Summary: | ASSERTION FAILED: m_items.isEmpty() in CustomElementReactionQueue destructor | ||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|
Product: | WebKit | Reporter: | Ryan Haddad <ryanhaddad> | ||||||||
Component: | New Bugs | Assignee: | Ryosuke Niwa <rniwa> | ||||||||
Status: | RESOLVED FIXED | ||||||||||
Severity: | Normal | CC: | ap, cdumez, commit-queue, dbates, esprehn+autocc, kangil.han, rniwa, webkit-bug-importer | ||||||||
Priority: | P2 | Keywords: | InRadar | ||||||||
Version: | WebKit Nightly Build | ||||||||||
Hardware: | Unspecified | ||||||||||
OS: | Unspecified | ||||||||||
Bug Depends on: | 164814 | ||||||||||
Bug Blocks: | 154907 | ||||||||||
Attachments: |
|
Description
Ryan Haddad
2016-09-15 12:51:32 PDT
I haven't been able to reproduce this but this should be fixed in https://trac.webkit.org/changeset/207710 because we clear the queue for sure now. We’re still seeing this. Created attachment 296373 [details]
Fixes the bug
Created attachment 296420 [details]
Fixed a regression
Comment on attachment 296420 [details] Fixed a regression View in context: https://bugs.webkit.org/attachment.cgi?id=296420&action=review > Source/WebCore/dom/CustomElementReactionQueue.cpp:153 > + if (element.document().refCount() <= 0) I really don't like that we're checking the refCount. Could we instead check if the document's frame is null? A document's frame should always be null after calling prepareForDestruction() on it. > LayoutTests/ChangeLog:18 > +2016-12-07 Ryosuke Niwa <rniwa@webkit.org> Duplicate ChangeLog. Created attachment 296441 [details]
Removed a duplicate change log entry
(In reply to comment #7) > Comment on attachment 296420 [details] > Fixed a regression > > View in context: > https://bugs.webkit.org/attachment.cgi?id=296420&action=review > > > Source/WebCore/dom/CustomElementReactionQueue.cpp:153 > > + if (element.document().refCount() <= 0) > > I really don't like that we're checking the refCount. Could we instead check > if the document's frame is null? A document's frame should always be null > after calling prepareForDestruction() on it. I did that (checking active DOM objects are stopped instead) in my previous patch, and that broke the test case I’m adding (disconnected-callback-in-detached-iframe.html). Because custom elements are coming from a different realm (iframe), we still need to enqueue disconnectedCallback in such a case. An alternative approach is to add a flag on Document which indicates that we’re in the middle of Document tear down but I’m not sure that’s better than checking refcount. Committed r209582: <http://trac.webkit.org/changeset/209582> |