Bug 59708 – fast/dom/shadow/nodetype.html crashing in NodeRareData::ensureEventTargetData on Leopard Intel Debug Tests

• Status: RESOLVED
• Resolution: DUPLICATE
• Component: DOM

[Adam Roben (:aroben)]

fast/dom/shadow/nodetype.html is crashing in NodeRareData::ensureEventTargetData on Leopard Intel Debug Tests. Backtrace:


Exception Type:  EXC_BAD_ACCESS (SIGBUS)
Exception Codes: KERN_PROTECTION_FAILURE at 0x000000000000000c
Crashed Thread:  0

Thread 0 Crashed:
0   com.apple.WebCore             	0x039fbe13 WTF::OwnPtr<WebCore::EventTargetData>::operator!() const + 9
1   com.apple.WebCore             	0x03a057c1 WebCore::NodeRareData::ensureEventTargetData() + 21
2   com.apple.WebCore             	0x039f3a27 WebCore::Node::ensureEventTargetData() + 25
3   com.apple.WebCore             	0x03be395d WebCore::RenderTheme::isEnabled(WebCore::RenderObject const*) const + 91
4   com.apple.WebCore             	0x03becdec WebCore::RenderThemeMac::updateEnabledState(NSCell*, WebCore::RenderObject const*) + 62
5   com.apple.WebCore             	0x03beea1d WebCore::RenderThemeMac::setPopupButtonCellState(WebCore::RenderObject const*, WebCore::IntRect const&) + 203
6   com.apple.WebCore             	0x03befc47 WebCore::RenderThemeMac::adjustRepaintRect(WebCore::RenderObject const*, WebCore::IntRect&) + 307
7   com.apple.WebCore             	0x03ac708a WebCore::RenderBox::clippedOverflowRectForRepaint(WebCore::RenderBoxModelObject*) + 262
8   com.apple.WebCore             	0x03b4bd4b WebCore::RenderObject::repaint(bool) + 107
9   com.apple.WebCore             	0x03b53250 WebCore::RenderObjectChildList::removeChildNode(WebCore::RenderObject*, WebCore::RenderObject*, bool) + 246
10  com.apple.WebCore             	0x03b49fba WebCore::RenderObject::removeChild(WebCore::RenderObject*) + 178
11  com.apple.WebCore             	0x03a8ebbd WebCore::RenderBlock::removeChild(WebCore::RenderObject*) + 803
12  com.apple.WebCore             	0x032f54ea WebCore::RenderObject::remove() + 58
13  com.apple.WebCore             	0x03b49123 WebCore::RenderObject::destroy() + 365
14  com.apple.WebCore             	0x03adb2f9 WebCore::RenderBoxModelObject::destroy() + 133
15  com.apple.WebCore             	0x03ad0c00 WebCore::RenderBox::destroy() + 232
16  com.apple.WebCore             	0x03a8f443 WebCore::RenderBlock::destroy() + 389
17  com.apple.WebCore             	0x039f8f66 WebCore::Node::detach() + 72
18  com.apple.WebCore             	0x039fabda WebCore::Node::~Node() + 738
19  com.apple.WebCore             	0x0318b9eb WebCore::ContainerNode::~ContainerNode() + 67
20  com.apple.WebCore             	0x033e1687 WebCore::Element::~Element() + 141
21  com.apple.WebCore             	0x03ce3bd3 WebCore::StyledElement::~StyledElement() + 81
22  com.apple.WebCore             	0x032d7f16 WebCore::HTMLElement::~HTMLElement() + 60
23  com.apple.WebCore             	0x0351246a WebCore::HTMLFormControlElement::~HTMLFormControlElement() + 154
24  com.apple.WebCore             	0x035124f1 WebCore::HTMLFormControlElementWithState::~HTMLFormControlElementWithState() + 101
25  com.apple.WebCore             	0x0352a656 WebCore::HTMLSelectElement::~HTMLSelectElement() + 146
