy.cpp:1859)
2   com.apple.WebKit2             	0x000000010905e272 void CoreIPC::callMemberFunction<WebKit::WebPageProxy, void (WebKit::WebPageProxy::*)(unsigned long long, CoreIPC::ArgumentDecoder*), unsigned long long>(CoreIPC::Arguments1<unsigned long long> const&, CoreIPC::ArgumentDecoder*, WebKit::WebPageProxy*, void (WebKit::WebPageProxy::*)(unsigned long long, CoreIPC::ArgumentDecoder*)) + 146 (HandleMessage.h:230)
3   com.apple.WebKit2             	0x000000010904fca7 void CoreIPC::handleMessageVariadic<Messages::WebPageProxy::DidFinishLoadForFrame, WebKit::WebPageProxy, void (WebKit::WebPageProxy::*)(unsigned long long, CoreIPC::ArgumentDecoder*)>(CoreIPC::ArgumentDecoder*, WebKit::WebPageProxy*, void (WebKit::WebPageProxy::*)(unsigned long long, CoreIPC::ArgumentDecoder*)) + 119 (HandleMessage.h:327)
4   com.apple.WebKit2             	0x000000010904c22c WebKit::WebPageProxy::didReceiveWebPageProxyMessage(CoreIPC::Connection*, CoreIPC::MessageID, CoreIPC::ArgumentDecoder*) + 2716 (WebPageProxyMessageReceiver.cpp:243)
5   com.apple.WebKit2             	0x0000000109004abf WebKit::WebPageProxy::didReceiveMessage(CoreIPC::Connection*, CoreIPC::MessageID, CoreIPC::ArgumentDecoder*) + 271 (WebPageProxy.cpp:1614)
6   com.apple.WebKit2             	0x000000010909fbd6 WebKit::WebProcessProxy::didReceiveMessage(CoreIPC::Connection*, CoreIPC::MessageID, CoreIPC::ArgumentDecoder*) + 438 (WebProcessProxy.cpp:332)
7   com.apple.WebKit2             	0x0000000108f1a485 WebKit::WebConnectionToWebProcess::didReceiveMessage(CoreIPC::Connection*, CoreIPC::MessageID, CoreIPC::ArgumentDecoder*) + 405 (WebConnectionToWebProcess.cpp:93)
8   com.apple.WebKit2             	0x0000000108f1a4cd non-virtual thunk to WebKit::WebConnectionToWebProcess::didReceiveMessage(CoreIPC::Connection*, CoreIPC::MessageID, CoreIPC::ArgumentDecoder*) + 61
9   com.apple.WebKit2             	0x0000000108db5fec CoreIPC::Connection::dispatchMessage(CoreIPC::Connection::Message<CoreIPC::ArgumentDecoder>&) + 428 (Connection.cpp:692)
10  com.apple.WebKit2             	0x0000000108db8b43 CoreIPC::Connection::dispatchMessages() + 211 (Connection.cpp:720)
11  com.apple.WebKit2             	0x0000000108dbfc50 WTF::FunctionWrapper<void (CoreIPC::Connection::*)()>::operator()(CoreIPC::Connection*) + 112 (Functional.h:173)
12  com.apple.WebKit2             	0x0000000108dbfbd5 WTF::BoundFunctionImpl<WTF::FunctionWrapper<void (CoreIPC::Connection::*)()>, void ()(CoreIPC::Connection*)>::operator()() + 53 (Functional.h:373)
13  com.apple.WebCore             	0x000000010c40d60d WTF::Function<void ()()>::operator()() const + 141 (Functional.h:581)
14  com.apple.WebCore             	0x000000010c40d393 WebCore::RunLoop::performWork() + 147 (RunLoop.cpp:66)
15  com.apple.WebCore             	0x000000010c40e7b0 WebCore::RunLoop::performWork(void*) + 96 (RunLoopMac.mm:65)
16  com.apple.CoreFoundation      	0x00007fff875e2b51 __CFRUNLOOP_IS_CALLING_OUT_TO_A_SOURCE0_PERFORM_FUNCTION__ + 17
17  com.apple.CoreFoundation      	0x00007fff875e23bd __CFRunLoopDoSources0 + 253
18  com.apple.CoreFoundation      	0x00007fff876091a9 __CFRunLoopRun + 905
19  com.apple.CoreFoundation      	0x00007fff87608ae6 CFRunLoopRunSpecific + 230
20  com.apple.Foundation          	0x00007fff80f4e04f -[NSRunLoop(NSRunLoop) runMode:beforeDate:] + 267
21  WebKitTestRunner              	0x0000000108d60ddc WTR::TestController::platformRunUntil(bool&, double) + 204 (TestControllerMac.mm:60)
22  WebKitTestRunner              	0x0000000108d5c6f5 WTR::TestController::runUntil(bool&, WTR::TestController::TimeoutDuration) + 149 (TestController.cpp:563)
23  WebKitTestRunner              	0x0000000108d61b64 WTR::TestInvocation::invoke() + 1396 (TestInvocation.cpp:171)
24  WebKitTestRunner              	0x0000000108d5cd78 WTR::TestController::runTest(char const*) + 1656 (TestController.cpp:513)
25  WebKitTestRunner              	0x0000000108d5ce82 WTR::TestController::runTestingServerLoop() + 178 (TestController.cpp:529)
26  WebKitTestRunner              	0x0000000108d5b500 WTR::TestController::run() + 48 (TestController.cpp:537)
27  WebKitTestRunner              	0x0000000108d5a1c6 WTR::TestController::TestController(int, char const**) + 614 (TestController.cpp:88)
28  WebKitTestRunner              	0x0000000108d59f53 WTR::TestController::TestController(int, char const**) + 35 (TestController.cpp:89)
29  WebKitTestRunner              	0x0000000108d57eaf main + 143 (main.mm:36)
30  WebKitTestRunner              	0x0000000108d57e14 start + 52

[Radar WebKit Bug Importer]

<rdar://problem/11052462>

[Alexey Proskuryakov]

Fixed in <http://trac.webkit.org/changeset/111059>.

This certainly had release mode consequences, although I didn't take the time to investigate how symptoms would look like.