Bug 133450

Summary:

ASSERT(!m_inRemovedLastRefFunction) in Element::addShadowRoot while destroying a document

Product:

WebKit

Reporter:

Alexey Proskuryakov <ap>

Component:

Media

Assignee:

Jer Noble <jer.noble>

Status:

RESOLVED FIXED

Severity:

Normal

CC:

calvaris, commit-queue, eric.carlson, esprehn+autocc, glenn, gyuyoung.kim, jer.noble, koivisto, philipj, rniwa, sergio

Priority:

Version:

528+ (Nightly build)

Hardware:

Unspecified

OS:

Unspecified

Attachments:

Description	Flags
Patch	none

Description Alexey Proskuryakov 2014-06-02 09:31:04 PDT

Seen this on bots. Doesn't seem to happen frequently, and probably not reproducible locally, but perhaps fixable based on stack trace? This sequence of calls seems crazy.

http://build.webkit.org/results/Apple%20Mavericks%20Debug%20WK1%20(Tests)/r169530%20(5705)/media/video-fullscreeen-only-controls-crash-log.txt

0   com.apple.JavaScriptCore      	0x000000010b2b723a WTFCrash + 42 (Assertions.cpp:333)
1   com.apple.WebCore             	0x000000010e6cc232 WebCore::TreeShared<WebCore::Node>::ref() + 178 (TreeShared.h:64)
2   com.apple.WebCore             	0x000000010e6d6c3d WTF::Ref<WebCore::Document>::Ref(WebCore::Document&) + 45 (Ref.h:38)
3   com.apple.WebCore             	0x000000010e6b7e6d WTF::Ref<WebCore::Document>::Ref(WebCore::Document&) + 29 (Ref.h:38)
4   com.apple.WebCore             	0x000000010e91f18d WebCore::ChildNodeInsertionNotifier::notify(WebCore::Node&) + 125 (ContainerNodeAlgorithms.h:224)
5   com.apple.WebCore             	0x000000010ed89677 WebCore::Element::addShadowRoot(WTF::PassRefPtr<WebCore::ShadowRoot>) + 247 (Element.cpp:1468)
6   com.apple.WebCore             	0x000000010ed89775 WebCore::Element::ensureUserAgentShadowRoot() + 85 (Element.cpp:1519)
--> why are we doing this while destructing everything?!
7   com.apple.WebCore             	0x000000010f0e3bbb WebCore::HTMLMediaElement::configureMediaControls() + 75 (HTMLMediaElement.cpp:5145)
8   com.apple.WebCore             	0x000000010f0e467b WebCore::HTMLMediaElement::removedFrom(WebCore::ContainerNode&) + 107 (HTMLMediaElement.cpp:712)
9   com.apple.WebCore             	0x000000010e926b7b WebCore::ChildNodeRemovalNotifier::notifyNodeRemovedFromDocument(WebCore::Node&) + 107 (ContainerNodeAlgorithms.h:242)
10  com.apple.WebCore             	0x000000010e91f4ab WebCore::ChildNodeRemovalNotifier::notify(WebCore::Node&) + 59 (ContainerNodeAlgorithms.h:259)
11  com.apple.WebCore             	0x000000010e923dd4 WebCore::Private::NodeRemovalDispatcher<WebCore::Node, WebCore::ContainerNode, true>::dispatch(WebCore::Node&, WebCore::ContainerNode&) + 116 (ContainerNodeAlgorithms.h:146)

Comment 1 Jer Noble 2014-06-09 10:23:20 PDT

*** Bug 133644 has been marked as a duplicate of this bug. ***

Comment 2 Jer Noble 2014-06-09 10:25:42 PDT

Created attachment 232711 [details]
Patch

Comment 3 WebKit Commit Bot 2014-06-09 13:10:49 PDT

Comment on attachment 232711 [details]
Patch

Clearing flags on attachment: 232711

Committed r169708: <http://trac.webkit.org/changeset/169708>

Comment 4 WebKit Commit Bot 2014-06-09 13:10:56 PDT

All reviewed patches have been landed.  Closing bug.