Bug 57624

Summary: inspector/debugger/debugger-step-over.html asserted once in JSEventListener::jsFunction on SnowLeopard Intel Leaks
Product: WebKit Reporter: Adam Roben (:aroben) <aroben@webkit.org>
Component: HTML DOMAssignee: Nobody <webkit-unassigned@lists.webkit.org>
Status: RESOLVED WORKSFORME    
Severity: Normal CC: darin@apple.com, dglazkov@chromium.org, ggaren@apple.com, oliver@apple.com
Priority: P2 Keywords: InRadar, LayoutTestFailure, MakingBotsRed
Version: 528+ (Nightly build)   
Hardware: PC   
OS: Mac OS X 10.6   
URL: http://build.webkit.org/results/SnowLeopard%20Intel%20Leaks/r82668%20(15954)/inspector/debugger/debugger-step-over-crash-log.txt

Description From 2011-04-01 06:18:30 PST
inspector/debugger/debugger-step-over.html asserted once in JSEventListener::jsFunction on SnowLeopard Intel Leaks. Here's the backtrace from <http://build.webkit.org/results/SnowLeopard%20Intel%20Leaks/r82668%20(15954)/inspector/debugger/debugger-step-over-crash-log.txt>:

Exception Type:  EXC_BAD_ACCESS (SIGSEGV)
Exception Codes: KERN_INVALID_ADDRESS at 0x00000000bbadbeef
Crashed Thread:  0  Dispatch queue: com.apple.main-thread

Thread 0 Crashed:  Dispatch queue: com.apple.main-thread
0   com.apple.WebCore                 0x0000000101678dd6 WebCore::JSEventListener::jsFunction(WebCore::ScriptExecutionContext*) const + 210 (JSEventListener.h:82)
1   com.apple.WebCore                 0x000000010172a409 WebCore::JSEventListener::handleEvent(WebCore::ScriptExecutionContext*, WebCore::Event*) + 201 (JSEventListener.cpp:68)
2   com.apple.WebCore                 0x00000001013b9c44 WebCore::EventTarget::fireEventListeners(WebCore::Event*, WebCore::EventTargetData*, WTF::Vector<WebCore::RegisteredEventListener, 1ul>&) + 296 (EventTarget.cpp:340)
3   com.apple.WebCore                 0x00000001013ba273 WebCore::EventTarget::fireEventListeners(WebCore::Event*) + 333 (EventTarget.cpp:325)
4   com.apple.WebCore                 0x00000001019ad22d WebCore::Node::handleLocalEvents(WebCore::Event*) + 159 (Node.cpp:2601)
5   com.apple.WebCore                 0x000000010139fe2f WebCore::EventDispatcher::dispatchEvent(WTF::PassRefPtr<WebCore::Event>) + 1131 (EventDispatcher.cpp:239)
6   com.apple.WebCore                 0x000000010139ea7d WebCore::Event::dispatch(WebCore::EventDispatcher*) + 43 (Event.cpp:276)
7   com.apple.WebCore                 0x000000010139f539 WebCore::EventDispatcher::dispatchEvent(WebCore::Node*, WTF::PassRefPtr<WebCore::Event>) + 73 (EventDispatcher.cpp:61)
8   com.apple.WebCore                 0x00000001019acf55 WebCore::Node::dispatchEvent(WTF::PassRefPtr<WebCore::Event>) + 43 (Node.cpp:2610)
9   com.apple.WebCore                 0x00000001013b4688 WebCore::EventQueue::dispatchEvent(WTF::PassRefPtr<WebCore::Event>) + 190 (EventQueue.cpp:125)
10  com.apple.WebCore                 0x00000001013b4ad1 WebCore::EventQueue::pendingEventTimerFired() + 599 (EventQueue.cpp:115)
11  com.apple.WebCore                 0x00000001013b77cb WebCore::EventQueueTimer::fired() + 25 (EventQueue.cpp:46)
12  com.apple.WebCore                 0x0000000101d88188 WebCore::ThreadTimers::sharedTimerFiredInternal() + 204 (ThreadTimers.cpp:115)
13  com.apple.WebCore                 0x0000000101d8839b WebCore::ThreadTimers::sharedTimerFired() + 25 (ThreadTimers.cpp:91)
14  com.apple.WebCore                 0x0000000101c53dae WebCore::timerFired(__CFRunLoopTimer*, void*) + 73 (SharedTimerMac.mm:167)
15  com.apple.CoreFoundation          0x00007fff8796ebe8 __CFRunLoopRun + 6488
16  com.apple.CoreFoundation          0x00007fff8796cdbf CFRunLoopRunSpecific + 575
17  com.apple.Foundation              0x00007fff81d5e8e4 -[NSRunLoop(NSRunLoop) runMode:beforeDate:] + 270
18  DumpRenderTree                    0x0000000100011a53 runTest(std::string const&) + 1880 (DumpRenderTree.mm:1141)
19  DumpRenderTree                    0x0000000100011f4a runTestingServerLoop() + 145 (DumpRenderTree.mm:628)
20  DumpRenderTree                    0x0000000100012364 dumpRenderTree(int, char const**) + 309 (DumpRenderTree.mm:684)
21  DumpRenderTree                    0x0000000100012586 main + 97 (DumpRenderTree.mm:726)
22  DumpRenderTree                    0x0000000100002178 start + 52
------- Comment #1 From 2011-04-01 06:19:51 PST -------
The failed assertion is:

        // Verify that we have a valid wrapper protecting our function from
        // garbage collection.
        ASSERT(m_wrapper || !m_jsFunction);

http://trac.webkit.org/browser/trunk/Source/WebCore/bindings/js/JSEventListener.h?rev=78634#L82
------- Comment #2 From 2011-04-01 06:20:32 PST -------
<rdar://problem/9221033>
------- Comment #3 From 2012-09-13 10:03:49 PST -------
I cannot reproduce this with 

run-webkit-tests inspector/debugger/debugger-step-over.html --repeat-each 60 -g

or 

run-webkit-tests inspector/debugger -v # with -v to confirm that it's not skipped

Perhaps it somehow got fixed, or the failure was misattributed. One way or another, it doesn't look like this bug tracks anything actionable.