108285 2013-01-29 19:35:11 -0800 Crashed while ref'ing DatabaseContext in DatabaseManager::interruptAllDatabasesForContext() 2013-01-30 23:07:45 -0800 1 1 1 Unclassified WebKit Tools / Tests 528+ (Nightly build) Unspecified Unspecified RESOLVED FIXED P2 Normal --- 1 keishi mark.lam alancutter ap beidson ggaren levin levin+threading mark.lam sam webkit.review.bot oldest_to_newest 819710 0 keishi 2013-01-29 19:35:11 -0800 crash log for DumpRenderTree (pid 3449): STDOUT: <empty> STDERR: ASSERTION FAILED: m_verifier.isSafeToUse() STDERR: ../../third_party/WebKit/Source/WTF/wtf/RefCounted.h(58) : void WTF::RefCountedBase::ref() STDERR: 1 0x362f91e7 WTF::RefCountedBase::ref() STDERR: 2 0x388a3ee1 WebCore::DatabaseManager::existingDatabaseContextFor(WebCore::ScriptExecutionContext*) STDERR: 3 0x388a5303 WebCore::DatabaseManager::interruptAllDatabasesForContext(WebCore::ScriptExecutionContext*) STDERR: 4 0x394bdaa1 WebCore::WorkerThread::stop() STDERR: 5 0x394af01c WebCore::WorkerMessagingProxy::terminateWorkerContext() STDERR: 6 0x36550752 WebKit::WebWorkerClientImpl::terminateWorkerContext() STDERR: 7 0x3949c9c4 WebCore::Worker::terminate() STDERR: 8 0x3949ca5b WebCore::Worker::stop() STDERR: 9 0x372267aa WebCore::ScriptExecutionContext::stopActiveDOMObjects() STDERR: 10 0x3704cb73 WebCore::Document::detach() STDERR: 11 0x3704d231 WebCore::Document::prepareForDestruction() STDERR: 12 0x39361aa0 WebCore::Frame::setView(WTF::PassRefPtr<WebCore::FrameView>) STDERR: 13 0x393653e6 WebCore::Frame::createView(WebCore::IntSize const&, WebCore::Color const&, bool, WebCore::IntSize const&, WebCore::IntRect const&, bool, WebCore::ScrollbarMode, bool, WebCore::ScrollbarMode, bool) STDERR: 14 0x36474b49 WebKit::WebFrameImpl::createFrameView() STDERR: 15 0x363a48ce WebKit::FrameLoaderClientImpl::makeDocumentView() STDERR: 16 0x363aa3db WebKit::FrameLoaderClientImpl::transitionToCommittedForNewPage() STDERR: 17 0x391db843 WebCore::FrameLoader::transitionToCommitted(WTF::PassRefPtr<WebCore::CachedPage>) STDERR: 18 0x391daa22 WebCore::FrameLoader::commitProvisionalLoad() STDERR: 19 0x391917fd WebCore::DocumentLoader::commitIfReady() STDERR: 20 0x39191f73 WebCore::DocumentLoader::commitLoad(char const*, int) STDERR: 21 0x3919274d WebCore::DocumentLoader::receivedData(char