105606 2012-12-20 20:08:26 -0800 Various tests in media/track are intermittently crashing 2012-12-24 04:35:00 -0800 1 1 1 Unclassified WebKit Media 528+ (Nightly build) Unspecified Unspecified RESOLVED FIXED P1 Critical --- 1 rniwa loislo dino eric.carlson eric feature-media-reviews loislo ojan.autocc palmer rniwa simon.fraser tony webkit.review.bot oldest_to_newest 796079 0 rniwa 2012-12-20 20:08:26 -0800 They all seem to have the same stack trace: Thread 0 Crashed:: Dispatch queue: com.apple.main-thread 0 com.apple.WebCore 0x0000000103343825 void WebCore::removeAllChildrenInContainer<WebCore::Node, WebCore::ContainerNode>(WebCore::ContainerNode*) + 229 (ContainerNodeAlgorithms.h:104) 1 com.apple.WebCore 0x000000010342d13b WebCore::Document::removedLastRef() + 539 (OwnPtr.h:72) 2 com.apple.WebCore 0x0000000103f04423 WebCore::TagNodeList::~TagNodeList() + 291 (Weak.h:143) 3 com.apple.WebCore 0x0000000103f045e3 WebCore::HTMLTagNodeList::~HTMLTagNodeList() + 67 (RefCounted.h:197) 4 com.apple.WebCore 0x0000000103991901 WebCore::JSNodeListOwner::finalize(JSC::Handle<JSC::Unknown>, void*) + 65 (JSNodeList.h:58) 5 com.apple.JavaScriptCore 0x0000000102c97f4c JSC::WeakBlock::sweep() + 108 (WeakImpl.h:84) 6 com.apple.JavaScriptCore 0x0000000102c982b8 JSC::WeakSet::sweep() + 40 (DoublyLinkedList.h:118) 7 com.apple.JavaScriptCore 0x0000000102bcf2d8 JSC::MarkedBlock::sweep(JSC::MarkedBlock::SweepMode) + 24 (MarkedBlock.cpp:112) 8 com.apple.JavaScriptCore 0x0000000102c96fa3 JSC::MarkedAllocator::allocateSlowCase(unsigned long) + 99 (MarkedAllocator.cpp:34) 9 com.apple.JavaScriptCore 0x0000000102b8c52d JSC::FunctionPrototype::create(JSC::ExecState*, JSC::JSGlobalObject*, JSC::Structure*) + 77 (MarkedAllocator.h:78) 10 com.apple.JavaScriptCore 0x0000000102b87c21 JSC::JSGlobalObject::reset(JSC::JSValue) + 209 (JSGlobalObject.cpp:202) 11 com.apple.WebCore 0x000000010389a523 WebCore::JSDOMWindowBase::finishCreation(JSC::JSGlobalData&, WebCore::JSDOMWindowShell*) + 35 (JSDOMWindowBase.cpp:69) 12 com.apple.WebCore 0x000000010389ef7f WebCore::JSDOMWindow::create(JSC::JSGlobalData&, JSC::Structure*, WTF::PassRefPtr<WebCore::DOMWindow>, WebCore::JSDOMWindowShell*) + 175 (JSDOMWindow.h:42) 13 com.apple.WebCore 0x000000010389ec7c WebCore::JSDOMWindowShell::setWindow(WTF::PassRefPtr<WebCore::DOMWindow>) + 380 (JSDOMWindowShell.cpp:75) 14 com.apple.WebCore 0x0000000103d6d234 WebCore::ScriptController::clearWindowShell(WebCore::DOMWindow*, bool) + 276 (PassRefPtr.h:68) 15 com.apple.WebCore 0x00000001035d2b9f WebCore::FrameLoader::clear(WebCore::Document*, bool, bool, bool) + 271 (FrameLoader.cpp:568) 16 com.apple.WebCore 0x0000000103459b61 WebCore::DocumentWriter::begin(WebCore::KURL const&, bool, WebCore::Document*) + 369 (DocumentWriter.cpp:135) 17 com.apple.WebCore 0x00000001034497db WebCore::DocumentLoader::commitData(char const*, unsigned long) + 91 (RefPtr.h:56) 18 com.apple.WebKit 0x0000000102fae7b4 -[WebHTMLRepresentation receivedData:withDataSource:] + 100 (WebHTMLRepresentation.mm:186) 19 com.apple.WebKit 0x0000000102f8149d -[WebDataSource(WebInternal) _receivedData:] + 77 (WebDataSource.mm:216) 20 