23694 2009-02-02 13:48:51 -0800 REGRESSION: Running svg/custom tests crashes, randomly, depending on the order of tests 2009-02-02 16:08:26 -0800 1 1 1 Unclassified WebKit SVG 528+ (Nightly build) Mac OS X 10.5 RESOLVED FIXED P1 Normal --- 1 zimmermann darin darin eric mjs oldest_to_newest 108027 0 zimmermann 2009-02-02 13:48:51 -0800 Launch gdb-safari, run svg/custom/use-instanceRoot-as-event-target.xhtml and open svg/custom/use-instanceRoot-event-bubbling.xhtml afterwards in Safari. Close the window. Crash unrelated to SVG, appears: Program received signal EXC_BAD_ACCESS, Could not access memory. Reason: KERN_PROTECTION_FAILURE at address: 0x00000000 0x00000000 in ?? () (gdb) bt #0 0x00000000 in ?? () #1 0x035db943 in WebCore::toEventTargetNode (node=0x1b8711f0) at EventTargetNode.h:201 #2 0x035db9a1 in WebCore::EventTargetNodeCast (node=0x1b8711f0) at EventTargetNode.h:217 #3 0x036c737d in WebCore::Document::removeAllDisconnectedNodeEventListeners (this=0x70d8800) at /Users/nikolaszimmermann/Coding/WebKit/WebCore/dom/Document.cpp:1361 #4 0x036c958e in WebCore::Document::removeAllEventListenersFromAllNodes (this=0x70d8800) at /Users/nikolaszimmermann/Coding/WebKit/WebCore/dom/Document.cpp:1341 #5 0x035a7915 in WebCore::CachedFrame::clear (this=0x1bfe80c0) at /Users/nikolaszimmermann/Coding/WebKit/WebCore/history/CachedFrame.cpp:122 #6 0x035a7a92 in WebCore::CachedFrame::~CachedFrame (this=0x1bfe80c0) at /Users/nikolaszimmermann/Coding/WebKit/WebCore/history/CachedFrame.cpp:86 #7 0x035a8ba9 in WTF::RefCounted<WebCore::CachedFrame>::deref (this=0x1bfe80c0) at RefCounted.h:91 #8 0x035ab20b in WTF::RefPtr<WebCore::CachedFrame>::clear (this=0x1d35e510) at RefPtr.h:56 #9 0x035aafae in WebCore::CachedPage::clear (this=0x1d35e500) at /Users/nikolaszimmermann/Coding/WebKit/WebCore/history/CachedPage.cpp:83 #10 0x03a9dd03 in WebCore::PageCache::releaseAutoreleasedPagesNow (this=0xaa8b00) at /Users/nikolaszimmermann/Coding/WebKit/WebCore/history/PageCache.cpp:168 #11 0x00288f83 in -[WebWindowWatcher windowWillClose:] (self=0xa51dc0, _cmd=0x972042c0, notification=0xa1c800) at /Users/nikolaszimmermann/Coding/WebKit/WebKit/mac/History/WebHistoryItem.mm:594 I don't see the crash on buildbot at the moment though. 108041 1 darin 2009-02-02 14:44:23 -0800 This looks like something that would be caused by my recent change, but I can't tell exactly what's going wrong here. 108042 2 darin 2009-02-02 14:49:14 -0800 I see the problem. ContainerNode no longer calls the base class insertedIntoDocument or removedFromDocument. 