111613 2013-03-06 12:28:25 -0800 REGRESSION: Intermittent crash in SpeechSynthesis::didFinishSpeaking 2014-04-29 12:23:58 -0700 1 1 1 Unclassified WebKit Accessibility 528+ (Nightly build) Unspecified Unspecified RESOLVED FIXED InRadar P2 Normal --- 1 rniwa cfleizach ap cfleizach commit-queue dmazzoni mark.lam simon.fraser webkit.review.bot oldest_to_newest 849183 0 rniwa 2013-03-06 12:28:25 -0800 CRASHING TEST: platform/mac/fast/speechsynthesis/speech-synthesis-cancel.html Thread 0 Crashed:: Dispatch queue: com.apple.main-thread 0 com.apple.WebCore 0x0000000101952a64 WebCore::SpeechSynthesis::didFinishSpeaking(WebCore::PlatformSpeechSynthesisUtterance const*) + 4 (PlatformSpeechSynthesisUtterance.h:71) 1 libWebCoreTestSupport.dylib 0x0000000100a03937 WebCore::PlatformSpeechSynthesizerMock::speakingFinished(WebCore::Timer<WebCore::PlatformSpeechSynthesizerMock>*) + 23 (PlatformSpeechSynthesizerMock.cpp:54) 2 com.apple.WebCore 0x0000000101ab37ef WebCore::ThreadTimers::sharedTimerFiredInternal() + 175 (ThreadTimers.cpp:132) 3 com.apple.WebCore 0x0000000101942423 WebCore::timerFired(__CFRunLoopTimer*, void*) + 51 (SharedTimerMac.mm:167) 4 com.apple.CoreFoundation 0x00007fff92ac7da4 __CFRUNLOOP_IS_CALLING_OUT_TO_A_TIMER_CALLBACK_FUNCTION__ + 20 5 com.apple.CoreFoundation 0x00007fff92ac78bd __CFRunLoopDoTimer + 557 6 com.apple.CoreFoundation 0x00007fff92aad099 __CFRunLoopRun + 1513 7 com.apple.CoreFoundation 0x00007fff92aac6b2 CFRunLoopRunSpecific + 290 8 com.apple.Foundation 0x00007fff87a8089e -[NSRunLoop(NSRunLoop) runMode:beforeDate:] + 268 9 DumpRenderTree 0x000000010035a122 runTest(std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> > const&) + 1639 (DumpRenderTree.mm:1375) 10 DumpRenderTree 0x00000001003598b6 dumpRenderTree(int, char const**) + 1727 (DumpRenderTree.mm:832) 11 DumpRenderTree 0x000000010035a48b main + 86 (DumpRenderTree.mm:925) 12 libdyld.dylib 0x00007fff895837e1 start + 1 e.g. http://build.webkit.org/results/Apple%20MountainLion%20Release%20WK1%20(Tests)/r144949%20(7620)/results.html 849185 1 rniwa 2013-03-06 12:29:14 -0800 http://test-results.appspot.com/dashboards/flakiness_dashboard.html#group=%40ToT%20-%20webkit.org&tests=platform%2Fmac%2Ffast%2Fspeechsynthesis%2Fspeech-synthesis-cancel.html 849200 2 rniwa 2013-03-06 12:45:05 -0800 Added a flaky crash test expectation in http://trac.webkit.org/changeset/144965. 