Bug 133450 - ASSERT(!m_inRemovedLastRefFunction) in Element::addShadowRoot while destroying a document
Summary: ASSERT(!m_inRemovedLastRefFunction) in Element::addShadowRoot while destroyin...
Status: RESOLVED FIXED
Alias: None
Product: WebKit
Classification: Unclassified
Component: Media (show other bugs)
Version: 528+ (Nightly build)
Hardware: Unspecified Unspecified
: P2 Normal
Assignee: Jer Noble
URL:
Keywords:
: 133644 (view as bug list)
Depends on:
Blocks:
 
Reported: 2014-06-02 09:31 PDT by Alexey Proskuryakov
Modified: 2014-06-09 13:10 PDT (History)
11 users (show)

See Also:

Attachments
Patch (1.72 KB, patch)
2014-06-09 10:25 PDT, Jer Noble 		no flags Details | Formatted Diff | Diff
View All Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Alexey Proskuryakov 2014-06-02 09:31:04 PDT 
Seen this on bots. Doesn't seem to happen frequently, and probably not reproducible locally, but perhaps fixable based on stack trace? This sequence of calls seems crazy.

http://build.webkit.org/results/Apple%20Mavericks%20Debug%20WK1%20(Tests)/r169530%20(5705)/media/video-fullscreeen-only-controls-crash-log.txt

0   com.apple.JavaScriptCore      	0x000000010b2b723a WTFCrash + 42 (Assertions.cpp:333)
1   com.apple.WebCore             	0x000000010e6cc232 WebCore::TreeShared<WebCore::Node>::ref() + 178 (TreeShared.h:64)
2   com.apple.WebCore             	0x000000010e6d6c3d WTF::Ref<WebCore::Document>::Ref(WebCore::Document&) + 45 (Ref.h:38)
3   com.apple.WebCore             	0x000000010e6b7e6d WTF::Ref<WebCore::Document>::Ref(WebCore::Document&) + 29 (Ref.h:38)
4   com.apple.WebCore             	0x000000010e91f18d WebCore::ChildNodeInsertionNotifier::notify(WebCore::Node&) + 125 (ContainerNodeAlgorithms.h:224)
5   com.apple.WebCore             	0x000000010ed89677 WebCore::Element::addShadowRoot(WTF::PassRefPtr<WebCore::ShadowRoot>) + 247 (Element.cpp:1468)
6   com.apple.WebCore             	0x000000010ed89775 WebCore::Element::ensureUserAgentShadowRoot() + 85 (Element.cpp:1519)
--> why are we doing this while destructing everything?!
7   com.apple.WebCore             	0x000000010f0e3bbb WebCore::HTMLMediaElement::configureMediaControls() + 75 (HTMLMediaElement.cpp:5145)
8   com.apple.WebCore             	0x000000010f0e467b WebCore::HTMLMediaElement::removedFrom(WebCore::ContainerNode&) + 107 (HTMLMediaElement.cpp:712)
9   com.apple.WebCore             	0x000000010e926b7b WebCore::ChildNodeRemovalNotifier::notifyNodeRemovedFromDocument(WebCore::Node&) + 107 (ContainerNodeAlgorithms.h:242)
10  com.apple.WebCore             	0x000000010e91f4ab WebCore::ChildNodeRemovalNotifier::notify(WebCore::Node&) + 59 (ContainerNodeAlgorithms.h:259)
11  com.apple.WebCore             	0x000000010e923dd4 WebCore::Private::NodeRemovalDispatcher<WebCore::Node, WebCore::ContainerNode, true>::dispatch(WebCore::Node&, WebCore::ContainerNode&) + 116 (ContainerNodeAlgorithms.h:146)
Comment 1 Jer Noble 2014-06-09 10:23:20 PDT 
*** Bug 133644 has been marked as a duplicate of this bug. ***
Comment 2 Jer Noble 2014-06-09 10:25:42 PDT 
Created attachment 232711 [details]
Patch
Comment 3 WebKit Commit Bot 2014-06-09 13:10:49 PDT 
Comment on attachment 232711 [details]
Patch

Clearing flags on attachment: 232711

Committed r169708: <http://trac.webkit.org/changeset/169708>
Comment 4 WebKit Commit Bot 2014-06-09 13:10:56 PDT 
All reviewed patches have been landed.  Closing bug.