Bug 58553 – Assertion failure in JSC::WriteBarrierBase<JSC::JSObject>::set() when firing an event listener

• Status: NEW
• Component: JavaScriptCore

To reproduce this, run-webkit-tests fast/css/hover-affects-child.html or open the test in a browser and hover over the square.

#0	0x000000010465ff34 in JSC::WriteBarrierBase<JSC::JSObject>::set(JSC::JSGlobalData&, JSC::JSCell const*, JSC::JSObject*) at JavaScriptCore.framework/Versions/A/PrivateHeaders/WriteBarrier.h:105
#1	0x000000010465f118 in WebCore::JSEventListener::jsFunction(WebCore::ScriptExecutionContext*) const ()
#2	0x0000000104783dea in WebCore::JSEventListener::handleEvent(WebCore::ScriptExecutionContext*, WebCore::Event*) ()
#3	0x00000001041ce1ba in WebCore::EventTarget::fireEventListeners(WebCore::Event*, WebCore::EventTargetData*, WTF::Vector<WebCore::RegisteredEventListener, 1ul>&) ()
#4	0x00000001041cdebc in WebCore::EventTarget::fireEventListeners(WebCore::Event*) ()
#5	0x0000000104b80401 in WebCore::Node::handleLocalEvents(WebCore::Event*) ()
#6	0x00000001041a0f8f in WebCore::EventDispatcher::dispatchEvent(WTF::PassRefPtr<WebCore::Event>) ()
#7	0x0000000104b641d1 in WebCore::MouseEventDispatchMediator::dispatchEvent(WebCore::EventDispatcher*) const ()
#8	0x000000010419fdc7 in WebCore::EventDispatcher::dispatchEvent(WebCore::Node*, WebCore::EventDispatchMediator const&) ()
#9	0x0000000104b80e2d in WebCore::Node::dispatchMouseEvent(WebCore::PlatformMouseEvent const&, WTF::AtomicString const&, int, WebCore::Node*) ()

[Oliver Hunt]

on what platform?

I don't see any failures on the bots from my patch so is this specific to a subset of tests running?

(In reply to comment #2)
> on what platform?

…

> 
> I don't see any failures on the bots from my patch so is this specific to a subset of tests running?

That test alone is enough to trigger the failure.

[Oliver Hunt]

I suspect that this means that the wrapper object has been collected, which makes me sad, i'll look once i get in.

[Oliver Hunt]

I can't repro this -- are you using 64 bit or 32 bit?

64

[Oliver Hunt]

TEmporarily removed that assertion, but this bug is a bad thing :-(

[Geoffrey Garen]

<rdar://problem/9286991>

[Alexey Proskuryakov]

Oliver, what's the status of this issue? Is there still a bad thing happening? Can the assertion be re-added?