108050 3 27263 darin 2009-02-02 15:50:13 -0800 Created attachment 27263 patch 108051 4 27263 andersca 2009-02-02 15:54:05 -0800 Comment on attachment 27263 patch r=me 108053 5 darin 2009-02-02 16:08:26 -0800 http://trac.webkit.org/changeset/40499 27263 2009-02-02 15:50:13 -0800 2009-02-02 15:54:05 -0800 patch EventListenerCrashPatch.txt text/plain 3563 darin SW5kZXg6IFdlYkNvcmUvQ2hhbmdlTG9nCj09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT0KLS0tIFdlYkNvcmUvQ2hhbmdlTG9n CShyZXZpc2lvbiA0MDQ5NikKKysrIFdlYkNvcmUvQ2hhbmdlTG9nCSh3b3JraW5nIGNvcHkpCkBA IC0xLDMgKzEsMjAgQEAKKzIwMDktMDItMDIgIERhcmluIEFkbGVyICA8ZGFyaW5AYXBwbGUuY29t PgorCisgICAgICAgIFJldmlld2VkIGJ5IE5PQk9EWSAoT09QUyEpLgorCisgICAgICAgIEJ1ZyAy MzY5NDogUkVHUkVTU0lPTjogUnVubmluZyBzdmcvY3VzdG9tIHRlc3RzIGNyYXNoZXMsIHJhbmRv bWx5LCBkZXBlbmRpbmcgb24gdGhlIG9yZGVyIG9mIHRlc3RzCisgICAgICAgIGh0dHBzOi8vYnVn cy53ZWJraXQub3JnL3Nob3dfYnVnLmNnaT9pZD0yMzY5NAorCisgICAgICAgICogZG9tL0NvbnRh aW5lck5vZGUuY3BwOgorICAgICAgICAoV2ViQ29yZTo6Q29udGFpbmVyTm9kZTo6aW5zZXJ0ZWRJ bnRvRG9jdW1lbnQpOiBBZGRlZCBiYWNrIHRoZSBjYWxsIHRocm91Z2ggdG8gRXZlbnRUYXJnZXRO b2RlLgorICAgICAgICAoV2ViQ29yZTo6Q29udGFpbmVyTm9kZTo6cmVtb3ZlZEZyb21Eb2N1bWVu dCk6IERpdHRvLgorICAgICAgICAqIGRvbS9FdmVudFRhcmdldE5vZGUuY3BwOgorICAgICAgICAo V2ViQ29yZTo6RXZlbnRUYXJnZXROb2RlOjppbnNlcnRlZEludG9Eb2N1bWVudCk6IENoYW5nZWQg dGhpcyB0byBub3QgY2FsbCB0aHJvdWdoIHRvIE5vZGUuCisgICAgICAgIChXZWJDb3JlOjpFdmVu dFRhcmdldE5vZGU6OnJlbW92ZWRGcm9tRG9jdW1lbnQpOiBEaXR0by4KKyAgICAgICAgKiBkb20v Tm9kZS5jcHA6CisgICAgICAgIChXZWJDb3JlOjpOb2RlOjppbnNlcnRlZEludG9Eb2N1bWVudCk6 IFVwZGF0ZWQgY29tbWVudC4KKyAgICAgICAgKFdlYkNvcmU6Ok5vZGU6OnJlbW92ZWRGcm9tRG9j dW1lbnQpOiBEaXR0by4KKwogMjAwOS0wMi0wMiAgSmF5IENhbXBhbiAgPGpjYW1wYW5AY2hyb21p dW0ub3JnPgogCiAgICAgICAgIFJldmlld2VkIGJ5IEVyaWMgU2VpZGVsLgpJbmRleDogV2ViQ29y ZS9kb20vQ29udGFpbmVyTm9kZS5jcHAKPT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PQotLS0gV2ViQ29yZS9kb20vQ29udGFp bmVyTm9kZS5jcHAJKHJldmlzaW9uIDQwNDk2KQorKysgV2ViQ29yZS9kb20vQ29udGFpbmVyTm9k ZS5jcHAJKHdvcmtpbmcgY29weSkKQEAgLTU4Nyw3ICs1ODcsNyBAQCB2b2lkIENvbnRhaW5lck5v ZGU6OmRldGFjaCgpCiAKIHZvaWQgQ29udGFpbmVyTm9kZTo6aW5zZXJ0ZWRJbnRvRG9jdW1lbnQo KQogewotICAgIHNldEluRG9jdW1lbnQodHJ1ZSk7CisgICAgRXZlbnRUYXJnZXROb2RlOjppbnNl cnRlZEludG9Eb2N1bWVudCgpOwogICAgIGluc2VydGVkSW50b1RyZWUoZmFsc2UpOwogICAgIGZv ciAoTm9kZSogY2hpbGQgPSBtX2ZpcnN0Q2hpbGQ7IGNoaWxkOyBjaGlsZCA9IGNoaWxkLT5uZXh0 U2libGluZygpKQogICAgICAgICBjaGlsZC0+aW5zZXJ0ZWRJbnRvRG9jdW1lbnQoKTsKQEAgLTU5 NSw4ICs1OTUsNyBAQCB2b2lkIENvbnRhaW5lck5vZGU6Omluc2VydGVkSW50b0RvY3VtZW50CiAK