const*, int) STDERR: 22 0x39201008 WebCore::MainResourceLoader::dataReceived(WebCore::CachedResource*, char const*, int) STDERR: 23 0x3926d121 WebCore::CachedRawResource::data(WTF::PassRefPtr<WebCore::ResourceBuffer>, bool) STDERR: 24 0x3922fbed WebCore::SubresourceLoader::sendDataToResource(char const*, int) STDERR: 25 0x3922ff47 WebCore::SubresourceLoader::didReceiveData(char const*, int, long long, bool) STDERR: 26 0x39228257 WebCore::ResourceLoader::didReceiveData(WebCore::ResourceHandle*, char const*, int, int) STDERR: 27 0x36bae7c2 WebCore::ResourceHandleInternal::didReceiveData(WebKit::WebURLLoader*, char const*, int, int) STDERR: 28 0x317d49dc webkit_glue::WebURLLoaderImpl::Context::OnReceivedData(char const*, int, int) STDERR: 29 0x3102a54f (anonymous namespace)::RequestProxy::NotifyReceivedData(int) STDERR: 30 0x3102ac02 base::internal::RunnableAdapter<void ((anonymous namespace)::RequestProxy::*)(int)>::Run((anonymous namespace)::RequestProxy*, int const&) STDERR: 31 0x3102ab2f base::internal::InvokeHelper<false, void, base::internal::RunnableAdapter<void ((anonymous namespace)::RequestProxy::*)(int)>, void ()((anonymous namespace)::RequestProxy* const&, int const&)>::MakeItSo(base::internal::RunnableAdapter<void ((anonymous namespace)::RequestProxy::*)(int)>, (anonymous namespace)::RequestProxy* const&, int const&) STDERR: Received signal 11 SEGV_MAPERR 0000bbadbeef STDERR: [0x000034c5601f] STDERR: [0x000034c55fbb] STDERR: [0x000034c55c4b] STDERR: [0x000097bb505b] STDERR: [0x0000ffffffff] STDERR: [0x0000388a3ee1] STDERR: [0x0000388a5303] STDERR: [0x0000394bdaa1] STDERR: [0x0000394af01c] STDERR: [0x000036550752] STDERR: [0x00003949c9c4] STDERR: [0x00003949ca5b] STDERR: [0x0000372267aa] STDERR: [0x00003704cb73] STDERR: [0x00003704d231] STDERR: [0x000039361aa0] STDERR: [0x0000393653e6] STDERR: [0x000036474b49] STDERR: [0x0000363a48ce] STDERR: [0x0000363aa3db] STDERR: [0x0000391db843] STDERR: [0x0000391daa22] STDERR: [0x0000391917fd] STDERR: [0x000039191f73] STDERR: [0x00003919274d] STDERR: [0x000039201008] STDERR: [0x00003926d121] STDERR: [0x00003922fbed] STDERR: [0x00003922ff47] STDERR: [0x000039228257] STDERR: [0x000036bae7c2] STDERR: [0x0000317d49dc] STDERR: [0x00003102a54f] STDERR: [0x00003102ac02] STDERR: [0x00003102ab2f] STDERR: [0x00003102aaa4] STDERR: [0x000034c41c1b] STDERR: [0x000034cd372b] STDERR: [0x000034cd3bf2] STDERR: [0x000034cd3df2] STDERR: [0x000034c1d7eb] STDERR: [0x000034c1cfa2] STDERR: [0x000098caa42b] STDERR: [0x000098ca7eef] STDERR: [0x000098ca73c4] STDERR: [0x000098ca71f1] STDERR: [0x000096fe5e04] STDERR: [0x000096fe5bb9] STDERR: [0x000096fe5a3e] STDERR: [0x000093429595] STDERR: [0x000093428dd6] STDERR: [0x0000933eb1f3] STDERR: [0x000034c1e71e] STDERR: [0x000034c1d558] STDERR: [0x000034cd2f72] STDERR: [0x000034cd2e2b] STDERR: [0x000034d3fe88] STDERR: [0x000034cd2226] STDERR: [0x00003105d6b7] STDERR: [0x000030efe9e9] STDERR: [0x000030ee9f87] STDERR: [0x000030eb6258] STDERR: ax: bbadbeef, bx: 0, cx: e022b7cb, dx: e022b7cb STDERR: di: 3957cd2c, si: 3957cfbe, bp: bfffc648, sp: bfffc610, ss: 23, flags: 10282 STDERR: ip: 362f91f1, cs: 1b, ds: 23, es: 23, fs: 0, gs: f 820266 1 mark.lam 2013-01-30 09:36:43 -0800 WebCore::DatabaseManager::interruptAllDatabasesForContext() is the only API that can access another thread's DatabaseContext. Since DatabaseContext is ref counted and can be ref'ed by another thread (in the interrupt case), it should extend ThreadSafeRefCounted instead of the RefCounted. Investigating the fix right now. 820534 2 185565 mark.lam 2013-01-30 14:12:30 -0800 Created attachment 185565 The fix. 820540 3 185565 mark.lam 2013-01-30 14:14:06 -0800 Comment on attachment 185565 The fix. View in context: https://bugs.webkit.org/attachment.cgi?id=185565&action=review > Source/WebCore/ChangeLog:14 > + This reflects the contract that another thread (calling doing the Typo in comment. Will remove "calling". 820587 4 185565 ap 2013-01-30 14:34:29 -0800 Comment on attachment 185565 The fix. View in context: https://bugs.webkit.org/attachment.cgi?id=185565&action=review r=me on ThreadSafeRefCounted part. > Source/WebCore/Modules/webdatabase/DatabaseManager.cpp:353 > -void DatabaseManager::interruptAllDatabasesForContext(ScriptExecutionContext* context) > +void DatabaseManager::interruptAllDatabasesForContext(const ScriptExecutionContext* context) I do not think that we should be using "const ScriptExecutionContext*" here, or anywhere. These are huge "world" objects that are never actually immutable, and saying that they are constant for the purposes of a particular function does not have any semantic meaning that I could catch. For example, you are passing context as constant here. But interrupting all databases for context modifies the context in a very noticeable way! 820620 5 mark.lam 2013-01-30 14:47:55 -0800 Removed "const" changes. Landed in r141320: <http://trac.webkit.org/changeset/141320>. 