194329 2019-02-05 20:59:03 -0800 REGRESSION (r240909): Release assert in FrameLoader::loadURL when navigating with a non-existent target name 2019-02-06 10:59:56 -0800 1 1 1 Unclassified WebKit Page Loading WebKit Nightly Build Unspecified Unspecified RESOLVED FIXED InRadar, Regression P2 Normal --- 194189 1 rniwa rniwa achristensen beidson cdumez dbates ddkilzer ews-watchlist ggaren japhet rniwa webkit-bug-importer oldest_to_newest 1502681 0 rniwa 2019-02-05 20:59:03 -0800 After https://trac.webkit.org/changeset/240909/webkit, we're hitting the newly introduced release assertion. Reproduction steps: 1. Navigate to: https://www.timeout.com/miami/music/rolling-loud-festival 2. Click on the “Hard Rock Stadium” link in the article 3. Use the back button to return to the article. 3. Click on the rollingloud.com link at the end of the article. <rdar://problem/47830193> 1502683 1 361276 rniwa 2019-02-05 21:06:01 -0800 Created attachment 361276 Fixes the bug 1502684 2 361276 ggaren 2019-02-05 21:17:24 -0800 Comment on attachment 361276 Fixes the bug r=me 1502689 3 361276 dbates 2019-02-05 21:59:05 -0800 Comment on attachment 361276 Fixes the bug View in context: https://bugs.webkit.org/attachment.cgi?id=361276&action=review > Source/WebCore/ChangeLog:12 > + Updating the load type here should in theory fix the underlying bug r240909 was meant to catch & fix. Just to play devil’s advocate, what makes you think you fixed it this time? I guess it’s fixed in theory. By the way, I didn’t even look at r240909, but something about this bug: its title, or this sentence. Maybe its the lack of confidence in the fix. But I’ll tell you what I love about this bug - your description (comment #0) and understandable repro steps. 1502690 4 dbates 2019-02-05 22:00:31 -0800 (In reply to Daniel Bates from comment #3) > Comment on attachment 361276 [details] > Fixes the bug > > View in context: > https://bugs.webkit.org/attachment.cgi?id=361276&action=review > > > Source/WebCore/ChangeLog:12 > > + Updating the load type here should in theory fix the underlying bug r240909 was meant to catch & fix. > > Just to play devil’s advocate, what makes you think you fixed it this time? > I guess it’s fixed in theory. By the way, I didn’t even look at r240909, but > something about this bug: its title, or this sentence. Something about this bug ... rubs me the wrong way. 1502691 