Bug 116979 – ASSERTION FAILED: !m_adoptionIsRequired in void WebCore::TreeShared<NodeType>::ref()

• Component: DOM
• Status: RESOLVED FIXED

[Renata Hodovan]

Created attachment 203218 [details]
Test case

The attached tests crashes in debug mode.

Crashlog & backtrace:

Program received signal SIGSEGV, Segmentation fault.
0x00007ffff575275d in WTFCrash () at /home/reni/Data/REPOS/webkit_sec/Source/WTF/wtf/Assertions.cpp:339
339	    *(int *)(uintptr_t)0xbbadbeef = 0;
(gdb) bt 
#0  0x00007ffff575275d in WTFCrash () at /home/reni/Data/REPOS/webkit_sec/Source/WTF/wtf/Assertions.cpp:339
#1  0x00007ffff3bfd4d1 in WebCore::TreeShared<WebCore::Node>::ref (this=0x8d0ae0) at /home/reni/Data/REPOS/webkit_sec/Source/WebCore/platform/TreeShared.h:65
#2  0x00007ffff42cc5c2 in WebCore::Node::refEventTarget (this=0x8d0ad0) at /home/reni/Data/REPOS/webkit_sec/Source/WebCore/dom/Node.cpp:792
#3  0x00007ffff3fc7039 in WebCore::EventTarget::ref (this=0x8d0ad0) at /home/reni/Data/REPOS/webkit_sec/Source/WebCore/dom/EventTarget.h:106
#4  0x00007ffff3fc7e9f in WTF::refIfNotNull<WebCore::EventTarget> (ptr=0x8d0ad0) at /home/reni/Data/REPOS/webkit_sec/Source/WTF/wtf/PassRefPtr.h:46
#5  0x00007ffff4246327 in WTF::PassRefPtr<WebCore::EventTarget>::PassRefPtr (this=0x7fffffffbde0, ptr=0x8d0ad0)
    at /home/reni/Data/REPOS/webkit_sec/Source/WTF/wtf/PassRefPtr.h:60
#6  0x00007ffff42994f8 in WebCore::EventDispatcher::dispatchScopedEvent (node=0x8d0ad0, mediator=...)
    at /home/reni/Data/REPOS/webkit_sec/Source/WebCore/dom/EventDispatcher.cpp:73
#7  0x00007ffff42d0f3c in WebCore::Node::dispatchScopedEventDispatchMediator (this=0x8d0ad0, eventDispatchMediator=...)
    at /home/reni/Data/REPOS/webkit_sec/Source/WebCore/dom/Node.cpp:2274
#8  0x00007ffff42d0eeb in WebCore::Node::dispatchScopedEvent (this=0x8d0ad0, event=...) at /home/reni/Data/REPOS/webkit_sec/Source/WebCore/dom/Node.cpp:2269
#9  0x00007ffff42d11e0 in WebCore::Node::dispatchSubtreeModifiedEvent (this=0x8d0ad0) at /home/reni/Data/REPOS/webkit_sec/Source/WebCore/dom/Node.cpp:2298
#10 0x00007ffff428f71d in WebCore::Element::didAddAttribute (this=0x8d0ad0, name=..., value=...)
    at /home/reni/Data/REPOS/webkit_sec/Source/WebCore/dom/Element.cpp:2952

[Rob Buis]

Created attachment 208781 [details]
Patch

[Antti Koivisto]

Comment on attachment 208781 [details]
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=208781&action=review

> Source/WebCore/html/HTMLProgressElement.cpp:159
>      RefPtr<ProgressInnerElement> inner = ProgressInnerElement::create(document());
> +    inner->setPseudo(AtomicString("-webkit-progress-inner-element", AtomicString::ConstructFromLiteral));

It would be nicer to make these setPseudo calls in ::create() so it is not possible to construct ProgressInnerElement and pals without the right pseudo type.

[Rob Buis]

(In reply to comment #2)
> (From update of attachment 208781 [details])
> View in context: https://bugs.webkit.org/attachment.cgi?id=208781&action=review
> 
> > Source/WebCore/html/HTMLProgressElement.cpp:159
> >      RefPtr<ProgressInnerElement> inner = ProgressInnerElement::create(document());
> > +    inner->setPseudo(AtomicString("-webkit-progress-inner-element", AtomicString::ConstructFromLiteral));
> 
> It would be nicer to make these setPseudo calls in ::create() so it is not possible to construct ProgressInnerElement and pals without the right pseudo type.

Great idea, I fixed it before landing. A shame that we are not always consistent here.

[Rob Buis]

Committed r154099: <http://trac.webkit.org/changeset/154099>

[Darin Adler]

Comment on attachment 208781 [details]
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=208781&action=review

> Source/WebCore/html/shadow/ProgressShadowElement.h:69
> +    ProgressBarElement(Document*);

Shouldn’t this constructor be private, if it’s only supposed to be called by the create function?

> Source/WebCore/html/shadow/ProgressShadowElement.h:81
> +    ProgressValueElement(Document*);

Same question.

[Rob Buis]

(In reply to comment #5)
> (From update of attachment 208781 [details])
> View in context: https://bugs.webkit.org/attachment.cgi?id=208781&action=review
> 
> > Source/WebCore/html/shadow/ProgressShadowElement.h:69
> > +    ProgressBarElement(Document*);
> 
> Shouldn’t this constructor be private, if it’s only supposed to be called by the create function?
> 
> > Source/WebCore/html/shadow/ProgressShadowElement.h:81
> > +    ProgressValueElement(Document*);
> 
> Same question.

Good point, I'll try to make a follow-up patch.

[Rob Buis]

Reopening to attach new patch.

[Rob Buis]

Created attachment 208827 [details]
Patch

[WebKit Commit Bot]

Comment on attachment 208827 [details]
Patch

Clearing flags on attachment: 208827

Committed r154121: <http://trac.webkit.org/changeset/154121>

[WebKit Commit Bot]

All reviewed patches have been landed.  Closing bug.