Bug 163309

Summary: Optional's move-constructor and move-assignment operator don't disengage the value being moved from
Product: WebKit Reporter: Sam Weinig <sam>
Component: Web Template FrameworkAssignee: Sam Weinig <sam>
Status: RESOLVED DUPLICATE    
Severity: Normal CC: benjamin, cdumez, cmarcelo, commit-queue, dbates, ddkilzer, ryanhaddad
Priority: P2    
Version: WebKit Local Build   
Hardware: Unspecified   
OS: Unspecified   
See Also: https://bugs.webkit.org/show_bug.cgi?id=192728
Attachments:
Description Flags
Patch
andersca: review+, buildbot: commit-queue-
Archive of layout-test-results from ews112 for mac-yosemite none

Description Sam Weinig 2016-10-11 18:39:51 PDT
Optional's move-constructor and move-assignment operator don't disengage the value being moved from.
Comment 1 Sam Weinig 2016-10-11 18:41:56 PDT
Created attachment 291325 [details]
Patch
Comment 2 Chris Dumez 2016-10-11 19:31:14 PDT
Is this what's causing crashes when trying to use a union of interfaces in IDL?
Comment 3 Build Bot 2016-10-11 19:41:40 PDT
Comment on attachment 291325 [details]
Patch

Attachment 291325 [details] did not pass mac-debug-ews (mac):
Output: http://webkit-queues.webkit.org/results/2266728

Number of test failures exceeded the failure limit.
Comment 4 Build Bot 2016-10-11 19:41:44 PDT
Created attachment 291327 [details]
Archive of layout-test-results from ews112 for mac-yosemite

The attached test failures were seen while running run-webkit-tests on the mac-debug-ews.
Bot: ews112  Port: mac-yosemite  Platform: Mac OS X 10.10.5
Comment 5 Sam Weinig 2016-10-11 21:05:50 PDT
(In reply to comment #2)
> Is this what's causing crashes when trying to use a union of interfaces in
> IDL?

That's how I found it.
Comment 6 Chris Dumez 2016-10-11 21:26:00 PDT
(In reply to comment #5)
> (In reply to comment #2)
> > Is this what's causing crashes when trying to use a union of interfaces in
> > IDL?
> 
> That's how I found it.

Great, looking forward to this landing then because I hit the crash as well when trying to use such union :)
Comment 7 Sam Weinig 2016-10-12 10:44:35 PDT
Fixed in https://trac.webkit.org/changeset/207225.
Comment 8 Ryan Haddad 2016-10-12 13:41:14 PDT
Reverted r207225 for reason:

This change causes debug tests to exit early with crashes.