5 rniwa 2019-02-05 22:05:51 -0800 (In reply to Daniel Bates from comment #3) > Comment on attachment 361276 [details] > Fixes the bug > > View in context: > https://bugs.webkit.org/attachment.cgi?id=361276&action=review > > > Source/WebCore/ChangeLog:12 > > + Updating the load type here should in theory fix the underlying bug r240909 was meant to catch & fix. > > Just to play devil’s advocate, what makes you think you fixed it this time? Because the release assertion I added in r240909 should be "comprehensive" in that either one of the release assertions is hit, or the original crash in FrameLoader::continueLoadAfterNavigationPolicy shouldn't happen. Obviously, it's possible we read the code wrong but that's our collective understanding of the situation right now. 1502692 6 rniwa 2019-02-05 22:06:33 -0800 Waiting for EWS. 1502729 7 rniwa 2019-02-06 01:42:51 -0800 Committed r241015: <https://trac.webkit.org/changeset/241015> 1502734 8 ddkilzer 2019-02-06 02:11:50 -0800 (In reply to Ryosuke Niwa from comment #7) > Committed r241015: <https://trac.webkit.org/changeset/241015> The landed patch skipped all WebGL tests for all platforms. I don’t think that was the intention here. 1503381 9 ggaren 2019-02-06 10:44:20 -0800 > Just to play devil’s advocate, what makes you think you fixed it this time? I think the formal answer here is that the regression test included with this patch exercises a code path that will RELEASE_ASSERT if the bug is not fixed. That's not my favorite way to test, but I think it's sufficient. 1503386 10 ddkilzer 2019-02-06 10:59:56 -0800 (In reply to David Kilzer (:ddkilzer) from comment #8) > (In reply to Ryosuke Niwa from comment #7) > > Committed r241015: <https://trac.webkit.org/changeset/241015> > > The landed patch skipped all WebGL tests for all platforms. > > I don’t think that was the intention here. Unskipped all webgl tests again: Committed r241031: <https://trac.webkit.org/changeset/241031> 361276 2019-02-05 21:06:01 -0800 2019-02-05 21:17:24 -0800 Fixes the bug bug-194329-20190205210601.patch text/plain 5634 rniwa SW5kZXg6IFNvdXJjZS9XZWJDb3JlL0NoYW5nZUxvZwo9PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09Ci0tLSBTb3VyY2UvV2Vi Q29yZS9DaGFuZ2VMb2cJKHJldmlzaW9uIDI0MTAwOSkKKysrIFNvdXJjZS9XZWJDb3JlL0NoYW5n ZUxvZwkod29ya2luZyBjb3B5KQpAQCAtMSwzICsxLDIxIEBACisyMDE5LTAyLTA1ICBSeW9zdWtl