Created attachment 203218 [details] Test case The attached tests crashes in debug mode. Crashlog & backtrace: Program received signal SIGSEGV, Segmentation fault. 0x00007ffff575275d in WTFCrash () at /home/reni/Data/REPOS/webkit_sec/Source/WTF/wtf/Assertions.cpp:339 339 *(int *)(uintptr_t)0xbbadbeef = 0; (gdb) bt #0 0x00007ffff575275d in WTFCrash () at /home/reni/Data/REPOS/webkit_sec/Source/WTF/wtf/Assertions.cpp:339 #1 0x00007ffff3bfd4d1 in WebCore::TreeShared<WebCore::Node>::ref (this=0x8d0ae0) at /home/reni/Data/REPOS/webkit_sec/Source/WebCore/platform/TreeShared.h:65 #2 0x00007ffff42cc5c2 in WebCore::Node::refEventTarget (this=0x8d0ad0) at /home/reni/Data/REPOS/webkit_sec/Source/WebCore/dom/Node.cpp:792 #3 0x00007ffff3fc7039 in WebCore::EventTarget::ref (this=0x8d0ad0) at /home/reni/Data/REPOS/webkit_sec/Source/WebCore/dom/EventTarget.h:106 #4 0x00007ffff3fc7e9f in WTF::refIfNotNull<WebCore::EventTarget> (ptr=0x8d0ad0) at /home/reni/Data/REPOS/webkit_sec/Source/WTF/wtf/PassRefPtr.h:46 #5 0x00007ffff4246327 in WTF::PassRefPtr<WebCore::EventTarget>::PassRefPtr (this=0x7fffffffbde0, ptr=0x8d0ad0) at /home/reni/Data/REPOS/webkit_sec/Source/WTF/wtf/PassRefPtr.h:60 #6 0x00007ffff42994f8 in WebCore::EventDispatcher::dispatchScopedEvent (node=0x8d0ad0, mediator=...) at /home/reni/Data/REPOS/webkit_sec/Source/WebCore/dom/EventDispatcher.cpp:73 #7 0x00007ffff42d0f3c in WebCore::Node::dispatchScopedEventDispatchMediator (this=0x8d0ad0, eventDispatchMediator=...) at /home/reni/Data/REPOS/webkit_sec/Source/WebCore/dom/Node.cpp:2274 #8 0x00007ffff42d0eeb in WebCore::Node::dispatchScopedEvent (this=0x8d0ad0, event=...) at /home/reni/Data/REPOS/webkit_sec/Source/WebCore/dom/Node.cpp:2269 #9 0x00007ffff42d11e0 in WebCore::Node::dispatchSubtreeModifiedEvent (this=0x8d0ad0) at /home/reni/Data/REPOS/webkit_sec/Source/WebCore/dom/Node.cpp:2298 #10 0x00007ffff428f71d in WebCore::Element::didAddAttribute (this=0x8d0ad0, name=..., value=...) at /home/reni/Data/REPOS/webkit_sec/Source/WebCore/dom/Element.cpp:2952
Created attachment 208781 [details] Patch
Comment on attachment 208781 [details] Patch View in context: https://bugs.webkit.org/attachment.cgi?id=208781&action=review > Source/WebCore/html/HTMLProgressElement.cpp:159 > RefPtr<ProgressInnerElement> inner = ProgressInnerElement::create(document()); > + inner->setPseudo(AtomicString("-webkit-progress-inner-element", AtomicString::ConstructFromLiteral)); It would be nicer to make these setPseudo calls in ::create() so it is not possible to construct ProgressInnerElement and pals without the right pseudo type.
(In reply to comment #2) > (From update of attachment 208781 [details]) > View in context: https://bugs.webkit.org/attachment.cgi?id=208781&action=review > > > Source/WebCore/html/HTMLProgressElement.cpp:159 > > RefPtr<ProgressInnerElement> inner = ProgressInnerElement::create(document()); > > + inner->setPseudo(AtomicString("-webkit-progress-inner-element", AtomicString::ConstructFromLiteral)); > > It would be nicer to make these setPseudo calls in ::create() so it is not possible to construct ProgressInnerElement and pals without the right pseudo type. Great idea, I fixed it before landing. A shame that we are not always consistent here.
Committed r154099: <http://trac.webkit.org/changeset/154099>
Comment on attachment 208781 [details] Patch View in context: https://bugs.webkit.org/attachment.cgi?id=208781&action=review > Source/WebCore/html/shadow/ProgressShadowElement.h:69 > + ProgressBarElement(Document*); Shouldn’t this constructor be private, if it’s only supposed to be called by the create function? > Source/WebCore/html/shadow/ProgressShadowElement.h:81 > + ProgressValueElement(Document*); Same question.
(In reply to comment #5) > (From update of attachment 208781 [details]) > View in context: https://bugs.webkit.org/attachment.cgi?id=208781&action=review > > > Source/WebCore/html/shadow/ProgressShadowElement.h:69 > > + ProgressBarElement(Document*); > > Shouldn’t this constructor be private, if it’s only supposed to be called by the create function? > > > Source/WebCore/html/shadow/ProgressShadowElement.h:81 > > + ProgressValueElement(Document*); > > Same question. Good point, I'll try to make a follow-up patch.
Reopening to attach new patch.
Created attachment 208827 [details] Patch
Comment on attachment 208827 [details] Patch Clearing flags on attachment: 208827 Committed r154121: <http://trac.webkit.org/changeset/154121>
All reviewed patches have been landed. Closing bug.