821117 6 alancutter 2013-01-30 23:07:45 -0800 Thanks Mark, the Chromium debug tests are happily passing again. Chromium expectations updated on: http://trac.webkit.org/changeset/141365 185565 2013-01-30 14:12:30 -0800 2013-01-30 14:34:28 -0800 The fix. bug-108285.patch text/plain 4741 mark.lam SW5kZXg6IFNvdXJjZS9XZWJDb3JlL0NoYW5nZUxvZwo9PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09Ci0tLSBTb3VyY2UvV2Vi Q29yZS9DaGFuZ2VMb2cJKHJldmlzaW9uIDE0MTMwNCkKKysrIFNvdXJjZS9XZWJDb3JlL0NoYW5n ZUxvZwkod29ya2luZyBjb3B5KQpAQCAtMSwzICsxLDI5IEBACisyMDEzLTAxLTMwICBNYXJrIExh bSAgPG1hcmsubGFtQGFwcGxlLmNvbT4KKworICAgICAgICBEYXRhYmFzZUNvbnRleHQgc2hvdWxk IGltcGxlbWVudCBUaHJlYWRTYWZlUmVmQ291bnRlZC4KKyAgICAgICAgaHR0cHM6Ly9idWdzLndl YmtpdC5vcmcvc2hvd19idWcuY2dpP2lkPTEwODI4NS4KKworICAgICAgICBSZXZpZXdlZCBieSBO T0JPRFkgKE9PUFMhKS4KKworICAgICAgICBEYXRhYmFzZU1hbmFnZXI6OmludGVycnVwdEFsbERh dGFiYXNlc0ZvckNvbnRleHQoKSBjYW4gcmVmIGEKKyAgICAgICAgRGF0YWJhc2VDb250ZXh0IGZy b20gYW5vdGhlciB0aHJlYWQuIEhlbmNlLCB0aGUgRGF0YWJhc2VDb250ZXh0IG5lZWRzCisgICAg ICAgIHRvIGJlIGEgVGhyZWFkU2FmZVJlZkNvdW50ZWQgaW5zdGVhZCBvZiBhIFJlZkNvdW50ZWQu CisKKyAgICAgICAgQWxzbyByZXZlcnRlZCB0aGUgU2NyaXB0RXhlY3V0aW9uQ29udGV4dCogYXJn IG9mCisgICAgICAgIERhdGFiYXNlTWFuYWdlcjo6aW50ZXJydXB0QWxsRGF0YWJhc2VzRm9yQ29u dGV4dCgpIHRvIGJlIGNvbnN0IGFnYWluLgorICAgICAgICBUaGlzIHJlZmxlY3RzIHRoZSBjb250 cmFjdCB0aGF0IGFub3RoZXIgdGhyZWFkIChjYWxsaW5nIGRvaW5nIHRoZQorICAgICAgICBpbnRl cnJ1cHRpbmcpIHNob3VsZCBub3QgYmUgYWJsZSB0byBtb2RpZnkgdGhlIGNvbnRlbnRzIG9mIHRo ZQorICAgICAgICBTY3JpcHRFeGVjdXRpb25Db250ZXh0LgorCisgICAgICAgIE5vIG5ldyB0ZXN0 cy4KKworICAgICAgICAqIE1vZHVsZXMvd2ViZGF0YWJhc2UvRGF0YWJhc2VDb250ZXh0Lmg6Cisg ICAgICAgICogTW9kdWxlcy93ZWJkYXRhYmFzZS9EYXRhYmFzZU1hbmFnZXIuY3BwOgorICAgICAg ICAoV2ViQ29yZTo6RGF0YWJhc2VNYW5hZ2VyOjpleGlzdGluZ0RhdGFiYXNlQ29udGV4dEZvcik6 CisgICAgICAgIChXZWJDb3JlOjpEYXRhYmFzZU1hbmFnZXI6OmludGVycnVwdEFsbERhdGFiYXNl c0ZvckNvbnRleHQpOgorICAgICAgICAqIE1vZHVsZXMvd2ViZGF0YWJhc2UvRGF0YWJhc2VNYW5h