Committed r207237: <http://trac.webkit.org/changeset/207237>
Comment 10 Chris Dumez 2016-10-12 13:44:21 PDT
Same as on EWS:
Thread 0 Crashed:: Dispatch queue: com.apple.main-thread
0   com.apple.JavaScriptCore      	0x00000001115e62d7 WTFCrash + 39 (Assertions.cpp:323)
1   com.apple.JavaScriptCore      	0x00000001115e62f9 WTFCrashWithSecurityImplication + 9
2   com.apple.WebCore             	0x00000001143c2ed9 WebCore::EventDispatcher::dispatchEvent(WebCore::Node*, WebCore::Event&) + 73 (EventDispatcher.cpp:153)
3   com.apple.WebCore             	0x000000011582533d WebCore::Node::dispatchEvent(WebCore::Event&) + 29 (Node.cpp:2147)
4   com.apple.WebCore             	0x0000000114210ccd WebCore::Document::setReadyState(WebCore::Document::ReadyState) + 349 (Document.cpp:1239)
5   com.apple.WebCore             	0x00000001145a8465 WebCore::FrameLoader::checkCompleted() + 261 (FrameLoader.cpp:816)
6   com.apple.WebCore             	0x0000000114218f50 WebCore::Document::explicitClose() + 160 (Document.cpp:2632)
7   com.apple.WebCore             	0x0000000114218ea9 WebCore::Document::cancelParsing() + 73 (Document.cpp:2532)
8   com.apple.WebCore             	0x00000001145a4b1d WebCore::FrameLoader::init() + 349 (FrameLoader.cpp:293)
9   com.apple.WebKit              	0x000000010d2c169c WebCore::Frame::init() + 28 (Frame.h:330)
10  com.apple.WebKit              	0x000000010d2bc309 WebKit::WebFrame::createWithCoreMainFrame(WebKit::WebPage*, WebCore::Frame*) + 745 (WebFrame.cpp:120)
11  com.apple.WebKit              	0x000000010d3b51a9 WebKit::WebPage::WebPage(unsigned long long, WebKit::WebPageCreationParameters const&) + 7801 (WebPage.cpp:441)
12  com.apple.WebKit              	0x000000010d3b3325 WebKit::WebPage::WebPage(unsigned long long, WebKit::WebPageCreationParameters const&) + 37 (WebPage.cpp:573)
13  com.apple.WebKit              	0x000000010d3b3263 WebKit::WebPage::create(unsigned long long, WebKit::WebPageCreationParameters const&) + 67 (WebPage.cpp:284)
14  com.apple.WebKit              	0x000000010d5714d8 WebKit::WebProcess::createWebPage(unsigned long long, WebKit::WebPageCreationParameters const&) + 200 (WebProcess.cpp:581)
15  com.apple.WebKit              	0x000000010d5c22b8 void IPC::callMemberFunctionImpl<WebKit::WebProcess, void (WebKit::WebProcess::*)(unsigned long long, WebKit::WebPageCreationParameters const&), std::__1::tuple<unsigned long long, WebKit::WebPageCreationParameters>, 0ul, 1ul>(WebKit::WebProcess*, void (WebKit::WebProcess::*)(unsigned long long, WebKit::WebPageCreationParameters const&), std::__1::tuple<unsigned long long, WebKit::WebPageCreationParameters>&&, std::__1::integer_sequence<unsigned long, 0ul, 1ul>) + 200 (HandleMessage.h:16)
16  com.apple.WebKit              	0x000000010d5c20a8 void IPC::callMemberFunction<WebKit::WebProcess, void (WebKit::WebProcess::*)(unsigned long long, WebKit::WebPageCreationParameters const&), std::__1::tuple<unsigned long long, WebKit::WebPageCreationParameters>, std::__1::integer_sequence<unsigned long, 0ul, 1ul> >(std::__1::tuple<unsigned long long, WebKit::WebPageCreationParameters>&&, WebKit::WebProcess*, void (WebKit::WebProcess::*)(unsigned long long, WebKit::WebPageCreationParameters const&)) + 88 (HandleMessage.h:22)
17  com.apple.WebKit              	0x000000010d5bdc04 void IPC::handleMessage<Messages::WebProcess::CreateWebPage, WebKit::WebProcess, void (WebKit::WebProcess::*)(unsigned long long, WebKit::WebPageCreationParameters const&)>(IPC::Decoder&, WebKit::WebProcess*, void (WebKit::WebProcess::*)(unsigned long long, WebKit::WebPageCreationParameters const&)) + 324 (HandleMessage.h:102)
