Bug 116979 - ASSERTION FAILED: !m_adoptionIsRequired in void WebCore::TreeShared<NodeType>::ref()
Summary: ASSERTION FAILED: !m_adoptionIsRequired in void WebCore::TreeShared<NodeType>...
Status: RESOLVED FIXED
Alias: None
Product: WebKit
Classification: Unclassified
Component: DOM (show other bugs)
Version: 528+ (Nightly build)
Hardware: Unspecified Unspecified
: P2 Normal
Assignee: Rob Buis
URL:
Keywords:
Depends on:
Blocks: 116980
  Show dependency treegraph
 
Reported: 2013-05-29 11:04 PDT by Renata Hodovan
Modified: 2013-08-15 12:51 PDT (History)
8 users (show)

See Also:


Attachments
Test case (133 bytes, text/html)
2013-05-29 11:04 PDT, Renata Hodovan
no flags Details
Patch (7.24 KB, patch)
2013-08-14 19:21 PDT, Rob Buis
no flags Details | Formatted Diff | Diff
Patch (4.51 KB, patch)
2013-08-15 11:41 PDT, Rob Buis
no flags Details | Formatted Diff | Diff

Note You need to log in before you can comment on or make changes to this bug.
Description Renata Hodovan 2013-05-29 11:04:30 PDT
Created attachment 203218 [details]
Test case

The attached tests crashes in debug mode.

Crashlog & backtrace:

Program received signal SIGSEGV, Segmentation fault.
0x00007ffff575275d in WTFCrash () at /home/reni/Data/REPOS/webkit_sec/Source/WTF/wtf/Assertions.cpp:339
339	    *(int *)(uintptr_t)0xbbadbeef = 0;
(gdb) bt 
#0  0x00007ffff575275d in WTFCrash () at /home/reni/Data/REPOS/webkit_sec/Source/WTF/wtf/Assertions.cpp:339
#1  0x00007ffff3bfd4d1 in WebCore::TreeShared<WebCore::Node>::ref (this=0x8d0ae0) at /home/reni/Data/REPOS/webkit_sec/Source/WebCore/platform/TreeShared.h:65
#2  0x00007ffff42cc5c2 in WebCore::Node::refEventTarget (this=0x8d0ad0) at /home/reni/Data/REPOS/webkit_sec/Source/WebCore/dom/Node.cpp:792
#3  0x00007ffff3fc7039 in WebCore::EventTarget::ref (this=0x8d0ad0) at /home/reni/Data/REPOS/webkit_sec/Source/WebCore/dom/EventTarget.h:106
#4  0x00007ffff3fc7e9f in WTF::refIfNotNull<WebCore::EventTarget> (ptr=0x8d0ad0) at /home/reni/Data/REPOS/webkit_sec/Source/WTF/wtf/PassRefPtr.h:46
#5  0x00007ffff4246327 in WTF::PassRefPtr<WebCore::EventTarget>::PassRefPtr (this=0x7fffffffbde0, ptr=0x8d0ad0)
    at /home/reni/Data/REPOS/webkit_sec/Source/WTF/wtf/PassRefPtr.h:60
#6  0x00007ffff42994f8 in WebCore::EventDispatcher::dispatchScopedEvent (node=0x8d0ad0, mediator=...)
    at /home/reni/Data/REPOS/webkit_sec/Source/WebCore/dom/EventDispatcher.cpp:73
#7  0x00007ffff42d0f3c in WebCore::Node::dispatchScopedEventDispatchMediator (this=0x8d0ad0, eventDispatchMediator=...)
    at /home/reni/Data/REPOS/webkit_sec/Source/WebCore/dom/Node.cpp:2274
#8  0x00007ffff42d0eeb in WebCore::Node::dispatchScopedEvent (this=0x8d0ad0, event=...) at /home/reni/Data/REPOS/webkit_sec/Source/WebCore/dom/Node.cpp:2269
#9  0x00007ffff42d11e0 in WebCore::Node::dispatchSubtreeModifiedEvent (this=0x8d0ad0) at /home/reni/Data/REPOS/webkit_sec/Source/WebCore/dom/Node.cpp:2298
#10 0x00007ffff428f71d in WebCore::Element::didAddAttribute (this=0x8d0ad0, name=..., value=...)
    at /home/reni/Data/REPOS/webkit_sec/Source/WebCore/dom/Element.cpp:2952
Comment 1 Rob Buis 2013-08-14 19:21:58 PDT
Created attachment 208781 [details]
Patch
Comment 2 Antti Koivisto 2013-08-15 06:40:29 PDT
Comment on attachment 208781 [details]
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=208781&action=review

> Source/WebCore/html/HTMLProgressElement.cpp:159
>      RefPtr<ProgressInnerElement> inner = ProgressInnerElement::create(document());
> +    inner->setPseudo(AtomicString("-webkit-progress-inner-element", AtomicString::ConstructFromLiteral));

It would be nicer to make these setPseudo calls in ::create() so it is not possible to construct ProgressInnerElement and pals without the right pseudo type.
Comment 3 Rob Buis 2013-08-15 08:02:24 PDT
(In reply to comment #2)
> (From update of attachment 208781 [details])
> View in context: https://bugs.webkit.org/attachment.cgi?id=208781&action=review
> 
> > Source/WebCore/html/HTMLProgressElement.cpp:159
> >      RefPtr<ProgressInnerElement> inner = ProgressInnerElement::create(document());
> > +    inner->setPseudo(AtomicString("-webkit-progress-inner-element", AtomicString::ConstructFromLiteral));
> 
> It would be nicer to make these setPseudo calls in ::create() so it is not possible to construct ProgressInnerElement and pals without the right pseudo type.

Great idea, I fixed it before landing. A shame that we are not always consistent here.
Comment 4 Rob Buis 2013-08-15 08:03:42 PDT
Committed r154099: <http://trac.webkit.org/changeset/154099>
Comment 5 Darin Adler 2013-08-15 10:41:25 PDT
Comment on attachment 208781 [details]
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=208781&action=review

> Source/WebCore/html/shadow/ProgressShadowElement.h:69
> +    ProgressBarElement(Document*);

Shouldn’t this constructor be private, if it’s only supposed to be called by the create function?

> Source/WebCore/html/shadow/ProgressShadowElement.h:81
> +    ProgressValueElement(Document*);

Same question.
Comment 6 Rob Buis 2013-08-15 10:46:40 PDT
(In reply to comment #5)
> (From update of attachment 208781 [details])
> View in context: https://bugs.webkit.org/attachment.cgi?id=208781&action=review
> 
> > Source/WebCore/html/shadow/ProgressShadowElement.h:69
> > +    ProgressBarElement(Document*);
> 
> Shouldn’t this constructor be private, if it’s only supposed to be called by the create function?
> 
> > Source/WebCore/html/shadow/ProgressShadowElement.h:81
> > +    ProgressValueElement(Document*);
> 
> Same question.

Good point, I'll try to make a follow-up patch.
Comment 7 Rob Buis 2013-08-15 11:41:08 PDT
Reopening to attach new patch.
Comment 8 Rob Buis 2013-08-15 11:41:13 PDT
Created attachment 208827 [details]
Patch
Comment 9 WebKit Commit Bot 2013-08-15 12:51:49 PDT
Comment on attachment 208827 [details]
Patch

Clearing flags on attachment: 208827

Committed r154121: <http://trac.webkit.org/changeset/154121>
Comment 10 WebKit Commit Bot 2013-08-15 12:51:52 PDT
All reviewed patches have been landed.  Closing bug.