Bug 75437 - fast/js/select-options-remove-gc.html crashes intermittently
Summary: fast/js/select-options-remove-gc.html crashes intermittently
Alias: None
Product: WebKit
Classification: Unclassified
Component: New Bugs (show other bugs)
Version: 528+ (Nightly build)
Hardware: Unspecified Unspecified
: P2 Normal
Assignee: Andreas Kling
Depends on: 75769
  Show dependency treegraph
Reported: 2012-01-02 08:37 PST by WebKit Review Bot
Modified: 2012-01-07 01:35 PST (History)
10 users (show)

See Also:

Patch (8.46 KB, patch)
2012-01-03 15:53 PST, Andreas Kling
no flags Details | Formatted Diff | Diff
Patch (7.63 KB, patch)
2012-01-03 15:54 PST, Andreas Kling
andersca: review+
Details | Formatted Diff | Diff
Better patch (7.63 KB, patch)
2012-01-03 21:32 PST, Andreas Kling
no flags Details | Formatted Diff | Diff
Better patch (55.92 KB, patch)
2012-01-03 21:33 PST, Andreas Kling
sam: review+
Details | Formatted Diff | Diff

Note You need to log in before you can comment on or make changes to this bug.
Description WebKit Review Bot 2012-01-02 08:37:16 PST
"fast/js/select-options-remove-gc.html crashes intermittently on Chromium"
Requested by mwenge2 on #webkit.
Comment 1 Robert Hogan 2012-01-02 08:41:19 PST
I can get it to crash twice in every ten runs with:

lucid Tools/Scripts/new-run-webkit-tests --chromium --iterations=100 fast/js/select-options-remove-gc.html

It occasionally crashes on the bots too:


http://build.webkit.org/results/Chromium%20Linux%20Release%20(Tests)/r103905%20(27679)/fast/js/select-options-remove-gc-crash-log.txt :

	base::debug::StackTrace::StackTrace() [0x5b727e]
	base::(anonymous namespace)::StackDumpSignalHandler() [0x5a00f9]
	WebCore::HTMLSelectElement::optionToListIndex() [0x9c9cd5]
	WebCore::HTMLSelectElement::remove() [0x9ca396]
	WebCore::removeElement() [0x183cc4b]
	WebCore::V8HTMLOptionsCollection::removeCallback() [0x183b90f]
	v8::internal::Builtin_HandleApiCall() [0x67d48d]
Comment 2 Robert Hogan 2012-01-02 08:42:56 PST
I can reproduce this on Qt, so it's not port-specific.
Comment 3 Andreas Kling 2012-01-02 13:56:00 PST
Taking, this has my ink all over it.
Comment 4 Andreas Kling 2012-01-03 15:53:11 PST
Created attachment 121010 [details]
Comment 5 Andreas Kling 2012-01-03 15:54:20 PST
Created attachment 121012 [details]
Comment 6 Alexey Proskuryakov 2012-01-03 16:29:43 PST
As discussed on IRC, this fixes the wrong problem. We should make sure that reachable elements are not collected, not deal with the aftermath of GC.

How did this work in shipping WebKit?
Comment 7 Andreas Kling 2012-01-03 21:32:33 PST
Created attachment 121057 [details]
Better patch

Reworked the HTMLCollection ownership model to ensure that collections keep their associated element alive.
Comment 8 Andreas Kling 2012-01-03 21:33:40 PST
Created attachment 121058 [details]
Better patch
Comment 9 Andreas Kling 2012-01-05 22:45:06 PST
Sam, would love your input on this.
Comment 10 Andreas Kling 2012-01-06 19:30:53 PST
Committed r104373: <http://trac.webkit.org/changeset/104373>
Comment 11 Andreas Kling 2012-01-07 01:35:43 PST
Committed r104383: <http://trac.webkit.org/changeset/104383>