[Webkit-unassigned] [Bug 133450] New: ASSERT(!m_inRemovedLastRefFunction) in Element::addShadowRoot while destroying a document

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=133450

           Summary: ASSERT(!m_inRemovedLastRefFunction) in
                    Element::addShadowRoot while destroying a document
           Product: WebKit
           Version: 528+ (Nightly build)
          Platform: Unspecified
        OS/Version: Unspecified
            Status: NEW
          Severity: Normal
          Priority: P2
         Component: Media Elements
        AssignedTo: webkit-unassigned at lists.webkit.org
        ReportedBy: ap at webkit.org
                CC: koivisto at iki.fi, eric.carlson at apple.com,
                    rniwa at webkit.org, jer.noble at apple.com


Seen this on bots. Doesn't seem to happen frequently, and probably not reproducible locally, but perhaps fixable based on stack trace? This sequence of calls seems crazy.

http://build.webkit.org/results/Apple%20Mavericks%20Debug%20WK1%20(Tests)/r169530%20(5705)/media/video-fullscreeen-only-controls-crash-log.txt

0   com.apple.JavaScriptCore          0x000000010b2b723a WTFCrash + 42 (Assertions.cpp:333)
1   com.apple.WebCore                 0x000000010e6cc232 WebCore::TreeShared<WebCore::Node>::ref() + 178 (TreeShared.h:64)
2   com.apple.WebCore                 0x000000010e6d6c3d WTF::Ref<WebCore::Document>::Ref(WebCore::Document&) + 45 (Ref.h:38)
3   com.apple.WebCore                 0x000000010e6b7e6d WTF::Ref<WebCore::Document>::Ref(WebCore::Document&) + 29 (Ref.h:38)
4   com.apple.WebCore                 0x000000010e91f18d WebCore::ChildNodeInsertionNotifier::notify(WebCore::Node&) + 125 (ContainerNodeAlgorithms.h:224)
5   com.apple.WebCore                 0x000000010ed89677 WebCore::Element::addShadowRoot(WTF::PassRefPtr<WebCore::ShadowRoot>) + 247 (Element.cpp:1468)
6   com.apple.WebCore                 0x000000010ed89775 WebCore::Element::ensureUserAgentShadowRoot() + 85 (Element.cpp:1519)
--> why are we doing this while destructing everything?!
7   com.apple.WebCore                 0x000000010f0e3bbb WebCore::HTMLMediaElement::configureMediaControls() + 75 (HTMLMediaElement.cpp:5145)
8   com.apple.WebCore                 0x000000010f0e467b WebCore::HTMLMediaElement::removedFrom(WebCore::ContainerNode&) + 107 (HTMLMediaElement.cpp:712)
9   com.apple.WebCore                 0x000000010e926b7b WebCore::ChildNodeRemovalNotifier::notifyNodeRemovedFromDocument(WebCore::Node&) + 107 (ContainerNodeAlgorithms.h:242)
10  com.apple.WebCore                 0x000000010e91f4ab WebCore::ChildNodeRemovalNotifier::notify(WebCore::Node&) + 59 (ContainerNodeAlgorithms.h:259)
11  com.apple.WebCore                 0x000000010e923dd4 WebCore::Private::NodeRemovalDispatcher<WebCore::Node, WebCore::ContainerNode, true>::dispatch(WebCore::Node&, WebCore::ContainerNode&) + 116 (ContainerNodeAlgorithms.h:146)

-- 
Configure bugmail: https://bugs.webkit.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.