18  com.apple.WebKit              	0x000000010d5bbccd WebKit::WebProcess::didReceiveWebProcessMessage(IPC::Connection&, IPC::Decoder&) + 237 (WebProcessMessageReceiver.cpp:63)
19  com.apple.WebKit              	0x000000010d571a9b WebKit::WebProcess::didReceiveMessage(IPC::Connection&, IPC::Decoder&) + 155 (WebProcess.cpp:645)
20  com.apple.WebKit              	0x000000010cd215f3 IPC::Connection::dispatchMessage(IPC::Decoder&) + 51 (Connection.cpp:897)
21  com.apple.WebKit              	0x000000010cd18201 IPC::Connection::dispatchMessage(std::__1::unique_ptr<IPC::Decoder, std::__1::default_delete<IPC::Decoder> >) + 721 (Connection.cpp:925)
22  com.apple.WebKit              	0x000000010cd21bff IPC::Connection::dispatchOneMessage() + 1535 (Connection.cpp:954)
23  com.apple.WebKit              	0x000000010cd28c2d IPC::Connection::enqueueIncomingMessage(std::__1::unique_ptr<IPC::Decoder, std::__1::default_delete<IPC::Decoder> >)::$_14::operator()() + 29 (Connection.cpp:891)
24  com.apple.WebKit              	0x000000010cd28b7c WTF::Function<void ()>::CallableWrapper<IPC::Connection::enqueueIncomingMessage(std::__1::unique_ptr<IPC::Decoder, std::__1::default_delete<IPC::Decoder> >)::$_14>::call() + 28 (Function.h:89)
25  com.apple.JavaScriptCore      	0x0000000111616443 WTF::Function<void ()>::operator()() const + 99 (Function.h:50)
26  com.apple.JavaScriptCore      	0x0000000111633a58 WTF::RunLoop::performWork() + 440 (RunLoop.cpp:123)
27  com.apple.JavaScriptCore      	0x0000000111634124 WTF::RunLoop::performWork(void*) + 36 (RunLoopCF.cpp:38)
28  com.apple.CoreFoundation      	0x00007fff9eeb6881 __CFRUNLOOP_IS_CALLING_OUT_TO_A_SOURCE0_PERFORM_FUNCTION__
Comment 11 Chris Dumez 2016-10-12 13:50:01 PDT
(In reply to comment #10)
> Same as on EWS:
> Thread 0 Crashed:: Dispatch queue: com.apple.main-thread
> 0   com.apple.JavaScriptCore      	0x00000001115e62d7 WTFCrash + 39
> (Assertions.cpp:323)
> 1   com.apple.JavaScriptCore      	0x00000001115e62f9
> WTFCrashWithSecurityImplication + 9
> 2   com.apple.WebCore             	0x00000001143c2ed9
> WebCore::EventDispatcher::dispatchEvent(WebCore::Node*, WebCore::Event&) +
> 73 (EventDispatcher.cpp:153)
> 3   com.apple.WebCore             	0x000000011582533d
> WebCore::Node::dispatchEvent(WebCore::Event&) + 29 (Node.cpp:2147)
> 4   com.apple.WebCore             	0x0000000114210ccd
> WebCore::Document::setReadyState(WebCore::Document::ReadyState) + 349
> (Document.cpp:1239)
> 5   com.apple.WebCore             	0x00000001145a8465
> WebCore::FrameLoader::checkCompleted() + 261 (FrameLoader.cpp:816)
> 6   com.apple.WebCore             	0x0000000114218f50
> WebCore::Document::explicitClose() + 160 (Document.cpp:2632)
> 7   com.apple.WebCore             	0x0000000114218ea9
> WebCore::Document::cancelParsing() + 73 (Document.cpp:2532)
> 8   com.apple.WebCore             	0x00000001145a4b1d
> WebCore::FrameLoader::init() + 349 (FrameLoader.cpp:293)
> 9   com.apple.WebKit              	0x000000010d2c169c WebCore::Frame::init()
> + 28 (Frame.h:330)
> 10  com.apple.WebKit              	0x000000010d2bc309
> WebKit::WebFrame::createWithCoreMainFrame(WebKit::WebPage*, WebCore::Frame*)
> + 745 (WebFrame.cpp:120)
> 11  com.apple.WebKit              	0x000000010d3b51a9
> WebKit::WebPage::WebPage(unsigned long long,
> WebKit::WebPageCreationParameters const&) + 7801 (WebPage.cpp:441)
> 12  com.apple.WebKit              	0x000000010d3b3325
> WebKit::WebPage::WebPage(unsigned long long,
> WebKit::WebPageCreationParameters const&) + 37 (WebPage.cpp:573)
