[Webkit-unassigned] [Bug 24258] New: Crash when closing page

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=24258

           Summary: Crash when closing page
           Product: WebKit
           Version: 528+ (Nightly build)
          Platform: PC
               URL: http://www.playtr.com/news/latest_news/tabula_rasa_shutd
                    own_events.html
        OS/Version: Linux
            Status: NEW
          Severity: Normal
          Priority: P2
         Component: Page Loading
        AssignedTo: webkit-unassigned at lists.webkit.org
        ReportedBy: xan.lopez at gmail.com


I'm getting the following crash (hitting an ASSERT, I'm using a debug build)
every time I close this page:
http://www.playtr.com/news/latest_news/tabula_rasa_shutdown_events.html

My first impression is that this is not necessarily GTK-only, so I'm opening a
general bug.

Program received signal SIGSEGV, Segmentation fault.
[Switching to Thread 0xb4969700 (LWP 30952)]
0xb6ab99a3 in WebCore::Page::changePendingUnloadEventCount (this=0x0, delta=-2)
    at ../../WebCore/page/Page.cpp:571
571         ASSERT( (delta + (int)m_pendingUnloadEventCount) >= 0 );
Current language:  auto; currently c++
(gdb) bt
#0  0xb6ab99a3 in WebCore::Page::changePendingUnloadEventCount (this=0x0,
delta=-2)
    at ../../WebCore/page/Page.cpp:571
#1  0xb6a92129 in WebCore::EventHandler::clearPendingFrameUnloadEventCount
(this=0xac66238)
    at ../../WebCore/page/EventHandler.cpp:2265
#2  0xb6a3d53f in WebCore::FrameLoader::stopLoading (this=0xac65de4,
sendUnload=true)
    at ../../WebCore/loader/FrameLoader.cpp:598
#3  0xb6a3d92e in WebCore::FrameLoader::closeURL (this=0xac65de4)
    at ../../WebCore/loader/FrameLoader.cpp:659
#4  0xb6a3e2cf in WebCore::FrameLoader::cancelAndClear (this=0xac65de4)
    at ../../WebCore/loader/FrameLoader.cpp:800
#5  0xb6aa3e41 in ~Frame (this=0xac65db8) at ../../WebCore/page/Frame.cpp:173
#6  0xb66ed8df in WTF::RefCounted<WebCore::Frame>::deref (this=0xac65db8)
    at ../../JavaScriptCore/wtf/RefCounted.h:91
#7  0xb66ed90f in ~RefPtr (this=0xaff2e24) at
../../JavaScriptCore/wtf/RefPtr.h:50
#8  0xb69e80d7 in ~InspectorResource (this=0xaff2e10) at
../../WebCore/inspector/InspectorController.cpp:292
#9  0xb69e8125 in WTF::RefCounted<WebCore::InspectorResource>::deref
(this=0xaff2e10)
    at ../../JavaScriptCore/wtf/RefCounted.h:91
#10 0xb69e8155 in ~RefPtr (this=0xa1d6264) at
../../JavaScriptCore/wtf/RefPtr.h:50
#11 0xb69d2705 in ~InspectorController (this=0xa1d6250)
    at ../../WebCore/inspector/InspectorController.cpp:1219
#12 0xb6abc354 in WTF::deleteOwnedPtr<WebCore::InspectorController>
(ptr=0xa1d6250)
    at ../../JavaScriptCore/wtf/OwnPtr.h:49
#13 0xb6abc375 in ~OwnPtr (this=0xaf8b078) at
../../JavaScriptCore/wtf/OwnPtr.h:68
#14 0xb6abb423 in ~Page (this=0xaf8b060) at ../../WebCore/page/Page.cpp:176
#15 0xb67043f0 in webkit_web_view_dispose (object=0xadd28c8)
    at ../../WebKit/gtk/webkit/webkitwebview.cpp:833
#16 0xb4db872f in IA__g_object_run_dispose (object=0xadd28c8) at gobject.c:789
#17 0xb564ae32 in IA__gtk_object_destroy (object=0xadd28c8) at gtkobject.c:406
#18 0xb554298a in gtk_bin_forall (container=0xadccc18, include_internals=0, 
    callback=0xb5760190 <IA__gtk_widget_destroy>, callback_data=0x0) at
gtkbin.c:128
#19 0xb568e7d4 in gtk_scrolled_window_forall (container=0xadccc18,
include_internals=0, 
    callback=0xb5760190 <IA__gtk_widget_destroy>, callback_data=0x0) at
gtkscrolledwindow.c:1079
#20 0xb5580f86 in IA__gtk_container_foreach (container=0xadccc18, 
    callback=0xb5760190 <IA__gtk_widget_destroy>, callback_data=0x0) at
gtkcontainer.c:1526
#21 0xb5582bbf in gtk_container_destroy (object=0xadccc18) at
gtkcontainer.c:1066
#22 0xb5690875 in gtk_scrolled_window_destroy (object=0xadccc18) at
gtkscrolledwindow.c:868


-- 
Configure bugmail: https://bugs.webkit.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.