Bug 37720

Summary: HTMLFrameSetElement-window-eventListener-attributes.html sometimes crashes on SnowLeopard Release
Product: WebKit Reporter: Adam Roben (:aroben) <aroben>
Component: WebCore Misc.Assignee: Alexey Proskuryakov <ap>
Status: RESOLVED FIXED    
Severity: Normal CC: ap, ggaren
Priority: P1 Keywords: InRadar, LayoutTestFailure
Version: 528+ (Nightly build)   
Hardware: Macintosh   
OS: OS X 10.6   
URL: http://build.webkit.org/results/SnowLeopard%20Intel%20Leaks/r57725%20(6051)/results.html
Attachments:
Description Flags
test (will assert)
none
proposed fix abarth: review+

Description Adam Roben (:aroben) 2010-04-16 11:49:11 PDT
HTMLFrameSetElement-window-eventListener-attributes.html sometimes crashes on SnowLeopard Release. Unfortunately the bots don't seem to be saving crash logs. :-(
Comment 1 Adam Roben (:aroben) 2010-04-16 11:52:55 PDT
I added this test to the Skipped file in r57731.
Comment 2 Alexey Proskuryakov 2010-04-16 12:22:53 PDT
<rdar://problem/7873752>
Comment 3 Alexey Proskuryakov 2010-04-16 13:00:54 PDT
There is a good chance that the disabled test is innocent.

In debug mode, fast/dom/Window/HTMLBodyElement-window-eventListener-attributes.html randomly crashes, which may make subsequent tests crash:

run-webkit-tests --repeat-each 100 fast/dom/Window

The debug crash is an assertion failure, ASSERT(m_wrapper || !m_jsFunction) in JSEventListener::jsFunction().
Comment 4 Alexey Proskuryakov 2010-04-16 13:47:57 PDT
Created attachment 53560 [details]
test (will assert)
Comment 5 Adam Roben (:aroben) 2010-04-16 14:02:33 PDT
(In reply to comment #3)
> There is a good chance that the disabled test is innocent.
> 
> In debug mode,
> fast/dom/Window/HTMLBodyElement-window-eventListener-attributes.html randomly
> crashes, which may make subsequent tests crash:

Should we skip this test instead?

This has now crashed on Windows as well: http://build.webkit.org/results/Windows%20Debug%20(Tests)/r57731%20(12262)/results.html
Comment 6 Alexey Proskuryakov 2010-04-16 15:20:39 PDT
Created attachment 53570 [details]
proposed fix
Comment 7 Adam Barth 2010-04-17 13:21:26 PDT
Comment on attachment 53570 [details]
proposed fix

Interesting bug.  It seems like another solution is to keep the body wrapper alive.  Can you and some text to the ChangeLog explaining why this approach is better?

+ window onject

typo
Comment 8 Alexey Proskuryakov 2010-04-17 23:09:36 PDT
Committed <http://trac.webkit.org/changeset/57790>.

> It seems like another solution is to keep the body wrapper alive.  
> Can you and some text to the ChangeLog explaining why this approach is better?

Maybe it's better to explain it here - ChangeLog explains what was done in a patch, not what wasn't done.

The reason I didn't fix this by keeping body wrapper alive was that it would be too subtle and roundabout. But thinking about it now, there is a bigger issue - the body element can be replaced via DOM manipulation, or even adopted by another document.
Comment 9 Alexey Proskuryakov 2010-04-17 23:12:38 PDT
Also, for posterity - I didn't figure out how the problem and the assertion failure resulted in release mode crashes. There is some chance that the random crashes were something different - if so, we'll hear from them again.