IHZvaWQgQ29udGFpbmVyTm9kZTo6cmVtb3ZlZEZyb21Eb2N1bWVudCgpCiB7Ci0gICAgaWYgKGRv Y3VtZW50KCktPmNzc1RhcmdldCgpID09IHRoaXMpCi0gICAgICAgIGRvY3VtZW50KCktPnNldENT U1RhcmdldCgwKTsKKyAgICBFdmVudFRhcmdldE5vZGU6OnJlbW92ZWRGcm9tRG9jdW1lbnQoKTsK ICAgICBzZXRJbkRvY3VtZW50KGZhbHNlKTsKICAgICByZW1vdmVkRnJvbVRyZWUoZmFsc2UpOwog ICAgIGZvciAoTm9kZSogY2hpbGQgPSBtX2ZpcnN0Q2hpbGQ7IGNoaWxkOyBjaGlsZCA9IGNoaWxk LT5uZXh0U2libGluZygpKQpJbmRleDogV2ViQ29yZS9kb20vRXZlbnRUYXJnZXROb2RlLmNwcAo9 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09Ci0tLSBXZWJDb3JlL2RvbS9FdmVudFRhcmdldE5vZGUuY3BwCShyZXZpc2lvbiA0 MDQ5NikKKysrIFdlYkNvcmUvZG9tL0V2ZW50VGFyZ2V0Tm9kZS5jcHAJKHdvcmtpbmcgY29weSkK QEAgLTg3LDcgKzg3LDcgQEAgdm9pZCBFdmVudFRhcmdldE5vZGU6Omluc2VydGVkSW50b0RvY3Vt ZQogICAgIGlmICghZXZlbnRMaXN0ZW5lcnMoKS5pc0VtcHR5KCkpCiAgICAgICAgIGRvY3VtZW50 KCktPnVucmVnaXN0ZXJEaXNjb25uZWN0ZWROb2RlV2l0aEV2ZW50TGlzdGVuZXJzKHRoaXMpOwog Ci0gICAgTm9kZTo6aW5zZXJ0ZWRJbnRvRG9jdW1lbnQoKTsKKyAgICBzZXRJbkRvY3VtZW50KHRy dWUpOwogfQogCiB2b2lkIEV2ZW50VGFyZ2V0Tm9kZTo6cmVtb3ZlZEZyb21Eb2N1bWVudCgpCkBA IC05NSw3ICs5NSw3IEBAIHZvaWQgRXZlbnRUYXJnZXROb2RlOjpyZW1vdmVkRnJvbURvY3VtZW4K ICAgICBpZiAoIWV2ZW50TGlzdGVuZXJzKCkuaXNFbXB0eSgpKQogICAgICAgICBkb2N1bWVudCgp LT5yZWdpc3RlckRpc2Nvbm5lY3RlZE5vZGVXaXRoRXZlbnRMaXN0ZW5lcnModGhpcyk7CiAKLSAg ICBOb2RlOjpyZW1vdmVkRnJvbURvY3VtZW50KCk7CisgICAgc2V0SW5Eb2N1bWVudChmYWxzZSk7 CiB9CiAKIHZvaWQgRXZlbnRUYXJnZXROb2RlOjp3aWxsTW92ZVRvTmV3T3duZXJEb2N1bWVudCgp CkluZGV4OiBXZWJDb3JlL2RvbS9Ob2RlLmNwcAo9PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09Ci0tLSBXZWJDb3JlL2RvbS9O b2RlLmNwcAkocmV2aXNpb24gNDA0OTYpCisrKyBXZWJDb3JlL2RvbS9Ob2RlLmNwcAkod29ya2lu ZyBjb3B5KQpAQCAtMTA3OCwxNCArMTA3OCwxNCBAQCB2b2lkIE5vZGU6OmRldGFjaCgpCiAKIHZv aWQgTm9kZTo6aW5zZXJ0ZWRJbnRvRG9jdW1lbnQoKQogewotICAgIC8vIE5vdGU6IENvbnRhaW5l ck5vZGU6Omluc2VydGVkSW50b0RvY3VtZW50IGRvZXMgbm90IGNhbGwgdGhyb3VnaCBoZXJlLCBz byBpZiB5b3UKKyAgICAvLyBOb3RlOiBFdmVudFRhcmdldE5vZGU6Omluc2VydGVkSW50b0RvY3Vt ZW50IGRvZXMgbm90IGNhbGwgdGhyb3VnaCBoZXJlLCBzbyBpZiB5b3UKICAgICAvLyBjaGFuZ2Ug dGhpcyBmdW5jdGlvbiwgY2hhbmdlIHRoYXQgb25lIGFzIHdlbGwuCiAgICAgc2V0SW5Eb2N1bWVu dCh0cnVlKTsKIH0KIAogdm9pZCBOb2RlOjpyZW1vdmVkRnJvbURvY3VtZW50KCkKIHsKLSAgICAv LyBOb3RlOiBDb250YWluZXJOb2RlOjppbnNlcnRlZEludG9Eb2N1bWVudCBkb2VzIG5vdCBjYWxs IHRocm91Z2ggaGVyZSwgc28gaWYgeW91CisgICAgLy8gTm90ZTogRXZlbnRUYXJnZXROb2RlOjpp bnNlcnRlZEludG9Eb2N1bWVudCBkb2VzIG5vdCBjYWxsIHRocm91Z2ggaGVyZSwgc28gaWYgeW91 CiAgICAgLy8gY2hhbmdlIHRoaXMgZnVuY3Rpb24sIGNoYW5nZSB0aGF0IG9uZSBhcyB3ZWxsLgog ICAgIHNldEluRG9jdW1lbnQoZmFsc2UpOwogfQo=