[Webkit-unassigned] [Bug 150327] New: ASSERTION FAILED: m_state == Initialized in ubresourceLoader::didReceiveResponse()

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=150327

            Bug ID: 150327
           Summary: ASSERTION FAILED: m_state == Initialized in
                    ubresourceLoader::didReceiveResponse()
    Classification: Unclassified
           Product: WebKit
           Version: WebKit Local Build
          Hardware: Unspecified
                OS: Unspecified
            Status: NEW
          Keywords: Gtk, LayoutTestFailure
          Severity: Normal
          Priority: P2
         Component: Page Loading
          Assignee: webkit-unassigned at lists.webkit.org
          Reporter: cgarcia at igalia.com
                CC: darin at apple.com, koivisto at iki.fi

This happens with printing/print-close-crash.html in the GTK+ port. This is how it happens:

 1. print() is called while the document is still loading, so m_shouldPrintWhenFinishedLoading is set to true
 2. DataURLDecoder::decode() finishes in the work queue thread, the completion handler is scheduled in the main thread
 3. The load is cancelled
   3.1 SubresourceLoader::willCancel sets m_state = Finishing
   3.2 DOMWindow::finishedLoading() is called, and since m_shouldPrintWhenFinishedLoading is true, it does the print.
   3.3 Cancellation finishes and ResourceLoader::releaseResources() si called that sets m_reachedTerminalState = true

So, between 3.1 and 3.3, the state is finishing, but m_reachedTerminalState is false. What happens, in the GTK+ port at least, is that the nested main loop used to make print() synchronous, processes the DataURLDecoder::decode() completion handler that was pending. The completion handler returns early if m_reachedTerminalState is true, but it's not yet in this particular case. So, it ends up calling didReceiveResponse (because the decode didn't fail) when the subresource loader state is Finishing.

I think there are two things here. One is that we shouldn't start a print that was waiting for the load to finish when it failed. That would fix the problem. But it's probably a good idea to also check for cancellation in the DataURLDecoder::decode() completion handler.

-- 
You are receiving this mail because:
You are the assignee for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.webkit.org/pipermail/webkit-unassigned/attachments/20151019/7a50d553/attachment.html>