> 13  com.apple.WebKit              	0x000000010d3b3263
> WebKit::WebPage::create(unsigned long long,
> WebKit::WebPageCreationParameters const&) + 67 (WebPage.cpp:284)
> 14  com.apple.WebKit              	0x000000010d5714d8
> WebKit::WebProcess::createWebPage(unsigned long long,
> WebKit::WebPageCreationParameters const&) + 200 (WebProcess.cpp:581)
> 15  com.apple.WebKit              	0x000000010d5c22b8 void
> IPC::callMemberFunctionImpl<WebKit::WebProcess, void
> (WebKit::WebProcess::*)(unsigned long long,
> WebKit::WebPageCreationParameters const&), std::__1::tuple<unsigned long
> long, WebKit::WebPageCreationParameters>, 0ul, 1ul>(WebKit::WebProcess*,
> void (WebKit::WebProcess::*)(unsigned long long,
> WebKit::WebPageCreationParameters const&), std::__1::tuple<unsigned long
> long, WebKit::WebPageCreationParameters>&&,
> std::__1::integer_sequence<unsigned long, 0ul, 1ul>) + 200
> (HandleMessage.h:16)
> 16  com.apple.WebKit              	0x000000010d5c20a8 void
> IPC::callMemberFunction<WebKit::WebProcess, void
> (WebKit::WebProcess::*)(unsigned long long,
> WebKit::WebPageCreationParameters const&), std::__1::tuple<unsigned long
> long, WebKit::WebPageCreationParameters>,
> std::__1::integer_sequence<unsigned long, 0ul, 1ul>
> >(std::__1::tuple<unsigned long long, WebKit::WebPageCreationParameters>&&,
> WebKit::WebProcess*, void (WebKit::WebProcess::*)(unsigned long long,
> WebKit::WebPageCreationParameters const&)) + 88 (HandleMessage.h:22)
> 17  com.apple.WebKit              	0x000000010d5bdc04 void
> IPC::handleMessage<Messages::WebProcess::CreateWebPage, WebKit::WebProcess,
> void (WebKit::WebProcess::*)(unsigned long long,
> WebKit::WebPageCreationParameters const&)>(IPC::Decoder&,
> WebKit::WebProcess*, void (WebKit::WebProcess::*)(unsigned long long,
> WebKit::WebPageCreationParameters const&)) + 324 (HandleMessage.h:102)
> 18  com.apple.WebKit              	0x000000010d5bbccd
> WebKit::WebProcess::didReceiveWebProcessMessage(IPC::Connection&,
> IPC::Decoder&) + 237 (WebProcessMessageReceiver.cpp:63)
> 19  com.apple.WebKit              	0x000000010d571a9b
> WebKit::WebProcess::didReceiveMessage(IPC::Connection&, IPC::Decoder&) + 155
> (WebProcess.cpp:645)
> 20  com.apple.WebKit              	0x000000010cd215f3
> IPC::Connection::dispatchMessage(IPC::Decoder&) + 51 (Connection.cpp:897)
> 21  com.apple.WebKit              	0x000000010cd18201
> IPC::Connection::dispatchMessage(std::__1::unique_ptr<IPC::Decoder,
> std::__1::default_delete<IPC::Decoder> >) + 721 (Connection.cpp:925)
> 22  com.apple.WebKit              	0x000000010cd21bff
> IPC::Connection::dispatchOneMessage() + 1535 (Connection.cpp:954)
> 23  com.apple.WebKit              	0x000000010cd28c2d
> IPC::Connection::enqueueIncomingMessage(std::__1::unique_ptr<IPC::Decoder,
> std::__1::default_delete<IPC::Decoder> >)::$_14::operator()() + 29
> (Connection.cpp:891)
> 24  com.apple.WebKit              	0x000000010cd28b7c WTF::Function<void
> ()>::CallableWrapper<IPC::Connection::enqueueIncomingMessage(std::__1::
> unique_ptr<IPC::Decoder, std::__1::default_delete<IPC::Decoder>
> >)::$_14>::call() + 28 (Function.h:89)
> 25  com.apple.JavaScriptCore      	0x0000000111616443 WTF::Function<void
> ()>::operator()() const + 99 (Function.h:50)
> 26  com.apple.JavaScriptCore      	0x0000000111633a58
> WTF::RunLoop::performWork() + 440 (RunLoop.cpp:123)
> 27  com.apple.JavaScriptCore      	0x0000000111634124
> WTF::RunLoop::performWork(void*) + 36 (RunLoopCF.cpp:38)
> 28  com.apple.CoreFoundation      	0x00007fff9eeb6881
> __CFRUNLOOP_IS_CALLING_OUT_TO_A_SOURCE0_PERFORM_FUNCTION__

