RESOLVED FIXED 243867
REGRESSION: Occasional assertion failure in JSEventListener::ensureJSFunction via HTMLSlotElement::dispatchSlotChangeEvent() 
https://bugs.webkit.org/show_bug.cgi?id=243867
Summary REGRESSION: Occasional assertion failure in JSEventListener::ensureJSFunction...
Ryosuke Niwa
Reported 2022-08-11 19:58:25 PDT
e.g. Thread 0 Crashed:: Dispatch queue: com.apple.main-thread 0 JavaScriptCore 0x5e2d672ce WTFCrash + 14 1 WebCore 0x6002f555b WTFCrashWithInfo(int, char const*, char const*, int) + 27 2 WebCore 0x60302ffea WebCore::JSEventListener::ensureJSFunction(WebCore::ScriptExecutionContext&) const + 602 (JSEventListener.h:157) 3 WebCore 0x60302f3ae WebCore::JSEventListener::handleEvent(WebCore::ScriptExecutionContext&, WebCore::Event&) + 206 (JSEventListener.cpp:141) 4 WebCore 0x60387f18e WebCore::EventTarget::innerInvokeEventListeners(WebCore::Event&, WTF::Vector<WTF::RefPtr<WebCore::RegisteredEventListener, WTF::RawPtrTraits<WebCore::RegisteredEventListener>, WTF::DefaultRefDerefTraits<WebCore::RegisteredEventListener> >, 1ul, WTF::CrashOnOverflow, 2ul, WTF::FastMalloc>, WebCore::EventTarget::EventInvokePhase) + 1022 (EventTarget.cpp:362) 5 WebCore 0x60387ec3e WebCore::EventTarget::fireEventListeners(WebCore::Event&, WebCore::EventTarget::EventInvokePhase) + 302 (EventTarget.cpp:294) 6 WebCore 0x60384aad9 WebCore::EventContext::handleLocalEvents(WebCore::Event&, WebCore::EventTarget::EventInvokePhase) const + 889 (EventContext.cpp:96) 7 WebCore 0x603873606 WebCore::dispatchEventInDOM(WebCore::Event&, WebCore::EventPath const&) + 374 (EventDispatcher.cpp:109) 8 WebCore 0x603872dde WebCore::EventDispatcher::dispatchEvent(WebCore::Node&, WebCore::Event&) + 1038 (EventDispatcher.cpp:190) 9 WebCore 0x6039076bd WebCore::Node::dispatchEvent(WebCore::Event&) + 29 (Node.cpp:2429) 10 WebCore 0x603ce4d6b WebCore::HTMLSlotElement::dispatchSlotChangeEvent() + 139 (HTMLSlotElement.cpp:220) 11 WebCore 0x6038e8007 WebCore::MutationObserver::notifyMutationObservers(WebCore::WindowEventLoop&) + 919 (MutationObserver.cpp:266) 12 WebCore 0x6039e46a4 WebCore::WindowEventLoop::queueMutationObserverCompoundMicrotask()::$_2::operator()() const + 84 (WindowEventLoop.cpp:138) 13 WebCore 0x6039e4609 WTF::Detail::CallableWrapper<WebCore::WindowEventLoop::queueMutationObserverCompoundMicrotask()::$_2, void>::call() + 25 (Function.h:53) 14 WebCore 0x600314902 WTF::Function<void ()>::operator()() const + 130 15 WebCore 0x603883079 WebCore::EventLoopFunctionDispatchTask::execute() + 25 (EventLoop.cpp:159) 16 WebCore 0x6038cfa71 WebCore::MicrotaskQueue::performMicrotaskCheckpoint() + 337 (Microtasks.cpp:64) 17 WebCore 0x60387501e WebCore::EventLoop::performMicrotaskCheckpoint() + 30 (EventLoop.cpp:51) 18 WebCore 0x60387635f WebCore::EventLoopTaskGroup::performMicrotaskCheckpoint() + 63 (EventLoop.cpp:180) 19 WebCore 0x60308becb WebCore::JSExecState::didLeaveScriptContext(JSC::JSGlobalObject*) + 59 (JSExecState.cpp:41) 20 WebCore 0x60303ac37 WebCore::JSExecState::~JSExecState() + 231 (JSExecState.h:175) 21 WebCore 0x60303aa75 WebCore::JSExecState::~JSExecState() + 21 (JSExecState.h:164)
Attachments
Add attachment proposed patch, testcase, etc.
Ryosuke Niwa
Comment 1 2022-08-11 20:04:46 PDT
Pull request: https://github.com/WebKit/WebKit/pull/3256
EWS
Comment 2 2022-08-11 22:13:04 PDT
Committed 253365@main (0069c1e3e527): <https://commits.webkit.org/253365@main> Reviewed commits have been landed. Closing PR #3256 and removing active labels.
Radar WebKit Bug Importer
Comment 3 2022-08-11 22:14:16 PDT
<rdar://problem/98549385>
Note You need to log in before you can comment on or make changes to this bug.