[Webkit-unassigned] [Bug 116979] New: ASSERTION FAILED: !m_adoptionIsRequired in void WebCore::TreeShared<NodeType>::ref()

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=116979

           Summary: ASSERTION FAILED: !m_adoptionIsRequired in void
                    WebCore::TreeShared<NodeType>::ref()
           Product: WebKit
           Version: 528+ (Nightly build)
          Platform: Unspecified
        OS/Version: Unspecified
            Status: NEW
          Severity: Normal
          Priority: P2
         Component: HTML DOM
        AssignedTo: webkit-unassigned at lists.webkit.org
        ReportedBy: reni at webkit.org


Created an attachment (id=203218)
 --> (https://bugs.webkit.org/attachment.cgi?id=203218&action=review)
Test case

The attached tests crashes in debug mode.

Crashlog & backtrace:

Program received signal SIGSEGV, Segmentation fault.
0x00007ffff575275d in WTFCrash () at /home/reni/Data/REPOS/webkit_sec/Source/WTF/wtf/Assertions.cpp:339
339        *(int *)(uintptr_t)0xbbadbeef = 0;
(gdb) bt 
#0  0x00007ffff575275d in WTFCrash () at /home/reni/Data/REPOS/webkit_sec/Source/WTF/wtf/Assertions.cpp:339
#1  0x00007ffff3bfd4d1 in WebCore::TreeShared<WebCore::Node>::ref (this=0x8d0ae0) at /home/reni/Data/REPOS/webkit_sec/Source/WebCore/platform/TreeShared.h:65
#2  0x00007ffff42cc5c2 in WebCore::Node::refEventTarget (this=0x8d0ad0) at /home/reni/Data/REPOS/webkit_sec/Source/WebCore/dom/Node.cpp:792
#3  0x00007ffff3fc7039 in WebCore::EventTarget::ref (this=0x8d0ad0) at /home/reni/Data/REPOS/webkit_sec/Source/WebCore/dom/EventTarget.h:106
#4  0x00007ffff3fc7e9f in WTF::refIfNotNull<WebCore::EventTarget> (ptr=0x8d0ad0) at /home/reni/Data/REPOS/webkit_sec/Source/WTF/wtf/PassRefPtr.h:46
#5  0x00007ffff4246327 in WTF::PassRefPtr<WebCore::EventTarget>::PassRefPtr (this=0x7fffffffbde0, ptr=0x8d0ad0)
    at /home/reni/Data/REPOS/webkit_sec/Source/WTF/wtf/PassRefPtr.h:60
#6  0x00007ffff42994f8 in WebCore::EventDispatcher::dispatchScopedEvent (node=0x8d0ad0, mediator=...)
    at /home/reni/Data/REPOS/webkit_sec/Source/WebCore/dom/EventDispatcher.cpp:73
#7  0x00007ffff42d0f3c in WebCore::Node::dispatchScopedEventDispatchMediator (this=0x8d0ad0, eventDispatchMediator=...)
    at /home/reni/Data/REPOS/webkit_sec/Source/WebCore/dom/Node.cpp:2274
#8  0x00007ffff42d0eeb in WebCore::Node::dispatchScopedEvent (this=0x8d0ad0, event=...) at /home/reni/Data/REPOS/webkit_sec/Source/WebCore/dom/Node.cpp:2269
#9  0x00007ffff42d11e0 in WebCore::Node::dispatchSubtreeModifiedEvent (this=0x8d0ad0) at /home/reni/Data/REPOS/webkit_sec/Source/WebCore/dom/Node.cpp:2298
#10 0x00007ffff428f71d in WebCore::Element::didAddAttribute (this=0x8d0ad0, name=..., value=...)
    at /home/reni/Data/REPOS/webkit_sec/Source/WebCore/dom/Element.cpp:2952

-- 
Configure bugmail: https://bugs.webkit.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.