Could be related to Optional<NoEventDispatchAssertion> m_eventDispatchAssertion; in ElementIteratorAssertions somehow.
Comment 12 Chris Dumez 2016-10-12 13:51:41 PDT
(In reply to comment #11)
> (In reply to comment #10)
> > Same as on EWS:
> > Thread 0 Crashed:: Dispatch queue: com.apple.main-thread
> > 0   com.apple.JavaScriptCore      	0x00000001115e62d7 WTFCrash + 39
> > (Assertions.cpp:323)
> > 1   com.apple.JavaScriptCore      	0x00000001115e62f9
> > WTFCrashWithSecurityImplication + 9
> > 2   com.apple.WebCore             	0x00000001143c2ed9
> > WebCore::EventDispatcher::dispatchEvent(WebCore::Node*, WebCore::Event&) +
> > 73 (EventDispatcher.cpp:153)
> > 3   com.apple.WebCore             	0x000000011582533d
> > WebCore::Node::dispatchEvent(WebCore::Event&) + 29 (Node.cpp:2147)
> > 4   com.apple.WebCore             	0x0000000114210ccd
> > WebCore::Document::setReadyState(WebCore::Document::ReadyState) + 349
> > (Document.cpp:1239)
> > 5   com.apple.WebCore             	0x00000001145a8465
> > WebCore::FrameLoader::checkCompleted() + 261 (FrameLoader.cpp:816)
> > 6   com.apple.WebCore             	0x0000000114218f50
> > WebCore::Document::explicitClose() + 160 (Document.cpp:2632)
> > 7   com.apple.WebCore             	0x0000000114218ea9
> > WebCore::Document::cancelParsing() + 73 (Document.cpp:2532)
> > 8   com.apple.WebCore             	0x00000001145a4b1d
> > WebCore::FrameLoader::init() + 349 (FrameLoader.cpp:293)
> > 9   com.apple.WebKit              	0x000000010d2c169c WebCore::Frame::init()
> > + 28 (Frame.h:330)
> > 10  com.apple.WebKit              	0x000000010d2bc309
> > WebKit::WebFrame::createWithCoreMainFrame(WebKit::WebPage*, WebCore::Frame*)
> > + 745 (WebFrame.cpp:120)
> > 11  com.apple.WebKit              	0x000000010d3b51a9
> > WebKit::WebPage::WebPage(unsigned long long,
> > WebKit::WebPageCreationParameters const&) + 7801 (WebPage.cpp:441)
> > 12  com.apple.WebKit              	0x000000010d3b3325
> > WebKit::WebPage::WebPage(unsigned long long,
> > WebKit::WebPageCreationParameters const&) + 37 (WebPage.cpp:573)
> > 13  com.apple.WebKit              	0x000000010d3b3263
> > WebKit::WebPage::create(unsigned long long,
> > WebKit::WebPageCreationParameters const&) + 67 (WebPage.cpp:284)
> > 14  com.apple.WebKit              	0x000000010d5714d8
> > WebKit::WebProcess::createWebPage(unsigned long long,
> > WebKit::WebPageCreationParameters const&) + 200 (WebProcess.cpp:581)
> > 15  com.apple.WebKit              	0x000000010d5c22b8 void
> > IPC::callMemberFunctionImpl<WebKit::WebProcess, void
> > (WebKit::WebProcess::*)(unsigned long long,
> > WebKit::WebPageCreationParameters const&), std::__1::tuple<unsigned long
> > long, WebKit::WebPageCreationParameters>, 0ul, 1ul>(WebKit::WebProcess*,
> > void (WebKit::WebProcess::*)(unsigned long long,
> > WebKit::WebPageCreationParameters const&), std::__1::tuple<unsigned long
> > long, WebKit::WebPageCreationParameters>&&,
> > std::__1::integer_sequence<unsigned long, 0ul, 1ul>) + 200
> > (HandleMessage.h:16)
> > 16  com.apple.WebKit              	0x000000010d5c20a8 void
> > IPC::callMemberFunction<WebKit::WebProcess, void
> > (WebKit::WebProcess::*)(unsigned long long,
> > WebKit::WebPageCreationParameters const&), std::__1::tuple<unsigned long
> > long, WebKit::WebPageCreationParameters>,
> > std::__1::integer_sequence<unsigned long, 0ul, 1ul>
> > >(std::__1::tuple<unsigned long long, WebKit::WebPageCreationParameters>&&,
> > WebKit::WebProcess*, void (WebKit::WebProcess::*)(unsigned long long,
> > WebKit::WebPageCreationParameters const&)) + 88 (HandleMessage.h:22)
> > 17  com.apple.WebKit              	0x000000010d5bdc04 void
> > IPC::handleMessage<Messages::WebProcess::CreateWebPage, WebKit::WebProcess,
> > void (WebKit::WebProcess::*)(unsigned long long,
> > WebKit::WebPageCreationParameters const&)>(IPC::Decoder&,
> > WebKit::WebProcess*, void (WebKit::WebProcess::*)(unsigned long long,
> > WebKit::WebPageCreationParameters const&)) + 324 (HandleMessage.h:102)
> > 18  com.apple.WebKit              	0x000000010d5bbccd
> > WebKit::WebProcess::didReceiveWebProcessMessage(IPC::Connection&,
> > IPC::Decoder&) + 237 (WebProcessMessageReceiver.cpp:63)
> > 19  com.apple.WebKit              	0x000000010d571a9b
> > WebKit::WebProcess::didReceiveMessage(IPC::Connection&, IPC::Decoder&) + 155
> > (WebProcess.cpp:645)
> > 20  com.apple.WebKit              	0x000000010cd215f3
> > IPC::Connection::dispatchMessage(IPC::Decoder&) + 51 (Connection.cpp:897)
> > 21  com.apple.WebKit              	0x000000010cd18201
> > IPC::Connection::dispatchMessage(std::__1::unique_ptr<IPC::Decoder,
> > std::__1::default_delete<IPC::Decoder> >) + 721 (Connection.cpp:925)
> > 22  com.apple.WebKit              	0x000000010cd21bff
> > IPC::Connection::dispatchOneMessage() + 1535 (Connection.cpp:954)
> > 23  com.apple.WebKit              	0x000000010cd28c2d
> > IPC::Connection::enqueueIncomingMessage(std::__1::unique_ptr<IPC::Decoder,
> > std::__1::default_delete<IPC::Decoder> >)::$_14::operator()() + 29
> > (Connection.cpp:891)
> > 24  com.apple.WebKit              	0x000000010cd28b7c WTF::Function<void
> > ()>::CallableWrapper<IPC::Connection::enqueueIncomingMessage(std::__1::
> > unique_ptr<IPC::Decoder, std::__1::default_delete<IPC::Decoder>
> > >)::$_14>::call() + 28 (Function.h:89)
> > 25  com.apple.JavaScriptCore      	0x0000000111616443 WTF::Function<void
> > ()>::operator()() const + 99 (Function.h:50)
> > 26  com.apple.JavaScriptCore      	0x0000000111633a58
> > WTF::RunLoop::performWork() + 440 (RunLoop.cpp:123)
> > 27  com.apple.JavaScriptCore      	0x0000000111634124
> > WTF::RunLoop::performWork(void*) + 36 (RunLoopCF.cpp:38)
> > 28  com.apple.CoreFoundation      	0x00007fff9eeb6881
> > __CFRUNLOOP_IS_CALLING_OUT_TO_A_SOURCE0_PERFORM_FUNCTION__
> 
> Could be related to Optional<NoEventDispatchAssertion>
> m_eventDispatchAssertion; in ElementIteratorAssertions somehow.