849838 3 191940 cfleizach 2013-03-07 00:58:59 -0800 Created attachment 191940 patch I don't think this will actually fix this, but I think it will help illuminate the problem. It does fix a similar problem when calling cancel. I believe this problem only affects the mock synthesizer right now 851712 4 191940 rniwa 2013-03-08 22:01:45 -0800 Comment on attachment 191940 patch rs=me. 851719 5 191940 webkit.review.bot 2013-03-08 22:40:40 -0800 Comment on attachment 191940 patch Clearing flags on attachment: 191940 Committed r145304: <http://trac.webkit.org/changeset/145304> 851720 6 webkit.review.bot 2013-03-08 22:40:43 -0800 All reviewed patches have been landed. Closing bug. 851724 7 cfleizach 2013-03-08 22:48:57 -0800 I don't think the problem is actually fixed so leaving this open to see if we hit some asserts that illuminate the problem more fully 854043 8 simon.fraser 2013-03-12 21:29:02 -0700 <rdar://problem/13407093> 1004641 9 230305 cfleizach 2014-04-28 10:34:59 -0700 Created attachment 230305 patch 2 1004691 10 230305 mark.lam 2014-04-28 12:25:57 -0700 Comment on attachment 230305 patch 2 LGTM. r=me. 1004693 11 230305 simon.fraser 2014-04-28 12:30:16 -0700 Comment on attachment 230305 patch 2 View in context: https://bugs.webkit.org/attachment.cgi?id=230305&action=review > Source/WebCore/ChangeLog:8 > + I think it's possible that didFinishSpeaking ends up calling directly back into start speaking, and the utterance reference "I think it's possible". Maybe verify that with assertions? Is it OK that this happens? 1004695 12 cfleizach 2014-04-28 12:34:57 -0700 (In reply to comment #11) > (From update of attachment 230305 [details]) > View in context: https://bugs.webkit.org/attachment.cgi?id=230305&action=review > > > Source/WebCore/ChangeLog:8 > > + I think it's possible that didFinishSpeaking ends up calling directly back into start speaking, and the utterance reference > > "I think it's possible". Maybe verify that with assertions? Is it OK that this happens? The assertion that Mark posted means that it definitely happens. My language is probably too cautious 1004703 13 230305 commit-queue 2014-04-28 12:57:53 -0700 Comment on attachment 230305 patch 2 Clearing flags on attachment: 230305 Committed r167899: <http://trac.webkit.org/changeset/167899> 1004704 14 commit-queue 2014-04-28 12:57:57 -0700 All reviewed patches have been landed. Closing bug. 1005053 15 ap 2014-04-29 12:23:58 -0700 Removed Crash/Pass expectation in <http://trac.webkit.org/r167950>. 