[Webkit-unassigned] [Bug 208642] REGRESSION: (r257905) [ Mac wk2 Debug ] ASSERTION FAILED: !m_isolatedWorld->isNormal() || m_wrapper || !m_jsFunction

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=208642

--- Comment #21 from Ryosuke Niwa <rniwa at webkit.org> ---
(In reply to Ryosuke Niwa from comment #20)
> (In reply to Yusuke Suzuki from comment #19)
> > (In reply to Ryosuke Niwa from comment #18)
> >
> > > In this scenario, HTMLVideoElement needs to have a pending activity in
> > > ActiveDOMObjet while HTMLVideoTrackList/HTMLVideoElement sits in
> > > GenericEventQueue. That would prevent GC from collecting the JS wrapper
> > > since it would be reachableFromOpaqueRoot regardless of where it is.
> > 
> > No, it does not fix the issue unfortunately :(
> > Even if HTMLVideoElement is live, HTMLVideoTrackList goes away since
> > HTMLVideoTrackList is live only if it can find an opaque root, which is not
> > properly registered by HTMLVideoElement due to race condition.
> 
> Okay, so VideoTrackList needs to be an ActiveDOMObject itself and have a
> pending activity whenever it's in HTMLVideoElement's m_asyncEventQueue.

Let another approach here is to use CustomIsReachable and write a custom JSVideoTrackList::isReachableFromOpaqueRoots, or add a new variant of GenerateIsReachable like ImplMediaElementRoot which checks not just that the root of the media element is an opaque root but also if the media element has a pending activity or not.

-- 
You are receiving this mail because:
You are the assignee for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.webkit.org/pipermail/webkit-unassigned/attachments/20200306/8a9c2a47/attachment.htm>