This is the only NoEventDispatchAssertion I found using Optional<>. And the assertion we hit is related to NoEventDispatchAssertion.
Comment 13 Chris Dumez 2016-10-12 13:53:27 PDT
(In reply to comment #12)
> (In reply to comment #11)
> > (In reply to comment #10)
> > > Same as on EWS:
> > > Thread 0 Crashed:: Dispatch queue: com.apple.main-thread
> > > 0   com.apple.JavaScriptCore      	0x00000001115e62d7 WTFCrash + 39
> > > (Assertions.cpp:323)
> > > 1   com.apple.JavaScriptCore      	0x00000001115e62f9
> > > WTFCrashWithSecurityImplication + 9
> > > 2   com.apple.WebCore             	0x00000001143c2ed9
> > > WebCore::EventDispatcher::dispatchEvent(WebCore::Node*, WebCore::Event&) +
> > > 73 (EventDispatcher.cpp:153)
> > > 3   com.apple.WebCore             	0x000000011582533d
> > > WebCore::Node::dispatchEvent(WebCore::Event&) + 29 (Node.cpp:2147)
> > > 4   com.apple.WebCore             	0x0000000114210ccd
> > > WebCore::Document::setReadyState(WebCore::Document::ReadyState) + 349
> > > (Document.cpp:1239)
> > > 5   com.apple.WebCore             	0x00000001145a8465
> > > WebCore::FrameLoader::checkCompleted() + 261 (FrameLoader.cpp:816)
> > > 6   com.apple.WebCore             	0x0000000114218f50
> > > WebCore::Document::explicitClose() + 160 (Document.cpp:2632)
> > > 7   com.apple.WebCore             	0x0000000114218ea9
> > > WebCore::Document::cancelParsing() + 73 (Document.cpp:2532)
> > > 8   com.apple.WebCore             	0x00000001145a4b1d
> > > WebCore::FrameLoader::init() + 349 (FrameLoader.cpp:293)
> > > 9   com.apple.WebKit              	0x000000010d2c169c WebCore::Frame::init()
> > > + 28 (Frame.h:330)
> > > 10  com.apple.WebKit              	0x000000010d2bc309
> > > WebKit::WebFrame::createWithCoreMainFrame(WebKit::WebPage*, WebCore::Frame*)
> > > + 745 (WebFrame.cpp:120)
> > > 11  com.apple.WebKit              	0x000000010d3b51a9
> > > WebKit::WebPage::WebPage(unsigned long long,
> > > WebKit::WebPageCreationParameters const&) + 7801 (WebPage.cpp:441)
> > > 12  com.apple.WebKit              	0x000000010d3b3325
> > > WebKit::WebPage::WebPage(unsigned long long,
> > > WebKit::WebPageCreationParameters const&) + 37 (WebPage.cpp:573)
> > > 13  com.apple.WebKit              	0x000000010d3b3263
> > > WebKit::WebPage::create(unsigned long long,
> > > WebKit::WebPageCreationParameters const&) + 67 (WebPage.cpp:284)
> > > 14  com.apple.WebKit              	0x000000010d5714d8
> > > WebKit::WebProcess::createWebPage(unsigned long long,
> > > WebKit::WebPageCreationParameters const&) + 200 (WebProcess.cpp:581)
> > > 15  com.apple.WebKit              	0x000000010d5c22b8 void
> > > IPC::callMemberFunctionImpl<WebKit::WebProcess, void
> > > (WebKit::WebProcess::*)(unsigned long long,
> > > WebKit::WebPageCreationParameters const&), std::__1::tuple<unsigned long
> > > long, WebKit::WebPageCreationParameters>, 0ul, 1ul>(WebKit::WebProcess*,
> > > void (WebKit::WebProcess::*)(unsigned long long,
> > > WebKit::WebPageCreationParameters const&), std::__1::tuple<unsigned long
> > > long, WebKit::WebPageCreationParameters>&&,
> > > std::__1::integer_sequence<unsigned long, 0ul, 1ul>) + 200
