[Webkit-unassigned] [Bug 18205] DOMNode objects are garbage collected although there are strong references

[bugzilla-daemon at webkit.org]

http://bugs.webkit.org/show_bug.cgi?id=18205





------- Comment #15 from illenberger at mac.com  2008-04-05 08:35 PDT -------
Thanks for looking into this.
I did not mean to say that objects on the redo stack should never get
finalized. You are completely right, that the cotents of the redo stack gets
nuked after a new "do".
What happens in the test case - at least from time to time - is that directly
after the first click of the button you see the following at the beginning of
the log:

[Session started at 2008-04-05 17:27:56 +0200.]
2008-04-05 17:27:57.556 WebKitGCTest2[200:10b] DOMHTMLHtmlElement 0x10373c0 was
put on redo stack.
2008-04-05 17:27:57.557 WebKitGCTest2[200:10b] DOMHTMLHtmlElement 0x10373c0 was
finalized.
2008-04-05 17:27:57.557 WebKitGCTest2[200:10b] -----------------


Here you see that the HtmlElement wrapper object was put on the redo stack and
finalized directly afterwards. But here no redo or new do was performed. So the
reference to the finalized object is still on the redo stack. So performing
redo in this state will definitely lead to the crash that my first test case
demonstrated. You can also reproduce this in the second test case:

Just add a delayed call to redo to the test action:
- (IBAction)testAction:(id)sender
{
        [self insertNode:[document createTextNode:@"a"]
parentNode:document.documentElement];
        [[NSGarbageCollector defaultCollector] collectExhaustively];
        [undoManager performSelector:@selector(undo) withObject:nil
afterDelay:0.0];
        [undoManager performSelector:@selector(redo) withObject:nil
afterDelay:1.0];
}

And in one out of five runs of the test app, you get a crash after the first
press of the button:

[Session started at 2008-04-05 17:33:21 +0200.]
2008-04-05 17:33:23.291 WebKitGCTest2[309:10b] DOMHTMLHtmlElement 0x1013270 was
put on redo stack.
2008-04-05 17:33:23.292 WebKitGCTest2[309:10b] DOMHTMLHtmlElement 0x1013270 was
finalized.
2008-04-05 17:33:23.293 WebKitGCTest2[309:10b] -----------------

The Debugger has exited due to signal 11 (SIGSEGV).The Debugger has exited due
to signal 11 (SIGSEGV).


-- 
Configure bugmail: http://bugs.webkit.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.