[Webkit-unassigned] [Bug 108223] [Mac] Flaky crash in SliderThumbElement::defaultEventHandler on fast/forms/range/slider-delete-while-dragging-thumb.html

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=108223


Alexis Menard (darktears) <alexis at webkit.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |dglazkov at chromium.org




--- Comment #3 from Alexis Menard (darktears) <alexis at webkit.org>  2013-01-30 03:34:34 PST ---
(In reply to comment #2)
> (In reply to comment #1)
> > Possibly related to http://trac.webkit.org/changeset/141119, which was introduced 5 hours ago?
> 
> It is really unlikely that it's this change. The change concerns only transition DOM events and more specifically related to DOM events for generated contents.
> 
> From the backtrace it seems that it crashes in the handler of the slider. Maybe running the test in the browser with the debugger attached and pressing refresh could catch it so you can get more information.

You can modify the test case and run it in the MiniBrowser and you can reproduce the crash.

https://gist.github.com/4672658 and press down the mouse on the slider and wait.

It crashes in

HTMLInputElement* SliderThumbElement::hostInput() const
{
    // Only HTMLInputElement creates SliderThumbElement instances as its shadow nodes.
    // So, shadowHost() must be an HTMLInputElement.
    return shadowHost()->toInputElement();
}

shadowHost() seems to be null. We could "fix" it by checking the return value of shadowHost() but I can't tell if that's right or not.

Dimitry?

-- 
Configure bugmail: https://bugs.webkit.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.