IE5pd2EgIDxybml3YUB3ZWJraXQub3JnPgorCisgICAgICAgIFJFR1JFU1NJT04gKHIyNDA5MDkp OiBSZWxlYXNlIGFzc2VydCBpbiBGcmFtZUxvYWRlcjo6bG9hZFVSTCB3aGVuIG5hdmlnYXRpbmcg d2l0aCBhIG5vbi1leGlzdGVudCB0YXJnZXQgbmFtZQorICAgICAgICBodHRwczovL2J1Z3Mud2Vi a2l0Lm9yZy9zaG93X2J1Zy5jZ2k/aWQ9MTk0MzI5CisKKyAgICAgICAgUmV2aWV3ZWQgYnkgTk9C T0RZIChPT1BTISkuCisKKyAgICAgICAgVGhlIGJ1ZyB3YXMgY2F1c2VkIGJ5IHRoZSBjb2RlIHBh dGggZm9yIHdoZW4gbmF2aWdhdGluZyB3aXRoIGEgc3BlY2lmaWMgdGFyZ2V0IGZyYW1lIG5hbWUg dGhhdCBkb2VzIG5vdCBleGlzdAorICAgICAgICBuZXZlciBzZXR0aW5nIHRoZSBsb2FkIHR5cGUg b2YgUG9saWN5Q2hlY2tlci4gQXMgYSByZXN1bHQsIHdlIHdvdWxkIHVzZSB3aGF0ZXZlciBsb2Fk IHR5cGUgdXNlZCBpbiB0aGUgcHJldmlvdXMKKyAgICAgICAgbmF2aWdhdGlvbiwgcmVzdWx0aW5n IGluIHRoaXMgcmVsZWFzZSBhc3NlcnRpb24uCisKKyAgICAgICAgVXBkYXRpbmcgdGhlIGxvYWQg dHlwZSBoZXJlIHNob3VsZCBpbiB0aGVvcnkgZml4IHRoZSB1bmRlcmx5aW5nIGJ1ZyByMjQwOTA5 IHdhcyBtZWFudCB0byBjYXRjaCAmIGZpeC4KKworICAgICAgICBUZXN0OiBmYXN0L2xvYWRlci9u YXZpZ2F0ZS13aXRoLW5ldy10YXJnZXQtYWZ0ZXItYmFjay1mb3J3YXJkLW5hdmlnYXRpb24uaHRt bAorCisgICAgICAgICogbG9hZGVyL0ZyYW1lTG9hZGVyLmNwcDoKKyAgICAgICAgKFdlYkNvcmU6 OkZyYW1lTG9hZGVyOjpsb2FkVVJMKToKKwogMjAxOS0wMi0wNSAgQWxleCBDaHJpc3RlbnNlbiAg PGFjaHJpc3RlbnNlbkB3ZWJraXQub3JnPgogCiAgICAgICAgIFN0b3AgdXNpbmcgYmxvYlJlZ2lz dHJ5IGluIE5ldHdvcmtQcm9jZXNzCkluZGV4OiBTb3VyY2UvV2ViQ29yZS9sb2FkZXIvRnJhbWVM b2FkZXIuY3BwCj09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT0KLS0tIFNvdXJjZS9XZWJDb3JlL2xvYWRlci9GcmFtZUxvYWRl ci5jcHAJKHJldmlzaW9uIDI0MTAwOCkKKysrIFNvdXJjZS9XZWJDb3JlL2xvYWRlci9GcmFtZUxv YWRlci5jcHAJKHdvcmtpbmcgY29weSkKQEAgLTEzNzksNiArMTM3OSw3IEBAIHZvaWQgRnJhbWVM b2FkZXI6OmxvYWRVUkwoRnJhbWVMb2FkUmVxdWUKIAogICAgIGlmICghdGFyZ2V0RnJhbWUgJiYg IWVmZmVjdGl2ZUZyYW1lTmFtZS5pc0VtcHR5KCkpIHsKICAgICAgICAgYWN0aW9uID0gYWN0aW9u LmNvcHlXaXRoU2hvdWxkT3BlbkV4dGVybmFsVVJMc1BvbGljeShzaG91bGRPcGVuRXh0ZXJuYWxV UkxzUG9saWN5VG9BcHBseShtX2ZyYW1lLCBmcmFtZUxvYWRSZXF1ZXN0KSk7CisgICAgICAgIHBv bGljeUNoZWNrZXIoKS5zZXRMb2FkVHlwZShuZXdMb2FkVHlwZSk7CiAgICAgICAgIFJFTEVBU0Vf QVNTRVJUKCFpc0JhY2tGb3J3YXJkTG9hZFR5cGUocG9saWN5Q2hlY2tlcigpLmxvYWRUeXBlKCkp KTsKICAgICAgICAgcG9saWN5Q2hlY2tlcigpLmNoZWNrTmV3V2luZG93UG9saWN5KFdURk1vdmUo YWN0aW9uKSwgV1RGTW92ZShyZXF1ZXN0KSwgV1RGTW92ZShmb3JtU3RhdGUpLCBlZmZlY3RpdmVG cmFtZU5hbWUsIFt0aGlzLCBhbGxvd05hdmlnYXRpb25Ub0ludmFsaWRVUkwsIG9wZW5lclBvbGlj eSwgY29tcGxldGlvbkhhbmRsZXIgPSBjb21wbGV0aW9uSGFuZGxlckNhbGxlci5yZWxlYXNlKCld IChjb25zdCBSZXNvdXJjZVJlcXVlc3QmIHJlcXVlc3QsIFdlYWtQdHI8Rm9ybVN0YXRlPiYmIGZv