94618 2012-08-21 11:11:22 -0700 IndexedDB: IDBRequest can be destructed during abort 2012-08-22 15:28:36 -0700 1 1 1 Unclassified WebKit WebCore Misc. 523.x (Safari 3) Unspecified Unspecified RESOLVED FIXED P2 Normal --- 1 jsbell jsbell alecflett dgrogan tony webkit.review.bot oldest_to_newest 700939 0 jsbell 2012-08-21 11:11:22 -0700 If all script references to an IDBRequest have been dropped, it's possible the only thing keeping a request alive is an en-queued event. If that's the case, then if the request is abort()ed the destructor can run in the middle of the abort() method, and asserts. Abbreviated stack trace: ASSERTION FAILED: m_readyState == DONE || m_readyState == EarlyDeath || !scriptExecutionContext() ../../third_party/WebKit/Source/WebCore/Modules/indexeddb/IDBRequest.cpp(83) : virtual WebCore::IDBRequest::~IDBRequest() 1 WebCore::IDBRequest::~IDBRequest() ... 7 WebCore::EventTarget::deref() ... 13 WebCore::Event::~Event() ... 22 WTF::Vector<WTF::RefPtr<WebCore::Event>, 0ul>::clear() 23 WebCore::IDBRequest::abort() 24 WebCore::IDBTransaction::abort(int&) 25 WebCore::IDBTransaction::stop() 26 non-virtual thunk to WebCore::IDBTransaction::stop() 27 WebCore::ScriptExecutionContext::stopActiveDOMObjects() 28 WebCore::Document::detach() 29 WebCore::Document::prepareForDestruction() 700957 1 159729 jsbell 2012-08-21 11:36:49 -0700 Created attachment 159729 Patch 700976 2 alecflett 2012-08-21 12:01:37 -0700 lgtm 700979 3 jsbell 2012-08-21 12:09:15 -0700 Link to Chromium test flake report: http://code.google.com/p/chromium/issues/detail?id=143855 700981 4 jsbell 2012-08-21 12:09:31 -0700 tony@ - r? 701079 5 159729 tony 2012-08-21 13:38:03 -0700 Comment on attachment 159729 Patch If there's a way to reliably hit the assert, it would be nice to add a test case for it. 702429 6 159729 webkit.review.bot 2012-08-22 15:28:33 -0700 Comment on attachment 159729 Patch Clearing flags on attachment: 159729 Committed r126361: <http://trac.webkit.org/changeset/126361> 702430 7 webkit.review.bot 2012-08-22 15:28:36 -0700 All reviewed patches have been landed. Closing bug. 159729 2012-08-21 11:36:49 -0700 2012-08-22 15:28:33 -0700 Patch bug-94618-20120821113648.patch text/plain 2242 jsbell U3VidmVyc2lvbiBSZXZpc2lvbjogMTI2MDE5CmRpZmYgLS1naXQgYS9Tb3VyY2UvV2ViQ29yZS9D aGFuZ2VMb2cgYi9Tb3VyY2UvV2ViQ29yZS9DaGFuZ2VMb2cKaW5kZXggMDY4OTBlNTI4ZGI2ZmM5 Y2ZkNzJhMzc0ZTVlZjM0MmY5MTdjMDFlZS4uNWU2NTY5NTE5NTBmZTk3ZDI5ZGM3YzBmOGM0ZDJm ZTM4MWNjMTA5NCAxMDA2NDQKLS0tIGEvU291cmNlL1dlYkNvcmUvQ2hhbmdlTG9nCisrKyBiL1Nv dXJjZS9XZWJDb3JlL0NoYW5nZUxvZwpAQCAtMSwzICsxLDI2IEBACisyMDEyLTA4LTIxICBKb3No