Bug 113312

Created attachment 195090 [details] ROLLOUT of r146879 Any committer can land this patch automatically by marking it commit-queue+. The commit-queue will build and test the patch before landing to ensure that the rollout will be successful. This process takes approximately 15 minutes. If you would like to land the rollout faster, you can use the following command: webkit-patch land-attachment ATTACHMENT_ID where ATTACHMENT_ID is the ID of this attachment.

The change caused multiple layout tests to crash: http://test-results.appspot.com/dashboards/flakiness_dashboard.html#group=%40ToT%20-%20chromium.org&showExpectations=true&tests=editing%2Fpasteboard%2Fdrag-list-item.html%2Cediting%2Fpasteboard%2Fpaste-list-002.html%2Cfast%2Fcss%2Fpseudo-required-optional-003.html%2Cfast%2Fcss%2Fpseudo-required-optional-004.html%2Cfast%2Fcss%2Fpseudo-required-optional-006.html%2Cfast%2Fcss%2Freadonly-pseudoclass-opera-003.html%2Cfast%2Fcss%2Freadonly-pseudoclass-opera-005.html%2Cfast%2Fdom%2Fassign-to-window-status.html%2Cfast%2Fforms%2FValidityState-001.html%2Cfast%2Fforms%2FValidityState-valueMissing-005.html%2Cfast%2Fforms%2FValidityState-valueMissing-009.html%2Cfast%2Fforms%2Fautofocus-attribute.html%2Cfast%2Fjs%2Fbitwise-and-on-undefined.html%2Cinspector%2Fdebugger%2Fdom-breakpoints.html with exception like the following: crash log for DumpRenderTree (pid 8124): STDOUT: <empty> STDERR: ASSERTION FAILED: listNode STDERR: ../../third_party/WebKit/Source/WebCore/rendering/RenderListItem.cpp(474) : void WebCore::RenderListItem::updateListMarkerNumbers() STDERR: 1 0x7f92002e2f81 STDERR: 2 0x7f92002e13b4 STDERR: 3 0x7f92003147b5 STDERR: 4 0x7f9200305963 STDERR: 5 0x7f920018496a STDERR: 6 0x7f920026c40b STDERR: 7 0x7f9200310080 STDERR: 8 0x7f92002d99e5 STDERR: 9 0x7f9200218181 STDERR: 10 0x7f92001f641c STDERR: 11 0x7f9200181074 STDERR: 12 0x7f92002e1368 STDERR: 13 0x7f920031085d STDERR: 14 0x7f9200310836 STDERR: 15 0x7f92004d6a6c STDERR: 16 0x7f92003f5c24 STDERR: 17 0x7f920048b9fe STDERR: 18 0x7f92003f5091 STDERR: 19 0x7f9201004222 STDERR: 20 0x7f9201386800 STDERR: 21 0x7f9201936c0d STDERR: 22 0x7f9201936c8e STDERR: 23 0x7f9206459657 STDERR: 24 0x7f920645d902 STDERR: 25 0x7f920645b4c7 STDERR: 26 0x7f9206459212 STDERR: 27 0x7f92063d82d6 STDERR: 28 0x7f92063dac58 STDERR: 29 0x10a65fd062ee STDERR: Received signal 11 SEGV_MAPERR 0000bbadbeef STDERR: [0x7f9204c427f8] base::debug::StackTrace::StackTrace() STDERR: [0x7f9204c420ff] base::debug::(anonymous namespace)::StackDumpSignalHandler() STDERR: [0x7f91fcfcccb0] <unknown> STDERR: [0x7f92002e2f8b] WebCore::RenderListItem::updateListMarkerNumbers() STDERR: [0x7f92002e13b4] WebCore::RenderListItem::willBeRemovedFromTree() STDERR: [0x7f92003147b5] WebCore::RenderObjectChildList::removeChildNode() STDERR: [0x7f9200305963] WebCore::RenderObject::removeChild() STDERR: [0x7f920018496a] WebCore::RenderBlock::removeChild() STDERR: [0x7f920026c40b] WebCore::RenderObject::remove() STDERR: [0x7f9200310080] WebCore::RenderObject::willBeDestroyed() STDERR: [0x7f92002d99e5] WebCore::RenderLayerModelObject::willBeDestroyed() STDERR: [0x7f9200218181] WebCore::RenderBoxModelObject::willBeDestroyed() STDERR: [0x7f92001f641c] WebCore::RenderBox::willBeDestroyed() STDERR: [0x7f9200181074] WebCore::RenderBlock::willBeDestroyed() STDERR: [0x7f92002e1368] WebCore::RenderListItem::willBeDestroyed() STDERR: [0x7f920031085d] WebCore::RenderObject::destroy() STDERR: [0x7f9200310836] WebCore::RenderObject::destroyAndCleanupAnonymousWrappers() STDERR: [0x7f92004d6a6c] WebCore::Node::detach() STDERR: [0x7f92003f5c24] WebCore::ContainerNode::detach() STDERR: [0x7f920048b9fe] WebCore::Element::detach() STDERR: [0x7f92003f5091] WebCore::ContainerNode::removeChildren() STDERR: [0x7f9201004222] WebCore::replaceChildrenWithFragment() STDERR: [0x7f9201386800] WebCore::HTMLElement::setInnerHTML() STDERR: [0x7f9201936c0d] WebCore::HTMLElementV8Internal::innerHTMLAttrSetter() STDERR: [0x7f9201936c8e] WebCore::HTMLElementV8Internal::innerHTMLAttrSetterCallback() STDERR: [0x7f9206459657] v8::internal::JSObject::SetPropertyWithCallback() STDERR: [0x7f920645d902] v8::internal::JSObject::SetPropertyForResult() STDERR: [0x7f920645b4c7] v8::internal::JSReceiver::SetProperty() STDERR: [0x7f9206459212] v8::internal::JSReceiver::SetProperty() STDERR: [0x7f92063d82d6] v8::internal::StoreIC::Store() STDERR: [0x7f92063dac58] v8::internal::StoreIC_Miss() STDERR: [0x10a65fd062ee] <unknown> STDERR: r8: 00007f91f3ce9980 r9: 00007f92074a30d0 r10: 0000000000000001 r11: 0000000000000000 STDERR: r12: 000038c3e181ca49 r13: 000038c3e19f3f41 r14: 0000000000000003 r15: 00007fff8c842270 STDERR: di: 0000000000000000 si: 00000000efcdab90 bp: 00007fff8c841520 bx: 0000000000000000 STDERR: dx: 00007f91fcfb8aa0 ax: 00000000bbadbeef cx: 00007f91fcce491d sp: 00007fff8c8414f0 STDERR: ip: 00007f92002e2f8b efl: 0000000000010246 cgf: 0000000000000033 erf: 0000000000000006 STDERR: trp: 000000000000000e msk: 0000000000000000 cr2: 00000000bbadbeef

Comment on attachment 195090 [details] ROLLOUT of r146879 Clearing flags on attachment: 195090 Committed r146883: <http://trac.webkit.org/changeset/146883>

All reviewed patches have been landed. Closing bug.

You guys should improve the stack trace produced by Chromium bots... That stack trace is annoyingly unhelpful (e.g. it doesn't tell us line number or offset)