Z2VyLmg6CisgICAgICAgIChEYXRhYmFzZU1hbmFnZXIpOgorCiAyMDEzLTAxLTMwICBGbG9yaW4g TWFsaXRhICA8Zm1hbGl0YUBjaHJvbWl1bS5vcmc+CiAKICAgICAgICAgW0Nocm9taXVtXSBVbnJl dmlld2VkIGdhcmRlbmluZy4KSW5kZXg6IFNvdXJjZS9XZWJDb3JlL01vZHVsZXMvd2ViZGF0YWJh c2UvRGF0YWJhc2VDb250ZXh0LmgKPT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PQotLS0gU291cmNlL1dlYkNvcmUvTW9kdWxl cy93ZWJkYXRhYmFzZS9EYXRhYmFzZUNvbnRleHQuaAkocmV2aXNpb24gMTQxMzAzKQorKysgU291 cmNlL1dlYkNvcmUvTW9kdWxlcy93ZWJkYXRhYmFzZS9EYXRhYmFzZUNvbnRleHQuaAkod29ya2lu ZyBjb3B5KQpAQCAtMzMsNyArMzMsNyBAQAogI2luY2x1ZGUgIkFjdGl2ZURPTU9iamVjdC5oIgog I2luY2x1ZGUgIkRhdGFiYXNlRGV0YWlscy5oIgogI2luY2x1ZGUgPHd0Zi9Bc3NlcnRpb25zLmg+ Ci0jaW5jbHVkZSA8d3RmL1JlZkNvdW50ZWQuaD4KKyNpbmNsdWRlIDx3dGYvVGhyZWFkU2FmZVJl ZkNvdW50ZWQuaD4KIAogbmFtZXNwYWNlIFdlYkNvcmUgewogCkBAIC00Miw3ICs0Miw3IEBAIGNs YXNzIERhdGFiYXNlVGFza1N5bmNocm9uaXplcjsKIGNsYXNzIERhdGFiYXNlVGhyZWFkOwogY2xh c3MgU2NyaXB0RXhlY3V0aW9uQ29udGV4dDsKIAotY2xhc3MgRGF0YWJhc2VDb250ZXh0IDogcHVi bGljIFJlZkNvdW50ZWQ8RGF0YWJhc2VDb250ZXh0PiwgQWN0aXZlRE9NT2JqZWN0IHsKK2NsYXNz IERhdGFiYXNlQ29udGV4dCA6IHB1YmxpYyBUaHJlYWRTYWZlUmVmQ291bnRlZDxEYXRhYmFzZUNv bnRleHQ+LCBBY3RpdmVET01PYmplY3QgewogcHVibGljOgogICAgIHZpcnR1YWwgfkRhdGFiYXNl Q29udGV4dCgpOwogCkluZGV4OiBTb3VyY2UvV2ViQ29yZS9Nb2R1bGVzL3dlYmRhdGFiYXNlL0Rh dGFiYXNlTWFuYWdlci5jcHAKPT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PQotLS0gU291cmNlL1dlYkNvcmUvTW9kdWxlcy93 ZWJkYXRhYmFzZS9EYXRhYmFzZU1hbmFnZXIuY3BwCShyZXZpc2lvbiAxNDEzMDMpCisrKyBTb3Vy Y2UvV2ViQ29yZS9Nb2R1bGVzL3dlYmRhdGFiYXNlL0RhdGFiYXNlTWFuYWdlci5jcHAJKHdvcmtp bmcgY29weSkKQEAgLTEyOSw3ICsxMjksNyBAQCBwcml2YXRlOgogICAgIFJlZlB0cjxEYXRhYmFz ZUNhbGxiYWNrPiBtX2NyZWF0aW9uQ2FsbGJhY2s7CiB9OwogCi1QYXNzUmVmUHRyPERhdGFiYXNl Q29udGV4dD4gRGF0YWJhc2VNYW5hZ2VyOjpleGlzdGluZ0RhdGFiYXNlQ29udGV4dEZvcihTY3Jp cHRFeGVjdXRpb25Db250ZXh0KiBjb250ZXh0KQorUGFzc1JlZlB0cjxEYXRhYmFzZUNvbnRleHQ+ IERhdGFiYXNlTWFuYWdlcjo6ZXhpc3RpbmdEYXRhYmFzZUNvbnRleHRGb3IoY29uc3QgU2NyaXB0 RXhlY3V0aW9uQ29udGV4dCogY29udGV4dCkKIHsKICAgICBNdXRleExvY2tlciBsb2NrZXIobV9j b250ZXh0TWFwTG9jayk7CiAKQEAgLTM1MCw3ICszNTAsNyBAQCB2b2lkIERhdGFiYXNlTWFuYWdl cjo6Y2xvc2VEYXRhYmFzZXNJbW1lCiB9CiAjZW5kaWYgLy8gUExBVEZPUk0oQ0hST01JVU0pCiAK LXZvaWQgRGF0YWJhc2VNYW5hZ2VyOjppbnRlcnJ1cHRBbGxEYXRhYmFzZXNGb3JDb250ZXh0KFNj cmlwdEV4ZWN1dGlvbkNvbnRleHQqIGNvbnRleHQpCit2b2lkIERhdGFiYXNlTWFuYWdlcjo6aW50 