Bug 23694 - REGRESSION: Running svg/custom tests crashes, randomly, depending on the order of tests
Summary: REGRESSION: Running svg/custom tests crashes, randomly, depending on the orde...
Status: RESOLVED FIXED
Alias: None
Product: WebKit
Classification: Unclassified
Component: SVG (show other bugs)
Version: 528+ (Nightly build)
Hardware: Mac OS X 10.5
: P1 Normal
Assignee: Darin Adler
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2009-02-02 13:48 PST by Nikolas Zimmermann
Modified: 2009-02-02 16:08 PST (History)
3 users (show)

See Also:


Attachments
patch (3.48 KB, patch)
2009-02-02 15:50 PST, Darin Adler
andersca: review+
Details | Formatted Diff | Diff

Note You need to log in before you can comment on or make changes to this bug.
Description Nikolas Zimmermann 2009-02-02 13:48:51 PST
Launch gdb-safari, run svg/custom/use-instanceRoot-as-event-target.xhtml and open svg/custom/use-instanceRoot-event-bubbling.xhtml afterwards in Safari. Close the window. Crash unrelated to SVG, appears:

Program received signal EXC_BAD_ACCESS, Could not access memory.
Reason: KERN_PROTECTION_FAILURE at address: 0x00000000
0x00000000 in ?? ()
(gdb) bt
#0  0x00000000 in ?? ()
#1  0x035db943 in WebCore::toEventTargetNode (node=0x1b8711f0) at EventTargetNode.h:201
#2  0x035db9a1 in WebCore::EventTargetNodeCast (node=0x1b8711f0) at EventTargetNode.h:217
#3  0x036c737d in WebCore::Document::removeAllDisconnectedNodeEventListeners (this=0x70d8800) at /Users/nikolaszimmermann/Coding/WebKit/WebCore/dom/Document.cpp:1361
#4  0x036c958e in WebCore::Document::removeAllEventListenersFromAllNodes (this=0x70d8800) at /Users/nikolaszimmermann/Coding/WebKit/WebCore/dom/Document.cpp:1341
#5  0x035a7915 in WebCore::CachedFrame::clear (this=0x1bfe80c0) at /Users/nikolaszimmermann/Coding/WebKit/WebCore/history/CachedFrame.cpp:122
#6  0x035a7a92 in WebCore::CachedFrame::~CachedFrame (this=0x1bfe80c0) at /Users/nikolaszimmermann/Coding/WebKit/WebCore/history/CachedFrame.cpp:86
#7  0x035a8ba9 in WTF::RefCounted<WebCore::CachedFrame>::deref (this=0x1bfe80c0) at RefCounted.h:91
#8  0x035ab20b in WTF::RefPtr<WebCore::CachedFrame>::clear (this=0x1d35e510) at RefPtr.h:56
#9  0x035aafae in WebCore::CachedPage::clear (this=0x1d35e500) at /Users/nikolaszimmermann/Coding/WebKit/WebCore/history/CachedPage.cpp:83
#10 0x03a9dd03 in WebCore::PageCache::releaseAutoreleasedPagesNow (this=0xaa8b00) at /Users/nikolaszimmermann/Coding/WebKit/WebCore/history/PageCache.cpp:168
#11 0x00288f83 in -[WebWindowWatcher windowWillClose:] (self=0xa51dc0, _cmd=0x972042c0, notification=0xa1c800) at /Users/nikolaszimmermann/Coding/WebKit/WebKit/mac/History/WebHistoryItem.mm:594

I don't see the crash on buildbot at the moment though.
Comment 1 Darin Adler 2009-02-02 14:44:23 PST
This looks like something that would be caused by my recent change, but I can't tell exactly what's going wrong here.
Comment 2 Darin Adler 2009-02-02 14:49:14 PST
I see the problem. ContainerNode no longer calls the base class insertedIntoDocument or removedFromDocument.
Comment 3 Darin Adler 2009-02-02 15:50:13 PST
Created attachment 27263 [details]
patch
Comment 4 Anders Carlsson 2009-02-02 15:54:05 PST
Comment on attachment 27263 [details]
patch

r=me
Comment 5 Darin Adler 2009-02-02 16:08:26 PST
http://trac.webkit.org/changeset/40499