cm1TdGF0ZSwgY29uc3QgU3RyaW5nJiBmcmFtZU5hbWUsIGNvbnN0IE5hdmlnYXRpb25BY3Rpb24m IGFjdGlvbiwgU2hvdWxkQ29udGludWUgc2hvdWxkQ29udGludWUpIG11dGFibGUgewogICAgICAg ICAgICAgY29udGludWVMb2FkQWZ0ZXJOZXdXaW5kb3dQb2xpY3kocmVxdWVzdCwgZm9ybVN0YXRl LmdldCgpLCBmcmFtZU5hbWUsIGFjdGlvbiwgc2hvdWxkQ29udGludWUsIGFsbG93TmF2aWdhdGlv blRvSW52YWxpZFVSTCwgb3BlbmVyUG9saWN5KTsKSW5kZXg6IExheW91dFRlc3RzL0NoYW5nZUxv Zwo9PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09Ci0tLSBMYXlvdXRUZXN0cy9DaGFuZ2VMb2cJKHJldmlzaW9uIDI0MTAwOCkK KysrIExheW91dFRlc3RzL0NoYW5nZUxvZwkod29ya2luZyBjb3B5KQpAQCAtMSwzICsxLDE1IEBA CisyMDE5LTAyLTA1ICBSeW9zdWtlIE5pd2EgIDxybml3YUB3ZWJraXQub3JnPgorCisgICAgICAg IFJFR1JFU1NJT04gKHIyNDA5MDkpOiBSZWxlYXNlIGFzc2VydCBpbiBGcmFtZUxvYWRlcjo6bG9h ZFVSTCB3aGVuIG5hdmlnYXRpbmcgd2l0aCBhIG5vbi1leGlzdGVudCB0YXJnZXQgbmFtZQorICAg ICAgICBodHRwczovL2J1Z3Mud2Via2l0Lm9yZy9zaG93X2J1Zy5jZ2k/aWQ9MTk0MzI5CisKKyAg ICAgICAgUmV2aWV3ZWQgYnkgTk9CT0RZIChPT1BTISkuCisKKyAgICAgICAgQWRkZWQgYSByZWdy ZXNzaW9uIHRlc3QuCisKKyAgICAgICAgKiBmYXN0L2xvYWRlci9uYXZpZ2F0ZS13aXRoLW5ldy10 YXJnZXQtYWZ0ZXItYmFjay1mb3J3YXJkLW5hdmlnYXRpb24tZXhwZWN0ZWQudHh0OiBBZGRlZC4K KyAgICAgICAgKiBmYXN0L2xvYWRlci9uYXZpZ2F0ZS13aXRoLW5ldy10YXJnZXQtYWZ0ZXItYmFj ay1mb3J3YXJkLW5hdmlnYXRpb24uaHRtbDogQWRkZWQuCisKIDIwMTktMDItMDUgIE5pa2l0YSBW YXNpbHlldiAgPG52YXNpbHlldkBhcHBsZS5jb20+CiAKICAgICAgICAgV2ViIEluc3BlY3Rvcjog Rml4IG1vZGlmeS1jc3MtcHJvcGVydHktcmFjZS5odG1sIHRlc3QgZmFpbHVyZXMKSW5kZXg6IExh eW91dFRlc3RzL2Zhc3QvbG9hZGVyL25hdmlnYXRlLXdpdGgtbmV3LXRhcmdldC1hZnRlci1iYWNr LWZvcndhcmQtbmF2aWdhdGlvbi1leHBlY3RlZC50eHQKPT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PQotLS0gTGF5b3V0VGVz dHMvZmFzdC9sb2FkZXIvbmF2aWdhdGUtd2l0aC1uZXctdGFyZ2V0LWFmdGVyLWJhY2stZm9yd2Fy ZC1uYXZpZ2F0aW9uLWV4cGVjdGVkLnR4dAkobm9uZXhpc3RlbnQpCisrKyBMYXlvdXRUZXN0cy9m YXN0L2xvYWRlci9uYXZpZ2F0ZS13aXRoLW5ldy10YXJnZXQtYWZ0ZXItYmFjay1mb3J3YXJkLW5h dmlnYXRpb24tZXhwZWN0ZWQudHh0CSh3b3JraW5nIGNvcHkpCkBAIC0wLDAgKzEsNSBAQAorQUxF UlQ6IFBBU1MKK1RoaXMgdGVzdHMgbmF2aWdhdGluZyB2aWEgYW4gYW5jaG9yIGVsZW1lbnQgd2l0 aCBhIG5vbi1leGlzdGVudCB0YXJnZXQgbmFtZSwgd2hpY2ggc2hvdWxkIGNyZWF0ZSBhIG5ldyB3 aW5kb3cuCitXZWJLaXQgc2hvdWxkIG5vdCBoaXQgYW55IGFzc2VydGlvbnMgYW5kIGFsZXJ0ICJQ QVNTIi4KKworCkluZGV4OiBMYXlvdXRUZXN0cy9mYXN0L2xvYWRlci9uYXZpZ2F0ZS13aXRoLW5l dy10YXJnZXQtYWZ0ZXItYmFjay1mb3J3YXJkLW5hdmlnYXRpb24uaHRtbAo9PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09Ci0t