<html>
<head>
<base href="https://bugs.webkit.org/" />
</head>
<body>
<p>
<div>
<b><a class="bz_bug_link
bz_status_NEW "
title="NEW - [GTK][EFL] SIGSEGV in AccessibilityRenderObject::remoteSVGRootElement"
href="https://bugs.webkit.org/show_bug.cgi?id=159452#c9">Comment # 9</a>
on <a class="bz_bug_link
bz_status_NEW "
title="NEW - [GTK][EFL] SIGSEGV in AccessibilityRenderObject::remoteSVGRootElement"
href="https://bugs.webkit.org/show_bug.cgi?id=159452">bug 159452</a>
from <span class="vcard"><a class="email" href="mailto:Hironori.Fujii@sony.com" title="Fujii Hironori <Hironori.Fujii@sony.com>"> <span class="fn">Fujii Hironori</span></a>
</span></b>
<pre>Created <span class=""><a href="attachment.cgi?id=283000&action=diff" name="attach_283000" title="workadound patch">attachment 283000</a> <a href="attachment.cgi?id=283000&action=edit" title="workadound patch">[details]</a></span>
workadound patch
fast/history/page-cache-destroy-document.html tests the case iframe is removed in pagehide event.
But, there callstack are truncated and miss the important part under JSC.
In PageCache::addIfCacheable, proceeded in the following order:
1) Make sure all the documents know they are being added to the PageCache.
2) Fire the pagehide event in all frames.
Then, documents marked InPageCache are removed.
This makes a log of assertion failed.
I attached workaround patch swapping the order.
This solves these assertion failures and the crash.
Unfortunately, This workaround patch makes fast/history/page-cache-geolocation-active-oneshot.html text failure. Need more investigation.
<span class="quote">> ./Tools/Scripts/run-webkit-tests --gtk --release fast/history/page-cache-destroy-document.html fast/history/page-cache-geolocation-active-oneshot.html</span ></pre>
</div>
</p>
<hr>
<span>You are receiving this mail because:</span>
<ul>
<li>You are the assignee for the bug.</li>
</ul>
</body>
</html>