REGRESSION (r162947): Tests crashing at AccessibilityRenderObject::remoteSVGRootElement

• Component: WebKit EFL
• Status: RESOLVED DUPLICATE

[Michal Pakula vel Rutka]

After r162947 <http://trac.webkit.org/changeset/162947> around 20 tests from several categories (compositing, fast, http, loader, media) started crashing on EFL WK2 Release.
It seems that those tests fails also on GTK port i.e.:
http://webkit-test-results.appspot.com/dashboards/flakiness_dashboard.html#showAllRuns=true&tests=fast%2Floader%2Fshow-only-one-beforeunload-dialog.html
http://webkit-test-results.appspot.com/dashboards/flakiness_dashboard.html#showAllRuns=true&tests=http%2Ftests%2Fnavigation%2Fhistory-back-across-form-submission-to-fragment.html
http://webkit-test-results.appspot.com/dashboards/flakiness_dashboard.html#showAllRuns=true&tests=media%2Fsources-fallback-codecs.html

Release stack trace:
#0  0x0000000000000000 in ?? ()
#1  0x00007ffff0577f0e in WebCore::AccessibilityRenderObject::remoteSVGRootElement (this=0x81e7c0) at /home/michal/source/WebKit/Source/WebCore/accessibility/AccessibilityRenderObject.cpp:2799
#2  0x00007ffff0577eb6 in WebCore::AccessibilityRenderObject::detachRemoteSVGRoot (this=0x81e7c0) at /home/michal/source/WebKit/Source/WebCore/accessibility/AccessibilityRenderObject.cpp:2793
#3  0x00007ffff056e0c0 in WebCore::AccessibilityRenderObject::detach (this=0x81e7c0, detachmentType=WebCore::CacheDestroyed, cache=0x0)
    at /home/michal/source/WebKit/Source/WebCore/accessibility/AccessibilityRenderObject.cpp:138
#4  0x00007ffff0536201 in WebCore::AXObjectCache::~AXObjectCache (this=0x8247a0, __in_chrg=<optimized out>) at /home/michal/source/WebKit/Source/WebCore/accessibility/AXObjectCache.cpp:133
#5  0x00007ffff078ae8e in WTF::deleteOwnedPtr<WebCore::AXObjectCache> (ptr=0x8247a0) at /home/michal/source/WebKit/Source/WTF/wtf/OwnPtrCommon.h:51
#6  0x00007ffff0785186 in WTF::OwnPtr<WebCore::AXObjectCache>::clear (this=0x854648) at /home/michal/source/WebKit/Source/WTF/wtf/OwnPtr.h:98
#7  0x00007ffff076ed62 in WebCore::Document::clearAXObjectCache (this=0x853f90) at /home/michal/source/WebKit/Source/WebCore/dom/Document.cpp:2144
#8  0x00007ffff07690ba in WebCore::Document::~Document (this=0x853f90, __in_chrg=<optimized out>) at /home/michal/source/WebKit/Source/WebCore/dom/Document.cpp:599
#9  0x00007ffff096ac74 in WebCore::HTMLDocument::~HTMLDocument (this=0x853f90, __in_chrg=<optimized out>) at /home/michal/source/WebKit/Source/WebCore/html/HTMLDocument.cpp:90
#10 0x00007ffff096acc8 in WebCore::HTMLDocument::~HTMLDocument (this=0x853f90, __in_chrg=<optimized out>) at /home/michal/source/WebKit/Source/WebCore/html/HTMLDocument.cpp:92
#11 0x00007ffff081130b in WebCore::TreeScope::selfOnlyDeref (this=0x853fe8) at /home/michal/source/WebKit/Source/WebCore/dom/TreeScope.h:128
#12 0x00007ffff0812296 in WebCore::TreeScope::removedLastRefToScope (this=0x853fe8) at /home/michal/source/WebKit/Source/WebCore/dom/Node.cpp:2212
#13 0x00007ffff0810aa0 in WebCore::Node::removedLastRef (this=0x853f90) at /home/michal/source/WebKit/Source/WebCore/dom/Node.cpp:2230
#14 0x00007ffff74e502b in WebCore::TreeShared<WebCore::Node>::deref (this=0x853fa0) at /home/michal/source/WebKit/Source/WebCore/platform/TreeShared.h:81
#15 0x00007ffff164b3e0 in WebCore::JSNode::releaseImpl (this=0x7ffff7e0f4f0) at /home/michal/source/WebKit/WebKitBuild/Debug/DerivedSources/WebCore/JSNode.h:66
#16 0x00007ffff164b360 in WebCore::JSNodeOwner::finalize (this=0x76a4b0, handle=..., context=0x7386c0) at /home/michal/source/WebKit/WebKitBuild/Debug/DerivedSources/WebCore/JSNode.cpp:886
#17 0x00007ffff585e287 in JSC::WeakBlock::finalize (this=0x7ffff7f48000, weakImpl=0x7ffff7f48de0) at /home/michal/source/WebKit/Source/JavaScriptCore/heap/WeakSetInlines.h:52
#18 0x00007ffff585dcbb in JSC::WeakBlock::sweep (this=0x7ffff7f48000) at /home/michal/source/WebKit/Source/JavaScriptCore/heap/WeakBlock.cpp:76

