Bug 37720 - HTMLFrameSetElement-window-eventListener-attributes.html sometimes crashes on SnowLeopard Release
Summary: HTMLFrameSetElement-window-eventListener-attributes.html sometimes crashes on...
Status: RESOLVED FIXED
Alias: None
Product: WebKit
Classification: Unclassified
Component: WebCore Misc. (show other bugs)
Version: 528+ (Nightly build)
Hardware: Macintosh OS X 10.6
: P1 Normal
Assignee: Alexey Proskuryakov
URL: http://build.webkit.org/results/SnowL...
Keywords: InRadar, LayoutTestFailure
Depends on:
Blocks:
 
Reported: 2010-04-16 11:49 PDT by Adam Roben (:aroben)
Modified: 2010-04-17 23:12 PDT (History)
2 users (show)

See Also:


Attachments
test (will assert) (343 bytes, text/html)
2010-04-16 13:47 PDT, Alexey Proskuryakov
no flags Details
proposed fix (12.78 KB, patch)
2010-04-16 15:20 PDT, Alexey Proskuryakov
abarth: review+
Details | Formatted Diff | Diff

Note You need to log in before you can comment on or make changes to this bug.
Description Adam Roben (:aroben) 2010-04-16 11:49:11 PDT
HTMLFrameSetElement-window-eventListener-attributes.html sometimes crashes on SnowLeopard Release. Unfortunately the bots don't seem to be saving crash logs. :-(
Comment 1 Adam Roben (:aroben) 2010-04-16 11:52:55 PDT
I added this test to the Skipped file in r57731.
Comment 2 Alexey Proskuryakov 2010-04-16 12:22:53 PDT
<rdar://problem/7873752>
Comment 3 Alexey Proskuryakov 2010-04-16 13:00:54 PDT
There is a good chance that the disabled test is innocent.

In debug mode, fast/dom/Window/HTMLBodyElement-window-eventListener-attributes.html randomly crashes, which may make subsequent tests crash:

run-webkit-tests --repeat-each 100 fast/dom/Window

The debug crash is an assertion failure, ASSERT(m_wrapper || !m_jsFunction) in JSEventListener::jsFunction().
Comment 4 Alexey Proskuryakov 2010-04-16 13:47:57 PDT
Created attachment 53560 [details]
test (will assert)
Comment 5 Adam Roben (:aroben) 2010-04-16 14:02:33 PDT
(In reply to comment #3)
> There is a good chance that the disabled test is innocent.
> 
> In debug mode,
> fast/dom/Window/HTMLBodyElement-window-eventListener-attributes.html randomly
> crashes, which may make subsequent tests crash:

Should we skip this test instead?

This has now crashed on Windows as well: http://build.webkit.org/results/Windows%20Debug%20(Tests)/r57731%20(12262)/results.html
Comment 6 Alexey Proskuryakov 2010-04-16 15:20:39 PDT
Created attachment 53570 [details]
proposed fix
Comment 7 Adam Barth 2010-04-17 13:21:26 PDT
Comment on attachment 53570 [details]
proposed fix

Interesting bug.  It seems like another solution is to keep the body wrapper alive.  Can you and some text to the ChangeLog explaining why this approach is better?

+ window onject

typo
Comment 8 Alexey Proskuryakov 2010-04-17 23:09:36 PDT
Committed <http://trac.webkit.org/changeset/57790>.

> It seems like another solution is to keep the body wrapper alive.  
> Can you and some text to the ChangeLog explaining why this approach is better?

Maybe it's better to explain it here - ChangeLog explains what was done in a patch, not what wasn't done.

The reason I didn't fix this by keeping body wrapper alive was that it would be too subtle and roundabout. But thinking about it now, there is a bigger issue - the body element can be replaced via DOM manipulation, or even adopted by another document.
Comment 9 Alexey Proskuryakov 2010-04-17 23:12:38 PDT
Also, for posterity - I didn't figure out how the problem and the assertion failure resulted in release mode crashes. There is some chance that the random crashes were something different - if so, we'll hear from them again.