I did http://trac.webkit.org/changeset/105238 to help us figure this out, so now we know which assert is firing but it is unclear why the test is failing and how the assert/failure are related.
We should probably roll out r105238 when we figure this out. (Even better if we improve asserts so this type of hack wouldn't be needed.)
More data, I think the line that it the exception is about is here:
This line seems clearly incorrect (now) as it calls revokeObjectURL directly instead of doing webkitURL.revokeObjectURL. There are two questions that come from this:
1. Why doesn't this exception happen everytime?
2. Why does the assert fire when this exception gets hit?
More notes: This is carry over from the previous test and this issue seems to be the reason why fast/files/workers/worker-apply-blob-url-to-xhr.html is always failing.
So the console message is random depending on timing.
It could be that the assert always occurs when a url hasn't been revoked and the worker context is cleaned up but we only happen to hit this during the next test occaisionally.
It looks like DOMURL *leaks* object url's if the destructor is called and DOMURL::contextDestroyed isn't.
(I would guess that this would be the common case because the WorkerContext should have the last ref to DOMURL and that ref should go away in ~WorkerContext which is before contextDestroyed should be called from ScriptExecutionContext.)
This no longer repros but I have addressed at least two issues I found (see dependent bugs).
Also the leak is fixed but bug 74386 that fixed it has issues as noted in that bug.
So I'm resolving this one.