26  com.apple.WebCore             	0x0352a79a WebCore::KeygenSelectElement::~KeygenSelectElement() + 100
27  com.apple.WebCore             	0x0318eb74 void WebCore::removeAllChildrenInContainer<WebCore::Node, WebCore::ContainerNode>(WebCore::ContainerNode*) + 252
28  com.apple.WebCore             	0x0318972d WebCore::ContainerNode::removeAllChildren() + 17
29  com.apple.WebCore             	0x0318b9e0 WebCore::ContainerNode::~ContainerNode() + 56
30  com.apple.WebCore             	0x03dec236 WebCore::TreeScope::~TreeScope() + 144
31  com.apple.WebCore             	0x03c9e73c WebCore::ShadowRoot::~ShadowRoot() + 56
32  com.apple.WebCore             	0x03b9c759 WebCore::TreeShared<WebCore::ContainerNode>::removedLastRef() + 37
33  com.apple.WebCore             	0x031c6257 WebCore::TreeShared<WebCore::ContainerNode>::deref() + 471
34  com.apple.WebCore             	0x0357e5ea void WTF::derefIfNotNull<WebCore::Node>(WebCore::Node*) + 34
35  com.apple.WebCore             	0x0307edb7 WTF::RefPtr<WebCore::Node>::~RefPtr() + 19
36  com.apple.WebCore             	0x03356d77 WebCore::JSNode::~JSNode() + 43
37  com.apple.JavaScriptCore      	0x008e6530 JSC::MarkedBlock::sweep() + 116 (MarkedBlock.cpp:84)
38  com.apple.JavaScriptCore      	0x008e6d0b JSC::MarkedSpace::sweep() + 81 (MarkedSpace.cpp:120)
39  com.apple.JavaScriptCore      	0x008e2b3c JSC::Heap::reset(JSC::Heap::SweepToggle) + 192 (Heap.cpp:408)
40  com.apple.JavaScriptCore      	0x008e2bc5 JSC::Heap::collectAllGarbage() + 25 (Heap.cpp:387)
41  com.apple.WebCore             	0x0348cd50 __ZN7WebCoreL7collectEPv + 44
42  com.apple.WebCore             	0x0348cdc6 WebCore::GCController::gcTimerFired(WebCore::Timer<WebCore::GCController>*) + 18
43  com.apple.WebCore             	0x0348ce21 WebCore::Timer<WebCore::GCController>::fired() + 89
44  com.apple.WebCore             	0x03ddfc28 WebCore::ThreadTimers::sharedTimerFiredInternal() + 228
45  com.apple.WebCore             	0x03ddfe41 WebCore::ThreadTimers::sharedTimerFired() + 27
46  com.apple.WebCore             	0x03ca1306 __ZN7WebCoreL10timerFiredEP16__CFRunLoopTimerPv + 78
47  com.apple.CoreFoundation      	0x90e368f5 CFRunLoopRunSpecific + 4469
48  com.apple.CoreFoundation      	0x90e36aa8 CFRunLoopRunInMode + 88
49  com.apple.Foundation          	0x967733d5 -[NSRunLoop(NSRunLoop) runMode:beforeDate:] + 213
50  DumpRenderTree                	0x0001699d __ZL7runTestRKSs + 1939
51  DumpRenderTree                	0x00016e7d __ZL20runTestingServerLoopv + 119
52  DumpRenderTree                	0x00017110 dumpRenderTree(int, char const**) + 340
53  DumpRenderTree                	0x0001733c main + 94 (DumpRenderTree.mm:725)
54  DumpRenderTree                	0x00002986 start + 54

[Adam Roben (:aroben)]

<rdar://problem/9352136>

[Adam Roben (:aroben)]

Maybe related to bug 59571?

[Adam Roben (:aroben)]

Added to the mac Skipped file in r85202.

[Adam Roben (:aroben)]

After skipping this test, the next test started crashing, so presumably an earlier test is to blame. This makes me more confident that this is a dupe of bug 59571.

*** This bug has been marked as a duplicate of bug 59571 ***