Bug 113369

RIM PR 316822 Back traces ============ #0 0x7817d142 in BlackBerry::Platform::platformCrash (file=0x78338fa8 "/home/worker/workspace/playbook/platform/blackberryplatform/BlackBerryPlatformGuardedPointer.cpp", line=<optimized out>, function=<optimized out>) at /home/worker/workspace/playbook/platform/blackberryplatform/BlackBerryPlatformAssert.cpp:24 #1 0x78186c8c in BlackBerry::Platform::GuardedPointerBase::~GuardedPointerBase (this=0x816426c, __in_chrg=<optimized out>) at /home/worker/workspace/playbook/platform/blackberryplatform/BlackBerryPlatformGuardedPointer.cpp:138 #2 0x782d97b4 in BlackBerry::Platform::LayoutTestClient::~LayoutTestClient (this=0x816426c, __in_chrg=<optimized out>) at /home/worker/workspace/playbook/platform/blackberryplatform/BlackBerryPlatformLayoutTest.cpp:22 #3 0x784c5a5a in ~Timer (this=0x81642f0, __in_chrg=<optimized out>) at /home/worker/workspace/playbook/webkit/Source/WebCore/platform/Timer.h:98 #4 BlackBerry::WebKit::DumpRenderTree::~DumpRenderTree (this=0x8164268, __in_chrg=<optimized out>) at /home/worker/workspace/playbook/webkit/Tools/DumpRenderTree/blackberry/DumpRenderTree.cpp:207 #5 0x784c5ac8 in destruct (end=0x0, begin=0x0) at /home/worker/workspace/playbook/webkit/Source/WTF/wtf/Vector.h:58 #6 destruct (end=0x0, begin=0x0) at /home/worker/workspace/playbook/webkit/Source/WTF/wtf/Vector.h:221 #7 shrink (this=0x8164278, size=<optimized out>) at /home/worker/workspace/playbook/webkit/Source/WTF/wtf/Vector.h:941 #8 ~Vector (this=0x8164278, __in_chrg=<optimized out>) at /home/worker/workspace/playbook/webkit/Source/WTF/wtf/Vector.h:547 #9 BlackBerry::WebKit::DumpRenderTree::~DumpRenderTree (this=0x8164268, __in_chrg=<optimized out>) at /home/worker/workspace/playbook/webkit/Tools/DumpRenderTree/blackberry/DumpRenderTree.cpp:207 #10 0x080980c8 in ?? () #11 0x080980c8 in ?? () Root cause ============ B::W::DumpRenderTree derived from B::W::DumpRenderTreeClient and B::P::LayoutTestClient, and B::P::LayoutTestClient derived from B::P::GuardedPointerBase. In WebPagePrivate::m_dumpRenderTree is a B::W::DumpRenderTreeClient pointer backed by a B::W::DumpRenderTree instance. So if we delete m_dumpRenderTree the DumpRenderTree object will be deleted directory without calling deleteGuardedObject, and hit the assert in GuardedPointerBase::~GuardedPointerBase(). Solution ========== Since WebPagePrivate::m_dumpRenderTree is not derived from GuardedPointerBase, we can't use "deleteGuardedObject(m_dumpRenderTree);". We can add a virtual function DumpRenderTreeClient::destroy() and use it to destruct the DumpRenderTree instance.