[Webkit-unassigned] [Bug 89467] [WK2] ASSERTION FAILED: m_loadState == LoadStateProvisional at fast/loader/document-with-fragment-url-1.html

Thu Jun 28 02:23:07 PDT 2012

https://bugs.webkit.org/show_bug.cgi?id=89467

Balazs Kelemen <kbalazs at webkit.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |abarth at webkit.org,
                   |                            |jocelyn.turcotte at nokia.com

--- Comment #6 from Balazs Kelemen <kbalazs at webkit.org>  2012-06-28 02:23:06 PST ---
I tried to catch the order of load events in WebFrameProxy. I signed where I think the problem is.

0x7f6115d08f00 -- didStartProvisionalLoad: url=about:blank
0x7f6115d08f00 -- didCommitLoad: url=about:blank
0x7f6115d08f00 -- didFinishLoad: url=about:blank
0x7f6115d08f00 -- didStartProvisionalLoad: url=fast/loader/document-destruction-within-unload.html
0x7f6115d08f00 -- didCommitLoad: url=fast/loader/document-destruction-within-unload.html
    0x7f6115d08e60 -- didStartProvisionalLoad: url=fast/loader/resources/document-destruction-within-unload-iframe.html
    0x7f6115d08e60 -- didCommitLoad: url=fast/loader/resources/document-destruction-within-unload-iframe.html
        0x7f6115d3cd20 -- didStartProvisionalLoad: url=fast/loader/resources/does_not_exist
        0x7f6115d08dc0 -- didStartProvisionalLoad: url=fast/loader/resources/document-destruction-within-unload.svg
        0x7f6115d3cd20 -- didFailProvisionalLoad: url=fast/loader/resources/does_not_exist
        0x7f6115d08dc0 -- didCommitLoad: url=fast/loader/resources/document-destruction-within-unload.svg
        0x7f6115d08dc0 -- didFinishLoad: url=fast/loader/resources/document-destruction-within-unload.svg
    0x7f6115d08e60 -- didFinishLoad: url=fast/loader/resources/document-destruction-within-unload-iframe.html
0x7f6115d08f00 -- didFinishLoad: url=fast/loader/document-destruction-within-unload.html
    0x7f6115d08e60 -- didStartProvisionalLoad: url=fast/loader/resources/document-destruction-within-unload-iframe.html
    0x7f6115d08e60 -- didFailProvisionalLoad: url=fast/loader/resources/document-destruction-within-unload-iframe.html
    0x7f6115d08e60 -- didCommitLoad: url=  <============= this commit seems to be the problem.
0x7f6115d08f00 -- didStartProvisionalLoad: url=about:blank
0x7f6115d08f00 -- didCommitLoad: url=about:blank
0x7f6115d08f00 -- didFinishLoad: url=about:blank
0x7f6115d08f00 -- didStartProvisionalLoad: url=css1/basic/comments.html
0x7f6115d08f00 -- didCommitLoad: url=css1/basic/comments.html
0x7f6115d08f00 -- didFinishLoad: url=css1/basic/comments.html

Let's look at the iframe loaded in the test (fast/loader/resources/document-destruction-within-unload-iframe.html):

<html>
<body>
<script>
function runTest() {
    var test = document.getElementById('root').contentDocument;
    test.firstChild.setAttribute('onunload', "parent.clearUs();");
    location.reload();
}

function clearUs() {
    document.write();
    parent.done();
}
</script>
<object data="does_not_exist"></object>
<object data="document-destruction-within-unload.svg" id="root" onload="runTest();"></object>
</body>
</html>

So, upon loading the svg file, the iframe does a reload. This is why didStartProvisionalLoad called again for it. On the other hand the onunload handler of the svg element does document.write() which results in cancelling the load, and didFailProvisionalLoad is called. I think it is correct so far. The question is how can be data committed the this cancelled load after that (which results in didCommitLoad called)? In bug 66783 the same seems to happen, and if I put equivalent assertions in FrameLoaderClientQt, I get the same fail (with Qt WK1 of course), so basically it seems to be a general bug in loader code.

-- 
Configure bugmail: https://bugs.webkit.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.