LSBMYXlvdXRUZXN0cy9mYXN0L2xvYWRlci9uYXZpZ2F0ZS13aXRoLW5ldy10YXJnZXQtYWZ0ZXIt YmFjay1mb3J3YXJkLW5hdmlnYXRpb24uaHRtbAkobm9uZXhpc3RlbnQpCisrKyBMYXlvdXRUZXN0 cy9mYXN0L2xvYWRlci9uYXZpZ2F0ZS13aXRoLW5ldy10YXJnZXQtYWZ0ZXItYmFjay1mb3J3YXJk LW5hdmlnYXRpb24uaHRtbAkod29ya2luZyBjb3B5KQpAQCAtMCwwICsxLDUxIEBACis8IURPQ1RZ UEUgaHRtbD4KKzxodG1sPgorPGJvZHk+Cis8c2NyaXB0PgorCitpZiAod2luZG93LnRlc3RSdW5u ZXIpIHsKKyAgICB0ZXN0UnVubmVyLmR1bXBBc1RleHQoKTsKKyAgICB0ZXN0UnVubmVyLndhaXRV bnRpbERvbmUoKTsKKyAgICB0ZXN0UnVubmVyLnNldENhbk9wZW5XaW5kb3dzKCk7CisgICAgdGVz dFJ1bm5lci5zZXRDbG9zZVJlbWFpbmluZ1dpbmRvd3NXaGVuQ29tcGxldGUoKTsKKyAgICB0ZXN0 UnVubmVyLm92ZXJyaWRlUHJlZmVyZW5jZSgiV2ViS2l0VXNlc1BhZ2VDYWNoZVByZWZlcmVuY2VL ZXkiLCAxKTsKK30KKworaWYgKGxvY2F0aW9uLnNlYXJjaCA9PSAnP3RoaXJkJykgeworICAgIGFs ZXJ0KCdQQVNTJyk7CisgICAgaWYgKHdpbmRvdy50ZXN0UnVubmVyKQorICAgICAgICB0ZXN0UnVu bmVyLm5vdGlmeURvbmUoKTsKK30gZWxzZSBpZiAoc2VsZiA9PSB0b3ApIHsKKyAgICBkb2N1bWVu dC53cml0ZShgPHA+VGhpcyB0ZXN0cyBuYXZpZ2F0aW5nIHZpYSBhbiBhbmNob3IgZWxlbWVudCB3 aXRoIGEgbm9uLWV4aXN0ZW50IHRhcmdldCBuYW1lLCB3aGljaCBzaG91bGQgY3JlYXRlIGEgbmV3 IHdpbmRvdy48YnI+CitXZWJLaXQgc2hvdWxkIG5vdCBoaXQgYW55IGFzc2VydGlvbnMgYW5kIGFs ZXJ0ICJQQVNTIi48L3A+YCk7CisgICAgY29uc3QgZnJhbWUgPSBkb2N1bWVudC5jcmVhdGVFbGVt ZW50KCdpZnJhbWUnKTsKKyAgICBmcmFtZS5zcmMgPSAnP2ZpcnN0JzsKKyAgICBsZXQgc3RlcCA9 IDA7CisgICAgZnJhbWUub25sb2FkID0gKCkgPT4geworICAgICAgICBzd2l0Y2ggKHN0ZXArKykg eworICAgICAgICBjYXNlIDA6CisgICAgICAgICAgICBzZXRUaW1lb3V0KCgpID0+IGZyYW1lLnNy YyA9ICc/c2Vjb25kJywgMCk7CisgICAgICAgICAgICBicmVhazsKKyAgICAgICAgY2FzZSAxOgor ICAgICAgICAgICAgc2V0VGltZW91dCgoKSA9PiBoaXN0b3J5LmJhY2soKSwgMCk7CisgICAgICAg ICAgICBicmVhazsKKyAgICAgICAgfQorICAgIH0KKyAgICBkb2N1bWVudC5ib2R5LmFwcGVuZENo aWxkKGZyYW1lKTsKK30gZWxzZSB7CisgICAgaWYgKGxvY2F0aW9uLnNlYXJjaCA9PSAnP2ZpcnN0 JykgeworICAgICAgICBpZiAobG9jYWxTdG9yYWdlLmdldEl0ZW0oJ2xvYWRlZCcpKSB7CisgICAg ICAgICAgICBsb2NhbFN0b3JhZ2UucmVtb3ZlSXRlbSgnbG9hZGVkJyk7CisgICAgICAgICAgICB3 aW5kb3cub25sb2FkID0gKCkgPT4geworICAgICAgICAgICAgICAgIHNldFRpbWVvdXQoKCkgPT4g ZG9jdW1lbnQucXVlcnlTZWxlY3RvcignYScpLmNsaWNrKCksIDApOworICAgICAgICAgICAgfQor ICAgICAgICB9IGVsc2UKKyAgICAgICAgICAgIGxvY2FsU3RvcmFnZS5zZXRJdGVtKCdsb2FkZWQn LCAndHJ1ZScpOworICAgIH0KKyAgICBkb2N1bWVudC53cml0ZShsb2NhdGlvbi5zZWFyY2gpOwor ICAgIGRvY3VtZW50LndyaXRlKGAgPGEgaHJlZj0iP3RoaXJkIiB0YXJnZXQ9InVua25vd25UYXJn ZXQiPmdvPC9hPmApOworfQorCis8L3NjcmlwdD4KKzwvYm9keT4KKzwvaHRtbD4K