EventHandlerRegistry asserts on circular HTML import and Polymer on-tap. |
|||
Issue description
Version: 57.0.2967.0
Repro:
The easiest way to trigger this as a Chromium developer is to go to chrome/browser/resources/md_history/app.html:2 and add <link rel="import" href="chrome://history/history.html">. This imports the top level page for history which imports app.html.
If you then go to chrome://history with DCHECKs/ASSERTs enabled, the renderer will Aw Snap at EventHandlerRegistry:316.
A minimized test case would be setting up a Polymer project thus:
index.html:
<!doctype html>
<head>
<link rel="import" href="app.html">
</head>
<body>
<test-app></test-app>
</body>
</html>
app.html:
<link rel="import" href="polymer.html">
<link rel="import" href="index.html">
<dom-module id="test-app">
<template>
<div on-tap="tapped">
</template>
<script>
Polymer({ is: 'test-app' });
</script>
</dom-module>
,
Jan 19 2017
will take a look soon.
,
Jan 20 2017
First I tried bisecting, but it seems not a recent regression, at least M56 branch also fails with this assertion. So probably wjmaclean@'s changes are not the culprit. Will take further look.
,
Jan 20 2017
Yes, I was just adding wjmaclean as FYI since I know he's been staring at this code recently.
,
Jan 20 2017
It seems like this bug also hits the consistency check: https://bugs.chromium.org/p/chromium/issues/detail?id=683071 It's a ClusterFuzz test case ... again not sure if it's my CL or a legacy issue, but at least it's another repro case. I've made some comments on that bug in case it helps ...
,
Jan 23 2017
Thanks! I also looked the issue there and added a comment. Really appreciate your help.
,
Jan 25 2017
The following revision refers to this bug: https://chromium.googlesource.com/chromium/src.git/+/c4d67ffc673ac4dc72dc2f7f7bb4d4b1735d229d commit c4d67ffc673ac4dc72dc2f7f7bb4d4b1735d229d Author: kochi <kochi@chromium.org> Date: Wed Jan 25 04:34:43 2017 Fix assertion hit on debug build for EventHandlerRegistry The assertion checks consistency during removing the event handlers for all the handler classes one by one, and reports inconsistency because the handlers are partially removed. Such inconsistency can happen while moving a node from detached document to a main document, found by clusterfuzz et al. This changes the consistency check to see only modified handler class. R=skyostil@chromium.org BUG= 683071 , 677596 Review-Url: https://codereview.chromium.org/2653463003 Cr-Commit-Position: refs/heads/master@{#445944} [modify] https://crrev.com/c4d67ffc673ac4dc72dc2f7f7bb4d4b1735d229d/third_party/WebKit/Source/core/frame/EventHandlerRegistry.cpp [modify] https://crrev.com/c4d67ffc673ac4dc72dc2f7f7bb4d4b1735d229d/third_party/WebKit/Source/core/frame/EventHandlerRegistry.h
,
Jan 25 2017
should be fixed now. BTW, out of curiosity - calamity@, do you have any legitimate use case for importing the main HTML as sub import, or did you just find the repro accidentally?
,
Jan 27 2017
Stumbled on it accidentally, didn't think it should crash the renderer lol.
,
Jan 27 2017
Thanks, I now feel assured that this is not a viable use case :)
,
Mar 15 2017
Remove Blink>DOM>Events |
|||
►
Sign in to add a comment |
|||
Comment 1 by dominicc@chromium.org
, Jan 19 2017Owner: kochi@chromium.org
Status: Assigned (was: Untriaged)