Bug 58553
| Summary: | Assertion failure in JSC::WriteBarrierBase<JSC::JSObject>::set() when firing an event listener | ||
|---|---|---|---|
| Product: | WebKit | Reporter: | mitz |
| Component: | JavaScriptCore | Assignee: | Nobody <webkit-unassigned> |
| Status: | NEW | ||
| Severity: | Major | CC: | ap, ggaren, oliver |
| Priority: | P1 | Keywords: | InRadar, Regression |
| Version: | 528+ (Nightly build) | ||
| Hardware: | All | ||
| OS: | All | ||
mitz
To reproduce this, run-webkit-tests fast/css/hover-affects-child.html or open the test in a browser and hover over the square.
| Attachments | ||
|---|---|---|
| Add attachment proposed patch, testcase, etc. |
mitz
#0 0x000000010465ff34 in JSC::WriteBarrierBase<JSC::JSObject>::set(JSC::JSGlobalData&, JSC::JSCell const*, JSC::JSObject*) at JavaScriptCore.framework/Versions/A/PrivateHeaders/WriteBarrier.h:105
#1 0x000000010465f118 in WebCore::JSEventListener::jsFunction(WebCore::ScriptExecutionContext*) const ()
#2 0x0000000104783dea in WebCore::JSEventListener::handleEvent(WebCore::ScriptExecutionContext*, WebCore::Event*) ()
#3 0x00000001041ce1ba in WebCore::EventTarget::fireEventListeners(WebCore::Event*, WebCore::EventTargetData*, WTF::Vector<WebCore::RegisteredEventListener, 1ul>&) ()
#4 0x00000001041cdebc in WebCore::EventTarget::fireEventListeners(WebCore::Event*) ()
#5 0x0000000104b80401 in WebCore::Node::handleLocalEvents(WebCore::Event*) ()
#6 0x00000001041a0f8f in WebCore::EventDispatcher::dispatchEvent(WTF::PassRefPtr<WebCore::Event>) ()
#7 0x0000000104b641d1 in WebCore::MouseEventDispatchMediator::dispatchEvent(WebCore::EventDispatcher*) const ()
#8 0x000000010419fdc7 in WebCore::EventDispatcher::dispatchEvent(WebCore::Node*, WebCore::EventDispatchMediator const&) ()
#9 0x0000000104b80e2d in WebCore::Node::dispatchMouseEvent(WebCore::PlatformMouseEvent const&, WTF::AtomicString const&, int, WebCore::Node*) ()
Oliver Hunt
on what platform?
I don't see any failures on the bots from my patch so is this specific to a subset of tests running?
mitz
(In reply to comment #2)
> on what platform?
…
>
> I don't see any failures on the bots from my patch so is this specific to a subset of tests running?
That test alone is enough to trigger the failure.
Oliver Hunt
I suspect that this means that the wrapper object has been collected, which makes me sad, i'll look once i get in.
Oliver Hunt
I can't repro this -- are you using 64 bit or 32 bit?
mitz
64
Oliver Hunt
TEmporarily removed that assertion, but this bug is a bad thing :-(
Geoffrey Garen
<rdar://problem/9286991>
Alexey Proskuryakov
Oliver, what's the status of this issue? Is there still a bad thing happening? Can the assertion be re-added?