Bug 23694 - REGRESSION: Running svg/custom tests crashes, randomly, depending on the order of tests
Summary: REGRESSION: Running svg/custom tests crashes, randomly, depending on the orde...
Status: RESOLVED FIXED
Alias: None
Product: WebKit
Classification: Unclassified
Component: SVG (show other bugs)
Version: 528+ (Nightly build)
Hardware: Mac OS X 10.5
: P1 Normal
Assignee: Darin Adler
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2009-02-02 13:48 PST by Nikolas Zimmermann
Modified: 2009-02-02 16:08 PST (History)
3 users (show)

See Also:

Attachments
patch (3.48 KB, patch)
2009-02-02 15:50 PST, Darin Adler 		andersca: review+
Details | Formatted Diff | Diff
View All Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Nikolas Zimmermann 2009-02-02 13:48:51 PST 
Launch gdb-safari, run svg/custom/use-instanceRoot-as-event-target.xhtml and open svg/custom/use-instanceRoot-event-bubbling.xhtml afterwards in Safari. Close the window. Crash unrelated to SVG, appears:

Program received signal EXC_BAD_ACCESS, Could not access memory.
Reason: KERN_PROTECTION_FAILURE at address: 0x00000000
0x00000000 in ?? ()
(gdb) bt
#0  0x00000000 in ?? ()
#1  0x035db943 in WebCore::toEventTargetNode (node=0x1b8711f0) at EventTargetNode.h:201
#2  0x035db9a1 in WebCore::EventTargetNodeCast (node=0x1b8711f0) at EventTargetNode.h:217
#3  0x036c737d in WebCore::Document::removeAllDisconnectedNodeEventListeners (this=0x70d8800) at /Users/nikolaszimmermann/Coding/WebKit/WebCore/dom/Document.cpp:1361
#4  0x036c958e in WebCore::Document::removeAllEventListenersFromAllNodes (this=0x70d8800) at /Users/nikolaszimmermann/Coding/WebKit/WebCore/dom/Document.cpp:1341
#5  0x035a7915 in WebCore::CachedFrame::clear (this=0x1bfe80c0) at /Users/nikolaszimmermann/Coding/WebKit/WebCore/history/CachedFrame.cpp:122
#6  0x035a7a92 in WebCore::CachedFrame::~CachedFrame (this=0x1bfe80c0) at /Users/nikolaszimmermann/Coding/WebKit/WebCore/history/CachedFrame.cpp:86
#7  0x035a8ba9 in WTF::RefCounted<WebCore::CachedFrame>::deref (this=0x1bfe80c0) at RefCounted.h:91
#8  0x035ab20b in WTF::RefPtr<WebCore::CachedFrame>::clear (this=0x1d35e510) at RefPtr.h:56
#9  0x035aafae in WebCore::CachedPage::clear (this=0x1d35e500) at /Users/nikolaszimmermann/Coding/WebKit/WebCore/history/CachedPage.cpp:83
#10 0x03a9dd03 in WebCore::PageCache::releaseAutoreleasedPagesNow (this=0xaa8b00) at /Users/nikolaszimmermann/Coding/WebKit/WebCore/history/PageCache.cpp:168
#11 0x00288f83 in -[WebWindowWatcher windowWillClose:] (self=0xa51dc0, _cmd=0x972042c0, notification=0xa1c800) at /Users/nikolaszimmermann/Coding/WebKit/WebKit/mac/History/WebHistoryItem.mm:594

I don't see the crash on buildbot at the moment though.
Comment 1 Darin Adler 2009-02-02 14:44:23 PST 
This looks like something that would be caused by my recent change, but I can't tell exactly what's going wrong here.
Comment 2 Darin Adler 2009-02-02 14:49:14 PST 
I see the problem. ContainerNode no longer calls the base class insertedIntoDocument or removedFromDocument.
Comment 3 Darin Adler 2009-02-02 15:50:13 PST 
Created attachment 27263 [details]
patch
Comment 4 Anders Carlsson 2009-02-02 15:54:05 PST 
Comment on attachment 27263 [details]
patch

r=me
Comment 5 Darin Adler 2009-02-02 16:08:26 PST 
http://trac.webkit.org/changeset/40499