dWEgQmVsbCAgPGpzYmVsbEBjaHJvbWl1bS5vcmc+CisKKyAgICAgICAgSW5kZXhlZERCOiBJREJS ZXF1ZXN0IGNhbiBiZSBkZXN0cnVjdGVkIGR1cmluZyBhYm9ydAorICAgICAgICBodHRwczovL2J1 Z3Mud2Via2l0Lm9yZy9zaG93X2J1Zy5jZ2k/aWQ9OTQ2MTgKKworICAgICAgICBSZXZpZXdlZCBi eSBOT0JPRFkgKE9PUFMhKS4KKworICAgICAgICBJZiB0aGVyZSBhcmUgbm8gc2NyaXB0IHJlZmVy ZW5jZXMsIGFuIElEQlJlcXVlc3QgY291bGQgYmUga2VwdCBhbGl2ZQorICAgICAgICBvbmx5IGJ5 IGVucXVldWVkIGV2ZW50cy4gT24gZG9jdW1lbnQgZGVzdHJ1Y3Rpb24sIHRoZSBwYXJlbnQgdHJh bnNhY3Rpb24KKyAgICAgICAgaXMgYWJvcnRlZCwgd2hpY2ggYWJvcnRzIHRoZSByZXF1ZXN0LiBE dXJpbmcgdGhlIGFib3J0LCB0aGUgZW5xdWV1ZWQgZXZlbnRzCisgICAgICAgIGFyZSBkZWxldGVk LCByZWxlYXNpbmcgdGhlIGxhc3QgcmVmZXJlbmNlIHRvIHRoZSBJREJSZXF1ZXN0IHdoaWNoIHRo ZW4KKyAgICAgICAgZGVzdHJ1Y3RzIGluIG1pZC1tZXRob2QgY2FsbCBhbmQgYW4gInVuZmluaXNo ZWQiIHN0YXRlLCBoaXR0aW5nIGFuIGFzc2VydC4KKworICAgICAgICBUaGlzIHBhdGNoIGtlZXBz IHRoZSBJREJSZXF1ZXN0IGFsaXZlIHRocm91Z2ggdGhlIGNvbXBsZXRpb24gb2YgdGhlIGFib3J0 KCkKKyAgICAgICAgbWV0aG9kLCB3aGljaCB3aWxsIGVucXVldWUgYW5vdGhlciBldmVudC4gSW4g dGhlIGRvY3VtZW50IGRlc3RydWN0aW9uIGNhc2UsCisgICAgICAgIHRoaXMgd2lsbCBlbmQgdXAg d2l0aCB0aGUgSURCUmVxdWVzdCBoYXZpbmcgc3RvcCgpIGNhbGxlZCBvbiBpdCB3aGljaCB3aWxs CisgICAgICAgIHNlbmQgdGhlIElEQlJlcXVlc3QgaW50byBFYXJseURlYXRoIHN0YXRlLCBzYXRp c2Z5aW5nIHRoZSBkZXN0cnVjdG9yIGFzc2VydC4KKworICAgICAgICBBZGRyZXNzZXMgZXhpc3Rp bmcgbGF5b3V0IHRlc3RzIHRoYXQgYmVoYXZlIGZsYWtpbHkgaW4gQ2hyb21pdW0gcG9ydC4KKwor ICAgICAgICAqIE1vZHVsZXMvaW5kZXhlZGRiL0lEQlJlcXVlc3QuY3BwOgorICAgICAgICAoV2Vi Q29yZTo6SURCUmVxdWVzdDo6YWJvcnQpOgorCiAyMDEyLTA4LTIwICBTYW1pIEt5b3N0aWxhICA8 c2t5b3N0aWxAY2hyb21pdW0ub3JnPgogCiAgICAgICAgIFtjaHJvbWl1bV0gQ29udmVydCBzY3Jl ZW4gc3BhY2Ugc2Nyb2xsIGdlc3R1cmVzIHRvIGxheWVyIHNwYWNlCmRpZmYgLS1naXQgYS9Tb3Vy Y2UvV2ViQ29yZS9Nb2R1bGVzL2luZGV4ZWRkYi9JREJSZXF1ZXN0LmNwcCBiL1NvdXJjZS9XZWJD b3JlL01vZHVsZXMvaW5kZXhlZGRiL0lEQlJlcXVlc3QuY3BwCmluZGV4IGE2MzMzOWYyYTIzOWFh MzM5ZDMyNDkxNDJhYTAyY2IyMDQ2Yzc4YzQuLjU2N2ExZDU4OGIyYmUwNTc0NDViN2Q3ODllNjQ5 NzUyMDZlNTg0YTIgMTAwNjQ0Ci0tLSBhL1NvdXJjZS9XZWJDb3JlL01vZHVsZXMvaW5kZXhlZGRi L0lEQlJlcXVlc3QuY3BwCisrKyBiL1NvdXJjZS9XZWJDb3JlL01vZHVsZXMvaW5kZXhlZGRiL0lE QlJlcXVlc3QuY3BwCkBAIC0xNTgsNiArMTU4LDkgQEAgdm9pZCBJREJSZXF1ZXN0OjphYm9ydCgp CiAgICAgaWYgKG1fcmVhZHlTdGF0ZSA9PSBET05FKQogICAgICAgICByZXR1cm47CiAKKyAgICAv LyBFbnF1ZXVlZCBldmVudHMgbWF5IGJlIHRoZSBvbmx5IHJlZmVyZW5jZSB0byB0aGlzIG9iamVj dC4KKyAgICBSZWZQdHI8SURCUmVxdWVzdD4gc2VsZih0aGlzKTsKKwogICAgIEV2ZW50UXVldWUq IGV2ZW50UXVldWUgPSBzY3JpcHRFeGVjdXRpb25Db250ZXh0KCktPmV2ZW50UXVldWUoKTsKICAg ICBmb3IgKHNpemVfdCBpID0gMDsgaSA8IG1fZW5xdWV1ZWRFdmVudHMuc2l6ZSgpOyArK2kpIHsK ICAgICAgICAgYm9vbCByZW1vdmVkID0gZXZlbnRRdWV1ZS0+Y2FuY2VsRXZlbnQobV9lbnF1ZXVl ZEV2ZW50c1tpXS5nZXQoKSk7Cg==