[Webkit-unassigned] [Bug 159452] [GTK][EFL] SIGSEGV in AccessibilityRenderObject::remoteSVGRootElement

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=159452

--- Comment #9 from Fujii Hironori <Hironori.Fujii at sony.com> ---
Created attachment 283000
  --> https://bugs.webkit.org/attachment.cgi?id=283000&action=review
workadound patch

fast/history/page-cache-destroy-document.html tests the case iframe is removed in pagehide event.
But, there callstack are truncated and miss the important part under JSC.

In PageCache::addIfCacheable, proceeded in the following order:

1) Make sure all the documents know they are being added to the PageCache.
2) Fire the pagehide event in all frames.

Then, documents marked InPageCache are removed.
This makes a log of assertion failed.

I attached workaround patch swapping the order.
This solves these assertion failures and the crash.

Unfortunately, This workaround patch makes fast/history/page-cache-geolocation-active-oneshot.html text failure. Need more investigation.

> ./Tools/Scripts/run-webkit-tests --gtk --release fast/history/page-cache-destroy-document.html fast/history/page-cache-geolocation-active-oneshot.html

-- 
You are receiving this mail because:
You are the assignee for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.webkit.org/pipermail/webkit-unassigned/attachments/20160707/9bbd06d6/attachment.html>