Bug 133450

Summary: ASSERT(!m_inRemovedLastRefFunction) in Element::addShadowRoot while destroying a document
Product: WebKit Reporter: Alexey Proskuryakov <ap>
Component: MediaAssignee: Jer Noble <jer.noble>
Status: RESOLVED FIXED    
Severity: Normal CC: calvaris, commit-queue, eric.carlson, esprehn+autocc, glenn, gyuyoung.kim, jer.noble, koivisto, philipj, rniwa, sergio
Priority: P2    
Version: 528+ (Nightly build)   
Hardware: Unspecified   
OS: Unspecified   
Attachments:
Description Flags
Patch none

Alexey Proskuryakov
Reported 2014-06-02 09:31:04 PDT
Seen this on bots. Doesn't seem to happen frequently, and probably not reproducible locally, but perhaps fixable based on stack trace? This sequence of calls seems crazy. http://build.webkit.org/results/Apple%20Mavericks%20Debug%20WK1%20(Tests)/r169530%20(5705)/media/video-fullscreeen-only-controls-crash-log.txt 0 com.apple.JavaScriptCore 0x000000010b2b723a WTFCrash + 42 (Assertions.cpp:333) 1 com.apple.WebCore 0x000000010e6cc232 WebCore::TreeShared<WebCore::Node>::ref() + 178 (TreeShared.h:64) 2 com.apple.WebCore 0x000000010e6d6c3d WTF::Ref<WebCore::Document>::Ref(WebCore::Document&) + 45 (Ref.h:38) 3 com.apple.WebCore 0x000000010e6b7e6d WTF::Ref<WebCore::Document>::Ref(WebCore::Document&) + 29 (Ref.h:38) 4 com.apple.WebCore 0x000000010e91f18d WebCore::ChildNodeInsertionNotifier::notify(WebCore::Node&) + 125 (ContainerNodeAlgorithms.h:224) 5 com.apple.WebCore 0x000000010ed89677 WebCore::Element::addShadowRoot(WTF::PassRefPtr<WebCore::ShadowRoot>) + 247 (Element.cpp:1468) 6 com.apple.WebCore 0x000000010ed89775 WebCore::Element::ensureUserAgentShadowRoot() + 85 (Element.cpp:1519) --> why are we doing this while destructing everything?! 7 com.apple.WebCore 0x000000010f0e3bbb WebCore::HTMLMediaElement::configureMediaControls() + 75 (HTMLMediaElement.cpp:5145) 8 com.apple.WebCore 0x000000010f0e467b WebCore::HTMLMediaElement::removedFrom(WebCore::ContainerNode&) + 107 (HTMLMediaElement.cpp:712) 9 com.apple.WebCore 0x000000010e926b7b WebCore::ChildNodeRemovalNotifier::notifyNodeRemovedFromDocument(WebCore::Node&) + 107 (ContainerNodeAlgorithms.h:242) 10 com.apple.WebCore 0x000000010e91f4ab WebCore::ChildNodeRemovalNotifier::notify(WebCore::Node&) + 59 (ContainerNodeAlgorithms.h:259) 11 com.apple.WebCore 0x000000010e923dd4 WebCore::Private::NodeRemovalDispatcher<WebCore::Node, WebCore::ContainerNode, true>::dispatch(WebCore::Node&, WebCore::ContainerNode&) + 116 (ContainerNodeAlgorithms.h:146)
Attachments
Patch (1.72 KB, patch)
2014-06-09 10:25 PDT, Jer Noble 		no flags
DetailsFormatted DiffDiff
View All Add attachment proposed patch, testcase, etc.
Jer Noble
Comment 1 2014-06-09 10:23:20 PDT
*** Bug 133644 has been marked as a duplicate of this bug. ***
Jer Noble
Comment 2 2014-06-09 10:25:42 PDT
Created attachment 232711 [details] Patch
WebKit Commit Bot
Comment 3 2014-06-09 13:10:49 PDT
Comment on attachment 232711 [details] Patch Clearing flags on attachment: 232711 Committed r169708: <http://trac.webkit.org/changeset/169708>
WebKit Commit Bot
Comment 4 2014-06-09 13:10:56 PDT
All reviewed patches have been landed. Closing bug.
Note You need to log in before you can comment on or make changes to this bug.