> > > (HandleMessage.h:16)
> > > 16  com.apple.WebKit              	0x000000010d5c20a8 void
> > > IPC::callMemberFunction<WebKit::WebProcess, void
> > > (WebKit::WebProcess::*)(unsigned long long,
> > > WebKit::WebPageCreationParameters const&), std::__1::tuple<unsigned long
> > > long, WebKit::WebPageCreationParameters>,
> > > std::__1::integer_sequence<unsigned long, 0ul, 1ul>
> > > >(std::__1::tuple<unsigned long long, WebKit::WebPageCreationParameters>&&,
> > > WebKit::WebProcess*, void (WebKit::WebProcess::*)(unsigned long long,
> > > WebKit::WebPageCreationParameters const&)) + 88 (HandleMessage.h:22)
> > > 17  com.apple.WebKit              	0x000000010d5bdc04 void
> > > IPC::handleMessage<Messages::WebProcess::CreateWebPage, WebKit::WebProcess,
> > > void (WebKit::WebProcess::*)(unsigned long long,
> > > WebKit::WebPageCreationParameters const&)>(IPC::Decoder&,
> > > WebKit::WebProcess*, void (WebKit::WebProcess::*)(unsigned long long,
> > > WebKit::WebPageCreationParameters const&)) + 324 (HandleMessage.h:102)
> > > 18  com.apple.WebKit              	0x000000010d5bbccd
> > > WebKit::WebProcess::didReceiveWebProcessMessage(IPC::Connection&,
> > > IPC::Decoder&) + 237 (WebProcessMessageReceiver.cpp:63)
> > > 19  com.apple.WebKit              	0x000000010d571a9b
> > > WebKit::WebProcess::didReceiveMessage(IPC::Connection&, IPC::Decoder&) + 155
> > > (WebProcess.cpp:645)
> > > 20  com.apple.WebKit              	0x000000010cd215f3
> > > IPC::Connection::dispatchMessage(IPC::Decoder&) + 51 (Connection.cpp:897)
> > > 21  com.apple.WebKit              	0x000000010cd18201
> > > IPC::Connection::dispatchMessage(std::__1::unique_ptr<IPC::Decoder,
> > > std::__1::default_delete<IPC::Decoder> >) + 721 (Connection.cpp:925)
> > > 22  com.apple.WebKit              	0x000000010cd21bff
> > > IPC::Connection::dispatchOneMessage() + 1535 (Connection.cpp:954)
> > > 23  com.apple.WebKit              	0x000000010cd28c2d
> > > IPC::Connection::enqueueIncomingMessage(std::__1::unique_ptr<IPC::Decoder,
> > > std::__1::default_delete<IPC::Decoder> >)::$_14::operator()() + 29
> > > (Connection.cpp:891)
> > > 24  com.apple.WebKit              	0x000000010cd28b7c WTF::Function<void
> > > ()>::CallableWrapper<IPC::Connection::enqueueIncomingMessage(std::__1::
> > > unique_ptr<IPC::Decoder, std::__1::default_delete<IPC::Decoder>
> > > >)::$_14>::call() + 28 (Function.h:89)
> > > 25  com.apple.JavaScriptCore      	0x0000000111616443 WTF::Function<void
> > > ()>::operator()() const + 99 (Function.h:50)
> > > 26  com.apple.JavaScriptCore      	0x0000000111633a58
> > > WTF::RunLoop::performWork() + 440 (RunLoop.cpp:123)
> > > 27  com.apple.JavaScriptCore      	0x0000000111634124
> > > WTF::RunLoop::performWork(void*) + 36 (RunLoopCF.cpp:38)
> > > 28  com.apple.CoreFoundation      	0x00007fff9eeb6881
> > > __CFRUNLOOP_IS_CALLING_OUT_TO_A_SOURCE0_PERFORM_FUNCTION__
> > 
> > Could be related to Optional<NoEventDispatchAssertion>
> > m_eventDispatchAssertion; in ElementIteratorAssertions somehow.
> 
> This is the only NoEventDispatchAssertion I found using Optional<>. And the
> assertion we hit is related to NoEventDispatchAssertion.

