[Webkit-unassigned] [Bug 113369] New: [BlackBerry] Assert failure when destructing DumpRenderTree
bugzilla-daemon at webkit.org
bugzilla-daemon at webkit.org
Wed Mar 27 00:53:12 PDT 2013
https://bugs.webkit.org/show_bug.cgi?id=113369
Summary: [BlackBerry] Assert failure when destructing
DumpRenderTree
Product: WebKit
Version: 528+ (Nightly build)
Platform: Other
OS/Version: Other
Status: UNCONFIRMED
Severity: Normal
Priority: P2
Component: WebKit BlackBerry
AssignedTo: webkit-unassigned at lists.webkit.org
ReportedBy: xiaobo.wang at torchmobile.com.cn
CC: rwlbuis at gmail.com
RIM PR 316822
Back traces
============
#0 0x7817d142 in BlackBerry::Platform::platformCrash (file=0x78338fa8
"/home/worker/workspace/playbook/platform/blackberryplatform/BlackBerryPlatformGuardedPointer.cpp",
line=<optimized out>, function=<optimized out>) at
/home/worker/workspace/playbook/platform/blackberryplatform/BlackBerryPlatformAssert.cpp:24
#1 0x78186c8c in BlackBerry::Platform::GuardedPointerBase::~GuardedPointerBase
(this=0x816426c, __in_chrg=<optimized out>)
at
/home/worker/workspace/playbook/platform/blackberryplatform/BlackBerryPlatformGuardedPointer.cpp:138
#2 0x782d97b4 in BlackBerry::Platform::LayoutTestClient::~LayoutTestClient
(this=0x816426c, __in_chrg=<optimized out>)
at
/home/worker/workspace/playbook/platform/blackberryplatform/BlackBerryPlatformLayoutTest.cpp:22
#3 0x784c5a5a in ~Timer (this=0x81642f0, __in_chrg=<optimized out>) at
/home/worker/workspace/playbook/webkit/Source/WebCore/platform/Timer.h:98
#4 BlackBerry::WebKit::DumpRenderTree::~DumpRenderTree (this=0x8164268,
__in_chrg=<optimized out>)
at
/home/worker/workspace/playbook/webkit/Tools/DumpRenderTree/blackberry/DumpRenderTree.cpp:207
#5 0x784c5ac8 in destruct (end=0x0, begin=0x0) at
/home/worker/workspace/playbook/webkit/Source/WTF/wtf/Vector.h:58
#6 destruct (end=0x0, begin=0x0) at
/home/worker/workspace/playbook/webkit/Source/WTF/wtf/Vector.h:221
#7 shrink (this=0x8164278, size=<optimized out>) at
/home/worker/workspace/playbook/webkit/Source/WTF/wtf/Vector.h:941
#8 ~Vector (this=0x8164278, __in_chrg=<optimized out>) at
/home/worker/workspace/playbook/webkit/Source/WTF/wtf/Vector.h:547
#9 BlackBerry::WebKit::DumpRenderTree::~DumpRenderTree (this=0x8164268,
__in_chrg=<optimized out>)
at
/home/worker/workspace/playbook/webkit/Tools/DumpRenderTree/blackberry/DumpRenderTree.cpp:207
#10 0x080980c8 in ?? ()
#11 0x080980c8 in ?? ()
Root cause
============
B::W::DumpRenderTree derived from B::W::DumpRenderTreeClient and
B::P::LayoutTestClient, and B::P::LayoutTestClient derived from
B::P::GuardedPointerBase.
In WebPagePrivate::m_dumpRenderTree is a B::W::DumpRenderTreeClient pointer
backed by a B::W::DumpRenderTree instance. So if we delete m_dumpRenderTree the
DumpRenderTree object will be deleted directory without calling
deleteGuardedObject, and hit the assert in
GuardedPointerBase::~GuardedPointerBase().
Solution
==========
Since WebPagePrivate::m_dumpRenderTree is not derived from GuardedPointerBase,
we can't use "deleteGuardedObject(m_dumpRenderTree);". We can add a virtual
function DumpRenderTreeClient::destroy() and use it to destruct the
DumpRenderTree instance.
--
Configure bugmail: https://bugs.webkit.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.
More information about the webkit-unassigned
mailing list