CRASH: com.apple.WebCore: WebCore::DOMWindowExtension::disconnectFrame + 31 1 com.apple.WebCore 0x10eae409f WebCore::DOMWindowExtension::disconnectFrame() + 0x1f 2 com.apple.WebCore 0x10eae31ea WebCore::DOMWindow::disconnectDOMWindowProperties() + 0xfa 3 com.apple.WebCore 0x10eae2a82 WebCore::DOMWindow::clearDOMWindowProperties() + 0x12 4 com.apple.WebCore 0x10eae2687 WebCore::DOMWindow::~DOMWindow() + 0x27 5 com.apple.WebCore 0x10e49fa21 WebCore::DOMWindow::~DOMWindow() + 0x11 6 com.apple.WebCore 0x10ec96864 WebCore::JSDOMWindowBase::~JSDOMWindowBase() + 0x34 7 com.apple.JavaScriptCore 0x10e25615e JSC::MarkedBlock::FreeList JSC::MarkedBlock::sweepHelper<true>(JSC::MarkedBlock::SweepMode) + 0x18e 8 com.apple.JavaScriptCore 0x10e255f84 JSC::MarkedBlock::sweep(JSC::MarkedBlock::SweepMode) + 0x24 9 com.apple.JavaScriptCore 0x10e2017cb JSC::Heap::sweep() + 0xcb 10 com.apple.JavaScriptCore 0x10e201915 JSC::Heap::collect(JSC::Heap::SweepToggle) + 0xf5 11 com.apple.JavaScriptCore 0x10e20080d JSC::DefaultGCActivityCallbackPlatformData::timerDidFire(__CFRunLoopTimer*, void*) + 0x9d <rdar://problem/11353945> DOMWindow calls disconnectFrame on all its DOMWindowProperties, even in cases where it previously called disconnectFrame when going into the page cache. DOMWindowExtension should bail early if it already has a disconnected frame, since it has already notified any client the first time disconnectFrame was invoked.
Created attachment 139657 [details] Patch
Comment on attachment 139657 [details] Patch View in context: https://bugs.webkit.org/attachment.cgi?id=139657&action=review Is there a way to create a regression test for this? > Source/WebCore/page/DOMWindowExtension.cpp:60 > + ASSERT(!this->frame()); No need for this-> here.
(In reply to comment #2) > (From update of attachment 139657 [details]) > View in context: https://bugs.webkit.org/attachment.cgi?id=139657&action=review > > Is there a way to create a regression test for this? The only way I was able to reproduce this was to keep navigating to pages that were page-cache-worthy until the JSC timer was fired. I am not sure what else would reliably trigger the DOMWindow destruction after it had already gone into the the page cache without first detaching the page. > > > Source/WebCore/page/DOMWindowExtension.cpp:60 > > + ASSERT(!this->frame()); > > No need for this-> here. Fixed. Thanks for the review!
Comment on attachment 139657 [details] Patch Committed in http://trac.webkit.org/changeset/115746