ZXJydXB0QWxsRGF0YWJhc2VzRm9yQ29udGV4dChjb25zdCBTY3JpcHRFeGVjdXRpb25Db250ZXh0 KiBjb250ZXh0KQogewogICAgIFJlZlB0cjxEYXRhYmFzZUNvbnRleHQ+IGRhdGFiYXNlQ29udGV4 dCA9IGV4aXN0aW5nRGF0YWJhc2VDb250ZXh0Rm9yKGNvbnRleHQpOwogICAgIGlmIChkYXRhYmFz ZUNvbnRleHQpCkluZGV4OiBTb3VyY2UvV2ViQ29yZS9Nb2R1bGVzL3dlYmRhdGFiYXNlL0RhdGFi YXNlTWFuYWdlci5oCj09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT0KLS0tIFNvdXJjZS9XZWJDb3JlL01vZHVsZXMvd2ViZGF0 YWJhc2UvRGF0YWJhc2VNYW5hZ2VyLmgJKHJldmlzaW9uIDE0MTMwMykKKysrIFNvdXJjZS9XZWJD b3JlL01vZHVsZXMvd2ViZGF0YWJhc2UvRGF0YWJhc2VNYW5hZ2VyLmgJKHdvcmtpbmcgY29weSkK QEAgLTEwOSw3ICsxMDksNyBAQCBwdWJsaWM6CiAgICAgdm9pZCBjbG9zZURhdGFiYXNlc0ltbWVk aWF0ZWx5KGNvbnN0IFN0cmluZyYgb3JpZ2luSWRlbnRpZmllciwgY29uc3QgU3RyaW5nJiBuYW1l KTsKICNlbmRpZiAvLyBQTEFURk9STShDSFJPTUlVTSkKIAotICAgIHZvaWQgaW50ZXJydXB0QWxs RGF0YWJhc2VzRm9yQ29udGV4dChTY3JpcHRFeGVjdXRpb25Db250ZXh0Kik7CisgICAgdm9pZCBp bnRlcnJ1cHRBbGxEYXRhYmFzZXNGb3JDb250ZXh0KGNvbnN0IFNjcmlwdEV4ZWN1dGlvbkNvbnRl eHQqKTsKIAogICAgIGJvb2wgY2FuRXN0YWJsaXNoRGF0YWJhc2UoU2NyaXB0RXhlY3V0aW9uQ29u dGV4dCosIGNvbnN0IFN0cmluZyYgbmFtZSwgY29uc3QgU3RyaW5nJiBkaXNwbGF5TmFtZSwgdW5z aWduZWQgbG9uZyBlc3RpbWF0ZWRTaXplKTsKICAgICB2b2lkIGFkZE9wZW5EYXRhYmFzZShEYXRh YmFzZUJhY2tlbmQqKTsKQEAgLTEyNCwxNCArMTI0LDE0IEBAIHByaXZhdGU6CiAKICAgICAvLyBU aGlzIGdldHMgYSBEYXRhYmFzZUNvbnRleHQgZm9yIHRoZSBzcGVjaWZpZWQgU2NyaXB0RXhlY3V0 aW9uQ29udGV4dCBpZgogICAgIC8vIGl0IGFscmVhZHkgZXhpc3QgcHJldmlvdXNseS4gT3RoZXJ3 aXNlLCBpdCByZXR1cm5zIDAuCi0gICAgUGFzc1JlZlB0cjxEYXRhYmFzZUNvbnRleHQ+IGV4aXN0 aW5nRGF0YWJhc2VDb250ZXh0Rm9yKFNjcmlwdEV4ZWN1dGlvbkNvbnRleHQqKTsKKyAgICBQYXNz UmVmUHRyPERhdGFiYXNlQ29udGV4dD4gZXhpc3RpbmdEYXRhYmFzZUNvbnRleHRGb3IoY29uc3Qg U2NyaXB0RXhlY3V0aW9uQ29udGV4dCopOwogCiAgICAgQWJzdHJhY3REYXRhYmFzZVNlcnZlciog bV9zZXJ2ZXI7CiAgICAgRGF0YWJhc2VNYW5hZ2VyQ2xpZW50KiBtX2NsaWVudDsKICAgICBib29s IG1fZGF0YWJhc2VJc0F2YWlsYWJsZTsKIAogICAgIC8vIEFjY2VzcyB0byB0aGUgZm9sbG93aW5n IGZpZWxkcyByZXF1aXJlIGxvY2tpbmcgbV9jb250ZXh0TWFwTG9jazoKLSAgICB0eXBlZGVmIEhh c2hNYXA8U2NyaXB0RXhlY3V0aW9uQ29udGV4dCosIERhdGFiYXNlQ29udGV4dCo+IENvbnRleHRN YXA7CisgICAgdHlwZWRlZiBIYXNoTWFwPGNvbnN0IFNjcmlwdEV4ZWN1dGlvbkNvbnRleHQqLCBE YXRhYmFzZUNvbnRleHQqPiBDb250ZXh0TWFwOwogICAgIENvbnRleHRNYXAgbV9jb250ZXh0TWFw OwogI2lmICFBU1NFUlRfRElTQUJMRUQKICAgICBpbnQgbV9kYXRhYmFzZUNvbnRleHRSZWdpc3Rl cmVkQ291bnQ7Cg==