191940 2013-03-07 00:58:59 -0800 2014-04-28 10:34:36 -0700 patch patch text/plain 2196 cfleizach SW5kZXg6IFNvdXJjZS9XZWJDb3JlL0NoYW5nZUxvZwo9PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09Ci0tLSBTb3VyY2UvV2Vi Q29yZS9DaGFuZ2VMb2cJKHJldmlzaW9uIDE0NTA0OCkKKysrIFNvdXJjZS9XZWJDb3JlL0NoYW5n ZUxvZwkod29ya2luZyBjb3B5KQpAQCAtMSwzICsxLDIyIEBACisyMDEzLTAzLTA3ICBDaHJpcyBG bGVpemFjaCAgPGNmbGVpemFjaEBhcHBsZS5jb20+CisKKyAgICAgICAgUkVHUkVTU0lPTjogSW50 ZXJtaXR0ZW50IGNyYXNoIGluIFNwZWVjaFN5bnRoZXNpczo6ZGlkRmluaXNoU3BlYWtpbmcKKyAg ICAgICAgaHR0cHM6Ly9idWdzLndlYmtpdC5vcmcvc2hvd19idWcuY2dpP2lkPTExMTYxMworCisg ICAgICAgIFJldmlld2VkIGJ5IE5PQk9EWSAoT09QUyEpLgorCisgICAgICAgIFRoaXMgY3Jhc2gg aGFwcGVucyB3aGVuIHRoZSBtb2NrIHN5bnRoZXNpemVyIHV0dGVyYW5jZSB2YXJpYWJsZSBnZXRz IGNsZWFyZWQKKyAgICAgICAgYmVmb3JlIHRoZSBzcGVha2luZ0ZpbmlzaGVkIHRpbWVyIGhhcHBl bnMuIEkgZG9uJ3Qgc2VlIGhvdyB0aGF0IGNvdWxkIGhhcHBlbgorICAgICAgICBidXQgSSB3YXMg YWJsZSB0byBtYWtlIGEgc2ltaWxhciBwcm9ibGVtIGhhcHBlbiB3aGVuIGNhbmNlbCBpcyBjYWxs ZWQgdHdpY2UuCisKKyAgICAgICAgVGhpcyBhZGRzIGluIGEgZmV3IG1vcmUgYXNzZXJ0cyBhbmQg Y29tbW9uIHNlbnNlIGNoZWNrcy4gSSdtIGhvcGluZyBpdCB3aWxsCisgICAgICAgIGlsbHVtaW5h dGUgdGhlIHByb2JsZW0gZnVydGhlci4KKworICAgICAgICAqIHBsYXRmb3JtL21vY2svUGxhdGZv cm1TcGVlY2hTeW50aGVzaXplck1vY2suY3BwOgorICAgICAgICAoV2ViQ29yZTo6UGxhdGZvcm1T cGVlY2hTeW50aGVzaXplck1vY2s6OnNwZWFraW5nRmluaXNoZWQpOgorICAgICAgICAoV2ViQ29y ZTo6UGxhdGZvcm1TcGVlY2hTeW50aGVzaXplck1vY2s6OnNwZWFrKToKKyAgICAgICAgKFdlYkNv cmU6OlBsYXRmb3JtU3BlZWNoU3ludGhlc2l6ZXJNb2NrOjpjYW5jZWwpOgorCiAyMDEzLTAzLTA3 ICBWc2V2b2xvZCBWbGFzb3YgIDx2c2V2aWtAY2hyb21pdW0ub3JnPgogCiAgICAgICAgIFdlYiBJ bnNwZWN0b3I6IE5hdmlnYXRvclZpZXcgc2hvdWxkIHNob3cgKHByb2dyYW0pIGZvciB1aVNvdXJj ZUNvZGVzIHdpdGggZW1wdHkgbmFtZS4KSW5kZXg6IFNvdXJjZS9XZWJDb3JlL3BsYXRmb3JtL21v Y2svUGxhdGZvcm1TcGVlY2hTeW50aGVzaXplck1vY2suY3BwCj09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT0KLS0tIFNvdXJj ZS9XZWJDb3JlL3BsYXRmb3JtL21vY2svUGxhdGZvcm1TcGVlY2hTeW50aGVzaXplck1vY2suY3Bw CShyZXZpc2lvbiAxNDQ5OTgpCisrKyBTb3VyY2UvV2ViQ29yZS9wbGF0Zm9ybS9tb2NrL1BsYXRm b3JtU3BlZWNoU3ludGhlc2l6ZXJNb2NrLmNwcAkod29ya2luZyBjb3B5KQpAQCAtNTAsNiArNTAs