I went to these URLs, in this order (I think): http://webkit.org/blog-files/3d-transforms/poster-circle.html http://webkit.org/blog-files/3d-transforms/morphing-cubes.html http://annevankesteren.nl/ http://www.apple.com/html5/showcase/transitions/ When the last one was loading, I hit this assertion in ~JSGlobalObject(): ASSERT(JSLock::currentThreadIsHoldingLock()); Here's the backtrace: > JavaScriptCore.dll!JSC::JSGlobalObject::~JSGlobalObject() Line 97 + 0x2a bytes C++ WebKit.dll!WebCore::JSDOMGlobalObject::~JSDOMGlobalObject() + 0x16 bytes C++ WebKit.dll!WebCore::JSDOMWindowBase::~JSDOMWindowBase() + 0x16 bytes C++ WebKit.dll!WebCore::JSDOMWindow::~JSDOMWindow() Line 1090 + 0x8 bytes C++ WebKit.dll!WebCore::JSDOMWindow::`scalar deleting destructor'() + 0x16 bytes C++ JavaScriptCore.dll!JSC::MarkedSpace::sweep() Line 268 + 0x10 bytes C++ JavaScriptCore.dll!JSC::Heap::reset(JSC::Heap::SweepToggle sweepToggle=DoSweep) Line 386 C++ JavaScriptCore.dll!JSC::Heap::collectAllGarbage() Line 367 C++ JavaScriptCore.dll!JSC::Heap::reportExtraMemoryCostSlowCase(unsigned int cost=209083) Line 96 C++ WebKit.dll!JSC::Heap::reportExtraMemoryCost(unsigned int cost=209083) Line 169 C++ WebKit.dll!WebCore::HTMLImageLoader::notifyFinished(WebCore::CachedResource * __formal=0x0abaf7a0) Line 85 C++ WebKit.dll!WebCore::CachedImage::checkNotify() Line 316 + 0x13 bytes C++ WebKit.dll!WebCore::CachedImage::data(WTF::PassRefPtr<WebCore::SharedBuffer> data={...}, bool allDataReceived=true) Line 296 C++ WebKit.dll!WebCore::CachedResourceRequest::didFinishLoading(WebCore::SubresourceLoader * loader=0x064019f0) Line 161 C++ WebKit.dll!WebCore::SubresourceLoader::didFinishLoading(double finishTime=0.00000000000000000) Line 181 + 0x1f bytes C++ WebKit.dll!WebCore::ResourceLoader::didFinishLoading(WebCore::ResourceHandle * __formal=0x06846960, double finishTime=0.00000000000000000) Line 434 + 0x18 bytes C++ WebKit.dll!WebCore::didFinishLoading(_CFURLConnection * conn=0x0696b1f0, const void * clientInfo=0x06846960) Line 241 + 0x26 bytes C++ CFNetwork.dll!URLConnectionClient::_clientDidFinishLoading() + 0x2b bytes C++ CFNetwork.dll!URLConnectionClient::ClientConnectionEventQueue::processAllEventsAndConsumePayload() C++ CFNetwork.dll!URLConnectionClient::processEvents() + 0x21 bytes C++ CFNetwork.dll!URLConnectionWndProc() C++ user32.dll!_InternalCallWinProc@20() + 0x28 bytes user32.dll!_UserCallWinProcCheckWow@32() + 0xb7 bytes user32.dll!_DispatchMessageWorker@8() + 0xdc bytes user32.dll!_DispatchMessageW@4() + 0xf bytes WebKit.dll!RunLoop::run() Line 73 + 0xc bytes C++ WebKit.dll!WebKit::WebProcessMain(const WebKit::CommandLine & commandLine={...}) Line 82 C++ WebKit.dll!WebKitMain(const WebKit::CommandLine & commandLine={...}) Line 48 + 0x9 bytes C++ WebKit.dll!WebKitMain(HINSTANCE__ * hInstance=0x00400000, HINSTANCE__ * hPrevInstance=0x00000000, wchar_t * lpstrCmdLine=0x0002114c, int nCmdShow=10) Line 172 + 0x9 bytes C++ WebKit2WebProcess.exe!wWinMain(HINSTANCE__ * hInstance=0x00400000, HINSTANCE__ * hPrevInstance=0x00000000, wchar_t * lpstrCmdLine=0x0002114c, int nCmdShow=10) Line 44 + 0x18 bytes C++ WebKit2WebProcess.exe!__tmainCRTStartup() Line 589 + 0x1c bytes C kernel32.dll!_BaseProcessStart@4() + 0x23 bytes
<rdar://problem/8964321>
I think that we're just trivially needing a JSLock(SilenceAssertionsOnly) in HTMLImageLoader::notifyFinished(). Same problem exists elsewhere, e.g. in XMLHttpRequest::dropProtection().
Created attachment 81521 [details] Patch
Comment on attachment 81521 [details] Patch Marking cq+ so the bot can land this.
Attachment 81521 [details] did not build on gtk: Build output: http://queues.webkit.org/results/7705806
Created attachment 81526 [details] Patch
Comment on attachment 81526 [details] Patch One more time, with the build (hopefully) fixed.
Attachment 81526 [details] did not build on gtk: Build output: http://queues.webkit.org/results/7711042
Attachment 81521 [details] did not build on qt: Build output: http://queues.webkit.org/results/7711043
Attachment 81521 [details] did not build on win: Build output: http://queues.webkit.org/results/7711047
Created attachment 81534 [details] Patch
Comment on attachment 81534 [details] Patch This time for all the bananas.
Attachment 81534 [details] did not build on gtk: Build output: http://queues.webkit.org/results/7708523
Comment on attachment 81534 [details] Patch View in context: https://bugs.webkit.org/attachment.cgi?id=81534&action=review r=me, except I think you need to get the namespace stuff right so it doesn’t break the GTK build > Source/WebCore/html/HTMLCanvasElement.cpp:416 > + JSC::JSLock lock(SilenceAssertionsOnly); If it’s JSC::JSLock, then it should also be JSC::SilenceAssertionsOnly, right?
Created attachment 81540 [details] Patch
Committed r77853: <http://trac.webkit.org/changeset/77853>