Debug stack trace differs as asertion is hit:
STDERR: ASSERTION FAILED: !m_hasAXObject
STDERR: /home/michal/source/host/WebKitLayoutTests2/Source/WebCore/rendering/RenderObject.cpp(125) : virtual WebCore::RenderObject::~RenderObject()
STDERR: 1   0x7fdb53459629 WTFCrash
STDERR: 2   0x7fdb4ea6ea6b WebCore::RenderObject::~RenderObject()
STDERR: 3   0x7fdb4e9a7f16 WebCore::RenderElement::~RenderElement()
STDERR: 4   0x7fdb4ea4121a WebCore::RenderLayerModelObject::~RenderLayerModelObject()
STDERR: 5   0x7fdb4e97e902 WebCore::RenderBoxModelObject::~RenderBoxModelObject()
STDERR: 6   0x7fdb4e95fe9a WebCore::RenderBox::~RenderBox()
STDERR: 7   0x7fdb4e902d6a WebCore::RenderBlock::~RenderBlock()
STDERR: 8   0x7fdb4e93420c WebCore::RenderBlockFlow::~RenderBlockFlow()
STDERR: 9   0x7fdb4ead59d0 WebCore::RenderView::~RenderView()
STDERR: 10  0x7fdb4ead5a02 WebCore::RenderView::~RenderView()
STDERR: 11  0x7fdb4ea769cd WebCore::RenderObject::destroy()
STDERR: 12  0x7fdb4e0d8791 WebCore::RenderPtr<WebCore::RenderView>::clear()
STDERR: 13  0x7fdb4e0d0092 WebCore::RenderPtr<WebCore::RenderView>::operator=(decltype(nullptr))
STDERR: 14  0x7fdb4e0b99eb WebCore::Document::destroyRenderTree()
STDERR: 15  0x7fdb4e0b9a81 WebCore::Document::prepareForDestruction()
STDERR: 16  0x7fdb4e275854 WebCore::CachedFrame::destroy()
STDERR: 17  0x7fdb4e27792e WebCore::CachedPage::destroy()
STDERR: 18  0x7fdb4e277626 WebCore::CachedPage::~CachedPage()
STDERR: 19  0x7fdb4e27c618 std::default_delete<WebCore::CachedPage>::operator()(WebCore::CachedPage*) const
STDERR: 20  0x7fdb4e280bbc std::unique_ptr<WebCore::CachedPage, std::default_delete<WebCore::CachedPage> >::reset(WebCore::CachedPage*)
STDERR: 21  0x7fdb4e28032b std::unique_ptr<WebCore::CachedPage, std::default_delete<WebCore::CachedPage> >::operator=(decltype(nullptr))
STDERR: 22  0x7fdb4e27f931 WebCore::PageCache::remove(WebCore::HistoryItem*)
STDERR: 23  0x7fdb4e6a73ed WebCore::Settings::setUsesPageCache(bool)

[Zan Dobersek]

Bug #128175 covers probably the same problem. The issue seems to be in how the Document::topDocument() behavior changed in r162947 and how that change affects cached Documents.

[Zan Dobersek]

*** This bug has been marked as a duplicate of bug 128175 ***