Chances are that the NoEventDispatchAssertion destructor is somehow no longer called when clearing out the Optional<>?
Comment 14 Chris Dumez 2016-10-12 13:57:24 PDT
Comment on attachment 291325 [details]
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=291325&action=review

> Source/WTF/wtf/Optional.h:76
> +            other.m_isEngaged = false;

I think this means other's destructor no longer calls its internal type's destructor because the destructor is only called when m_isEngaged is true.
Comment 15 Chris Dumez 2016-10-12 13:58:12 PDT
Comment on attachment 291325 [details]
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=291325&action=review

>> Source/WTF/wtf/Optional.h:76
>> +            other.m_isEngaged = false;
> 
> I think this means other's destructor no longer calls its internal type's destructor because the destructor is only called when m_isEngaged is true.

maybe we should call other.destroy() instead?
Comment 16 Sam Weinig 2016-10-18 13:04:12 PDT
(In reply to comment #15)
> Comment on attachment 291325 [details]
> Patch
> 
> View in context:
> https://bugs.webkit.org/attachment.cgi?id=291325&action=review
> 
> >> Source/WTF/wtf/Optional.h:76
> >> +            other.m_isEngaged = false;
> > 
> > I think this means other's destructor no longer calls its internal type's destructor because the destructor is only called when m_isEngaged is true.
> 
> maybe we should call other.destroy() instead?

I was wrong. Optional is fine. Since the value is moved out, everything should work as expected.
Comment 17 David Kilzer (:ddkilzer) 2018-12-14 16:54:36 PST
This was rolled out in r207237, so RESOLVED/FIXED is not really the correct status.

Duping to Bug 192728.

*** This bug has been marked as a duplicate of bug 192728 ***