Bug 243867

Summary:	REGRESSION: Occasional assertion failure in JSEventListener::ensureJSFunction via HTMLSlotElement::dispatchSlotChangeEvent()
Product:	WebKit	Reporter:	Ryosuke Niwa <rniwa>
Component:	DOM	Assignee:	Ryosuke Niwa <rniwa>
Status:	RESOLVED FIXED
Severity:	Normal	CC:	webkit-bug-importer
Priority:	P2	Keywords:	InRadar
Version:	WebKit Nightly Build
Hardware:	Unspecified
OS:	Unspecified
Bug Depends on:
Bug Blocks:	218692

Description Ryosuke Niwa 2022-08-11 19:58:25 PDT

e.g.
Thread 0 Crashed::  Dispatch queue: com.apple.main-thread
0   JavaScriptCore                	       0x5e2d672ce WTFCrash + 14
1   WebCore                       	       0x6002f555b WTFCrashWithInfo(int, char const*, char const*, int) + 27
2   WebCore                       	       0x60302ffea WebCore::JSEventListener::ensureJSFunction(WebCore::ScriptExecutionContext&) const + 602 (JSEventListener.h:157)
3   WebCore                       	       0x60302f3ae WebCore::JSEventListener::handleEvent(WebCore::ScriptExecutionContext&, WebCore::Event&) + 206 (JSEventListener.cpp:141)
4   WebCore                       	       0x60387f18e WebCore::EventTarget::innerInvokeEventListeners(WebCore::Event&, WTF::Vector<WTF::RefPtr<WebCore::RegisteredEventListener, WTF::RawPtrTraits<WebCore::RegisteredEventListener>, WTF::DefaultRefDerefTraits<WebCore::RegisteredEventListener> >, 1ul, WTF::CrashOnOverflow, 2ul, WTF::FastMalloc>, WebCore::EventTarget::EventInvokePhase) + 1022 (EventTarget.cpp:362)
5   WebCore                       	       0x60387ec3e WebCore::EventTarget::fireEventListeners(WebCore::Event&, WebCore::EventTarget::EventInvokePhase) + 302 (EventTarget.cpp:294)
6   WebCore                       	       0x60384aad9 WebCore::EventContext::handleLocalEvents(WebCore::Event&, WebCore::EventTarget::EventInvokePhase) const + 889 (EventContext.cpp:96)
7   WebCore                       	       0x603873606 WebCore::dispatchEventInDOM(WebCore::Event&, WebCore::EventPath const&) + 374 (EventDispatcher.cpp:109)
8   WebCore                       	       0x603872dde WebCore::EventDispatcher::dispatchEvent(WebCore::Node&, WebCore::Event&) + 1038 (EventDispatcher.cpp:190)
9   WebCore                       	       0x6039076bd WebCore::Node::dispatchEvent(WebCore::Event&) + 29 (Node.cpp:2429)
10  WebCore                       	       0x603ce4d6b WebCore::HTMLSlotElement::dispatchSlotChangeEvent() + 139 (HTMLSlotElement.cpp:220)
11  WebCore                       	       0x6038e8007 WebCore::MutationObserver::notifyMutationObservers(WebCore::WindowEventLoop&) + 919 (MutationObserver.cpp:266)
12  WebCore                       	       0x6039e46a4 WebCore::WindowEventLoop::queueMutationObserverCompoundMicrotask()::$_2::operator()() const + 84 (WindowEventLoop.cpp:138)
13  WebCore                       	       0x6039e4609 WTF::Detail::CallableWrapper<WebCore::WindowEventLoop::queueMutationObserverCompoundMicrotask()::$_2, void>::call() + 25 (Function.h:53)
14  WebCore                       	       0x600314902 WTF::Function<void ()>::operator()() const + 130
15  WebCore                       	       0x603883079 WebCore::EventLoopFunctionDispatchTask::execute() + 25 (EventLoop.cpp:159)
16  WebCore                       	       0x6038cfa71 WebCore::MicrotaskQueue::performMicrotaskCheckpoint() + 337 (Microtasks.cpp:64)
17  WebCore                       	       0x60387501e WebCore::EventLoop::performMicrotaskCheckpoint() + 30 (EventLoop.cpp:51)
18  WebCore                       	       0x60387635f WebCore::EventLoopTaskGroup::performMicrotaskCheckpoint() + 63 (EventLoop.cpp:180)
19  WebCore                       	       0x60308becb WebCore::JSExecState::didLeaveScriptContext(JSC::JSGlobalObject*) + 59 (JSExecState.cpp:41)
20  WebCore                       	       0x60303ac37 WebCore::JSExecState::~JSExecState() + 231 (JSExecState.h:175)
21  WebCore                       	       0x60303aa75 WebCore::JSExecState::~JSExecState() + 21 (JSExecState.h:164)

Comment 1 Ryosuke Niwa 2022-08-11 20:04:46 PDT

Pull request: https://github.com/WebKit/WebKit/pull/3256

Comment 2 EWS 2022-08-11 22:13:04 PDT

Committed 253365@main (0069c1e3e527): <https://commits.webkit.org/253365@main>

Reviewed commits have been landed. Closing PR #3256 and removing active labels.

Comment 3 Radar WebKit Bug Importer 2022-08-11 22:14:16 PDT

<rdar://problem/98549385>