Bug 121892 – Tie the life of DocumentStyleSheetCollection and Document together

• Status: RESOLVED
• Resolution: FIXED
• Component: New Bugs

[Benjamin Poulain]

Tie the life of DocumentStyleSheetCollection and Document together

[Benjamin Poulain]

Created attachment 212535 [details]
Patch

[Andreas Kling]

Comment on attachment 212535 [details]
Patch

Great idea!

[Benjamin Poulain]

Committed r156422: <http://trac.webkit.org/changeset/156422>

[Roger Fong]

On the Windows debug tester the following assertion now fails:

ASSERTION FAILED: documentInternal()
c:\cygwin\home\buildbot\slave\win-debug\build\webkitbuild\debug\include\webcore\Node.h(403) : WebCore::Node::document

See http://build.webkit.org/results/Apple%20Win%207%20Debug%20(Tests)/r156423%20(54751)/results.html

[Benjamin Poulain]

That's odd. Could you symbolicate one of the crash?

[Jer Noble]

(In reply to comment #5)
> That's odd. Could you symbolicate one of the crash?

I'm hitting this very consistently.

/Volumes/Users/jer/Projects/WebKit.git/OpenSource/Source/WebCore/dom/Node.h(403) : WebCore::Document &WebCore::Node::document() const
1   0x102e511b0 WTFCrash
2   0x10592b9c3 WebCore::Node::document() const
3   0x105cad2b1 WebCore::CSSStyleSheet::ownerDocument() const
4   0x105cad2f9 WebCore::CSSStyleSheet::clearOwnerNode()
5   0x105e1cb1b WebCore::DocumentStyleSheetCollection::~DocumentStyleSheetCollection()
6   0x105e1cac5 WebCore::DocumentStyleSheetCollection::~DocumentStyleSheetCollection()
7   0x105db1ddc WebCore::Document::~Document()
8   0x1061cea45 WebCore::HTMLDocument::~HTMLDocument()
9   0x1061ce915 WebCore::HTMLDocument::~HTMLDocument()
10  0x1061ce8e9 WebCore::HTMLDocument::~HTMLDocument()
11  0x1061ce93c non-virtual thunk to WebCore::HTMLDocument::~HTMLDocument()

It looks like we're now referencing a node's document from the document's destructor.  Seems bad.

[Jer Noble]

Aha, now that it's a non-pointer member, we're destroying it after calling clearDocumentScope() rather than before.  That causes the ASSERT we're seeing in Node::document().

[Benjamin Poulain]

(In reply to comment #7)
> Aha, now that it's a non-pointer member, we're destroying it after calling clearDocumentScope() rather than before.  That causes the ASSERT we're seeing in Node::document().

I think CSSStyleSheet should not re-enter document at any point during destruction.

I am trying something to that effect. It is building at the moment.

[Benjamin Poulain]

Follow up: https://bugs.webkit.org/show_bug.cgi?id=121933