com.apple.WebKit 0x0000000102f994f7 WebFrameLoaderClient::committedLoad(WebCore::DocumentLoader*, char const*, int) + 103 (WebFrameLoaderClient.mm:841) 21 com.apple.WebCore 0x0000000103449a20 WebCore::DocumentLoader::commitLoad(char const*, int) + 144 (RefCounted.h:148) 22 com.apple.WebCore 0x0000000103b33ec3 WebCore::MainResourceLoader::dataReceived(WebCore::CachedResource*, char const*, int) + 787 (MainResourceLoader.cpp:497) 23 com.apple.WebCore 0x0000000103300145 WebCore::CachedRawResource::data(WTF::PassRefPtr<WebCore::ResourceBuffer>, bool) + 309 (CachedRawResource.cpp:70) 24 com.apple.WebCore 0x0000000103e4427a WebCore::SubresourceLoader::sendDataToResource(char const*, int) + 122 (PassRefPtr.h:68) 25 com.apple.WebCore 0x0000000103e4435c WebCore::SubresourceLoader::didReceiveData(char const*, int, long long, bool) + 76 (ResourceLoader.h:142) 26 com.apple.WebCore 0x0000000103d4dd48 WebCore::ResourceLoader::didReceiveData(WebCore::ResourceHandle*, char const*, int, int) + 136 (InspectorInstrumentation.h:260) 27 com.apple.Foundation 0x00007fff87ee6f58 __65-[NSURLConnectionInternal _withConnectionAndDelegate:onlyActive:]_block_invoke_0 + 28 28 com.apple.Foundation 0x00007fff87ee6e9c -[NSURLConnectionInternal _withConnectionAndDelegate:onlyActive:] + 227 29 com.apple.Foundation 0x00007fff87ee6d98 -[NSURLConnectionInternal _withActiveConnectionAndDelegate:] + 63 30 com.apple.Foundation 0x00007fff87ee992b _NSURLConnectionDidReceiveData_LengthReceived + 86 31 com.apple.CFNetwork 0x00007fff8971d7b1 ___delegate_didReceiveDataArray_block_invoke_0 + 132 32 com.apple.CFNetwork 0x00007fff89710753 ___withDelegateAsync_block_invoke_0 + 90 33 com.apple.CFNetwork 0x00007fff8979f2ca __block_global_1 + 28 34 com.apple.CoreFoundation 0x00007fff92f8c724 CFArrayApplyFunction + 68 35 com.apple.CFNetwork 0x00007fff89701a6c RunloopBlockContext::perform() + 126 36 com.apple.CFNetwork 0x00007fff8970194b MultiplexerSource::perform() + 221 37 com.apple.CoreFoundation 0x00007fff92f6e101 __CFRUNLOOP_IS_CALLING_OUT_TO_A_SOURCE0_PERFORM_FUNCTION__ + 17 38 com.apple.CoreFoundation 0x00007fff92f6da25 __CFRunLoopDoSources0 + 245 39 com.apple.CoreFoundation 0x00007fff92f90dc5 __CFRunLoopRun + 789 40 com.apple.CoreFoundation 0x00007fff92f906b2 CFRunLoopRunSpecific + 290 41 com.apple.Foundation 0x00007fff87f6489e -[NSRunLoop(NSRunLoop) runMode:beforeDate:] + 268 42 DumpRenderTree 0x00000001028b24c9 runTest(std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> > const&) + 1624 (DumpRenderTree.mm:1378) 43 DumpRenderTree 0x00000001028b1c54 dumpRenderTree(int, char const**) + 1855 (DumpRenderTree.mm:842) 44 DumpRenderTree 0x00000001028b2832 main + 86 (DumpRenderTree.mm:927) 45 libdyld.dylib 0x00007fff89a677e1 start + 1 796081 1 rniwa 2012-12-20 20:09:05 -0800 I’ve seen crashes on: media/track/tracklist-is-reachable.html media/track/text-track-cue-is-reachable.html media/track/text-track-is-reachable.html media/track/track-webvtt-tc005-header-comment.html media/track/track-webvtt-tc004-magic-header.html media/track/track-webvtt-tc016-align-positioning.html But looking at the commit queue, other tests are also crashing. 