Bug 138620 – Regression(r175947): Caused assertions in debug builds

• Component: DOM
• Status: RESOLVED FIXED

[Chris Dumez]

ASSERTION FAILED: traversed == (current != end ? 1 : 0)
/Volumes/Data/slave/mavericks-debug/build/Source/WebCore/dom/CollectionIndexCache.h(98) : unsigned int WebCore::CollectionIndexCache<WebCore::HTMLCollection, WebCore::Element *>::computeNodeCountUpdatingListCache(const Collection &) [Collection = WebCore::HTMLCollection, Iterator = WebCore::Element *]
1   0x105970330 WTFCrash
2   0x109c0ff45 WebCore::CollectionIndexCache<WebCore::HTMLCollection, WebCore::Element*>::computeNodeCountUpdatingListCache(WebCore::HTMLCollection const&)
3   0x109c0e400 WebCore::CollectionIndexCache<WebCore::HTMLCollection, WebCore::Element*>::nodeCount(WebCore::HTMLCollection const&)
4   0x109c0c639 WebCore::HTMLCollection::length() const
5   0x10a193155 WebCore::JSHTMLCollection::getOwnPropertySlotByIndex(JSC::JSObject*, JSC::ExecState*, unsigned int, JSC::PropertySlot&)
6   0x10505dfbb JSC::JSObject::getPropertySlot(JSC::ExecState*, unsigned int, JSC::PropertySlot&)
7   0x10535c543 JSC::JSValue::get(JSC::ExecState*, unsigned int, JSC::PropertySlot&) const
8   0x105337d08 JSC::JSValue::get(JSC::ExecState*, unsigned int) const
9   0x10574aea3 JSC::LLInt::getByVal(JSC::ExecState*, JSC::JSValue, JSC::JSValue)
10  0x1057442e3 llint_slow_path_get_by_val
11  0x105751d35 llint_entry
12  0x10574e3c9 vmEntryToJavaScript
13  0x1055ddb4a JSC::JITCode::execute(JSC::VM*, JSC::ProtoCallFrame*)
14  0x1055c20d4 JSC::Interpreter::execute(JSC::ProgramExecutable*, JSC::ExecState*, JSC::JSObject*)
15  0x1051573f0 JSC::evaluate(JSC::ExecState*, JSC::SourceCode const&, JSC::JSValue, JSC::JSValue*)
16  0x10a276125 WebCore::JSMainThreadExecState::evaluate(JSC::ExecState*, JSC::SourceCode const&, JSC::JSValue, JSC::JSValue*)
17  0x10abfda5d WebCore::ScriptController::evaluateInWorld(WebCore::ScriptSourceCode const&, WebCore::DOMWrapperWorld&)
18  0x10abfdba4 WebCore::ScriptController::evaluate(WebCore::ScriptSourceCode const&)
19  0x10ac0d127 WebCore::ScriptElement::executeScript(WebCore::ScriptSourceCode const&)
20  0x10ac0c0f0 WebCore::ScriptElement::prepareScript(WTF::TextPosition const&, WebCore::ScriptElement::LegacyTypeSupport)
21  0x109ce30f9 WebCore::HTMLScriptRunner::runScript(WebCore::Element*, WTF::TextPosition const&)
22  0x109ce2f09 WebCore::HTMLScriptRunner::execute(WTF::PassRefPtr<WebCore::Element>, WTF::TextPosition const&)
23  0x109c22eb1 WebCore::HTMLDocumentParser::runScriptsForPausedTreeBuilder()
24  0x109c22ff8 WebCore::HTMLDocumentParser::canTakeNextToken(WebCore::HTMLDocumentParser::SynchronousMode, WebCore::PumpSession&)
25  0x109c2219f WebCore::HTMLDocumentParser::pumpTokenizer(WebCore::HTMLDocumentParser::SynchronousMode)
26  0x109c21c29 WebCore::HTMLDocumentParser::pumpTokenizerIfPossible(WebCore::HTMLDocumentParser::SynchronousMode)
27  0x109c23bc1 WebCore::HTMLDocumentParser::append(WTF::PassRefPtr<WTF::StringImpl>)
28  0x1096e251c WebCore::DecodedDataDocumentParser::appendBytes(WebCore::DocumentWriter&, char const*, unsigned long)
29  0x109805fce WebCore::DocumentWriter::addData(char const*, unsigned long)
30  0x1097cd826 WebCore::DocumentLoader::commitData(char const*, unsigned long)
31  0x1103d538d -[WebFrame(WebInternal) _commitData:]

[Chris Dumez]

Patch is coming shortly, just need to validate locally first.

[Chris Dumez]

Created attachment 241367 [details]
Patch

Still waiting for my build to complete so I can test this locally.

[Chris Dumez]

Created attachment 241370 [details]
Patch

[Chris Dumez]

Comment on attachment 241370 [details]
Patch

Clearing flags on attachment: 241370

Committed r175968: <http://trac.webkit.org/changeset/175968>

[Chris Dumez]

All reviewed patches have been landed.  Closing bug.

[Darin Adler]

Thanks for fixing this. Sorry!