796195 2 180491 loislo 2012-12-21 01:44:30 -0800 Created attachment 180491 Patch 796201 3 180491 rniwa 2012-12-21 02:01:28 -0800 Comment on attachment 180491 Patch The fix looks reasonable. I'm hoping that either Dean or Eric could review it. 796324 4 180491 eric 2012-12-21 08:35:34 -0800 Comment on attachment 180491 Patch LGTM. 796325 5 180491 loislo 2012-12-21 08:37:34 -0800 Comment on attachment 180491 Patch Clearing flags on attachment: 180491 Committed r138381: <http://trac.webkit.org/changeset/138381> 796326 6 loislo 2012-12-21 08:37:40 -0800 All reviewed patches have been landed. Closing bug. 796349 7 eric.carlson 2012-12-21 09:39:24 -0800 (In reply to comment #3) > (From update of attachment 180491 [details]) > The fix looks reasonable. I'm hoping that either Dean or Eric could review it. It looks correct to me as well, thank you! 796945 8 loislo 2012-12-24 04:35:00 -0800 *** Bug 105657 has been marked as a duplicate of this bug. *** 180491 2012-12-21 01:44:30 -0800 2012-12-21 08:37:33 -0800 Patch bug-105606-20121221134145.patch text/plain 1521 loislo U3VidmVyc2lvbiBSZXZpc2lvbjogMTM4MzUyCmRpZmYgLS1naXQgYS9Tb3VyY2UvV2ViQ29yZS9D aGFuZ2VMb2cgYi9Tb3VyY2UvV2ViQ29yZS9DaGFuZ2VMb2cKaW5kZXggNmE4YTcyZTM1MGIzZTBj MGZlYjQ1NGI0MzA0YTM1MDcwZjM3Y2I0Zi4uNWYyNDQ3OGU4Y2U4ODYxM2FhMTQ3MTg2ZjMzN2Y3 NmYzZTAxN2NmNSAxMDA2NDQKLS0tIGEvU291cmNlL1dlYkNvcmUvQ2hhbmdlTG9nCisrKyBiL1Nv dXJjZS9XZWJDb3JlL0NoYW5nZUxvZwpAQCAtMSwzICsxLDE2IEBACisyMDEyLTEyLTIxICBJbHlh IFRpa2hvbm92c2t5ICA8bG9pc2xvQGNocm9taXVtLm9yZz4KKworICAgICAgICBWYXJpb3VzIHRl c3RzIGluIG1lZGlhL3RyYWNrIGFyZSBpbnRlcm1pdHRlbnRseSBjcmFzaGluZy4KKyAgICAgICAg aHR0cHM6Ly9idWdzLndlYmtpdC5vcmcvc2hvd19idWcuY2dpP2lkPTEwNTYwNgorCisgICAgICAg IFJldmlld2VkIGJ5IE5PQk9EWSAoT09QUyEpLgorCisgICAgICAgIFRoZSByb290IG9mIHByb2Js ZW0gaXMgdGhlIGZhY3QgdGhhdCB3ZSB1cGRhdGUgdHJhY2tzIGV2ZW4gaWYgd2UgYXJlIGluIHBy b2Nlc3Mgb2YgZGVsZXRpbmcgdGhlIGRvY3VtZW50LgorICAgICAgICBNZWRpYSBlbGVtZW50IGNh biBzdG9wIGRvaW5nIHRoYXQgaWYgdGhlIGRvY3VtZW50IGluZm9ybWVkIHRoZSBlbGVtZW50IHZp YSA6OnN0b3AgdGhhdCBpdCBpcyBnb2luZyBhd2F5LgorCisgICAgICAgICogaHRtbC9IVE1MTWVk aWFFbGVtZW50LmNwcDoKKyAgICAgICAgKFdlYkNvcmU6OkhUTUxNZWRpYUVsZW1lbnQ6OmVuZEln bm9yaW5nVHJhY2tEaXNwbGF5VXBkYXRlUmVxdWVzdHMpOgorCiAyMDEyLTEyLTIwICBSeW9zdWtl IE5pd2EgIDxybml3YUB3ZWJraXQub3JnPgogCiAgICAgICAgIE1vcmUgZml4IGFmdGVyIHIxMzgz NDguCmRpZmYgLS1naXQgYS9Tb3VyY2UvV2ViQ29yZS9odG1sL0hUTUxNZWRpYUVsZW1lbnQuY3Bw IGIvU291cmNlL1dlYkNvcmUvaHRtbC9IVE1MTWVkaWFFbGVtZW50LmNwcAppbmRleCA4N2YzNDM5 ZmRjZmIyYTE4ZWQ2NWZkZjI3MzlhNmQzYjE5YmUzMGYzLi5iNDY0NTkwYzVlMTAzM2JhMGIyYzI1 Y2NiODhjOGNmOTZmYzkzYjgwIDEwMDY0NAotLS0gYS9Tb3VyY2UvV2ViQ29yZS9odG1sL0hUTUxN ZWRpYUVsZW1lbnQuY3BwCisrKyBiL1NvdXJjZS9XZWJDb3JlL2h0bWwvSFRNTE1lZGlhRWxlbWVu dC5jcHAKQEAgLTEzODAsNyArMTM4MCw3IEBAIHZvaWQgSFRNTE1lZGlhRWxlbWVudDo6ZW5kSWdu b3JpbmdUcmFja0Rpc3BsYXlVcGRhdGVSZXF1ZXN0cygpCiB7CiAgICAgQVNTRVJUKG1faWdub3Jl VHJhY2tEaXNwbGF5VXBkYXRlKTsKICAgICAtLW1faWdub3JlVHJhY2tEaXNwbGF5VXBkYXRlOwot ICAgIGlmICghbV9pZ25vcmVUcmFja0Rpc3BsYXlVcGRhdGUpCisgICAgaWYgKCFtX2lnbm9yZVRy YWNrRGlzcGxheVVwZGF0ZSAmJiBtX2luQWN0aXZlRG9jdW1lbnQpCiAgICAgICAgIHVwZGF0ZUFj dGl2ZVRleHRUcmFja0N1ZXMoY3VycmVudFRpbWUoKSk7CiB9CiAK