NyBAQAogCiB2b2lkIFBsYXRmb3JtU3BlZWNoU3ludGhlc2l6ZXJNb2NrOjpzcGVha2luZ0Zpbmlz aGVkKFRpbWVyPFBsYXRmb3JtU3BlZWNoU3ludGhlc2l6ZXJNb2NrPiopCiB7CisgICAgQVNTRVJU KG1fdXR0ZXJhbmNlKTsKICAgICBjbGllbnQoKS0+ZGlkRmluaXNoU3BlYWtpbmcobV91dHRlcmFu Y2UpOwogICAgIG1fdXR0ZXJhbmNlID0gMDsKIH0KQEAgLTY0LDYgKzY1LDcgQEAKIAogdm9pZCBQ bGF0Zm9ybVNwZWVjaFN5bnRoZXNpemVyTW9jazo6c3BlYWsoY29uc3QgUGxhdGZvcm1TcGVlY2hT eW50aGVzaXNVdHRlcmFuY2UmIHV0dGVyYW5jZSkKIHsKKyAgICBBU1NFUlQoIW1fdXR0ZXJhbmNl KTsKICAgICBtX3V0dGVyYW5jZSA9ICZ1dHRlcmFuY2U7CiAgICAgY2xpZW50KCktPmRpZFN0YXJ0 U3BlYWtpbmcobV91dHRlcmFuY2UpOwogICAgIApAQCAtNzcsNiArNzksOSBAQAogICAgIAogdm9p ZCBQbGF0Zm9ybVNwZWVjaFN5bnRoZXNpemVyTW9jazo6Y2FuY2VsKCkKIHsKKyAgICBpZiAoIW1f dXR0ZXJhbmNlKQorICAgICAgICByZXR1cm47CisgICAgCiAgICAgbV9zcGVha2luZ0ZpbmlzaGVk VGltZXIuc3RvcCgpOwogICAgIGNsaWVudCgpLT5zcGVha2luZ0Vycm9yT2NjdXJyZWQobV91dHRl cmFuY2UpOwogICAgIG1fdXR0ZXJhbmNlID0gMDsK 230305 2014-04-28 10:34:59 -0700 2014-04-28 12:57:53 -0700 patch 2 patch2 text/plain 1619 cfleizach SW5kZXg6IFNvdXJjZS9XZWJDb3JlL0NoYW5nZUxvZwo9PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09Ci0tLSBTb3VyY2UvV2Vi Q29yZS9DaGFuZ2VMb2cJKHJldmlzaW9uIDE2Nzg5MikKKysrIFNvdXJjZS9XZWJDb3JlL0NoYW5n ZUxvZwkod29ya2luZyBjb3B5KQpAQCAtMSwzICsxLDE2IEBACisyMDE0LTA0LTI4ICBDaHJpcyBG bGVpemFjaCAgPGNmbGVpemFjaEBhcHBsZS5jb20+CisKKyAgICAgICAgUkVHUkVTU0lPTjogSW50 ZXJtaXR0ZW50IGNyYXNoIGluIFNwZWVjaFN5bnRoZXNpczo6ZGlkRmluaXNoU3BlYWtpbmcKKyAg ICAgICAgaHR0cHM6Ly9idWdzLndlYmtpdC5vcmcvc2hvd19idWcuY2dpP2lkPTExMTYxMworCisg ICAgICAgIFJldmlld2VkIGJ5IE5PQk9EWSAoT09QUyEpLgorCisgICAgICAgIEkgdGhpbmsgaXQn cyBwb3NzaWJsZSB0aGF0IGRpZEZpbmlzaFNwZWFraW5nIGVuZHMgdXAgY2FsbGluZyBkaXJlY3Rs eSBiYWNrIGludG8gc3RhcnQgc3BlYWtpbmcsIGFuZCB0aGUgdXR0ZXJhbmNlIHJlZmVyZW5jZQor ICAgICAgICB3ZSB3ZXJlIGhvbGRpbmcgY2FuIGdldCBjbGVhcmVkLCBzbyBwcm90ZWN0aW5nIHRo aXMgc2hvdWxkIGF2b2lkIGEgZmV3IGFzc2VydHMuCisKKyAgICAgICAgKiBwbGF0Zm9ybS9tb2Nr L1BsYXRmb3JtU3BlZWNoU3ludGhlc2l6ZXJNb2NrLmNwcDoKKyAgICAgICAgKFdlYkNvcmU6OlBs YXRmb3JtU3BlZWNoU3ludGhlc2l6ZXJNb2NrOjpzcGVha2luZ0ZpbmlzaGVkKToKKwogMjAxNC0w NC0yNCAgU2ltb24gRnJhc2VyICA8c2ltb24uZnJhc2VyQGFwcGxlLmNvbT4KIAogICAgICAgICBb aU9TIFdLMl0gZmxpY2tlcnkgc2Nyb2xsaW5nIHdpdGggb3ZlcmZsb3ctc2Nyb2xsaW5nOnRvdWNo CkluZGV4OiBTb3VyY2UvV2ViQ29yZS9wbGF0Zm9ybS9tb2NrL1BsYXRmb3JtU3BlZWNoU3ludGhl c2l6ZXJNb2NrLmNwcAo9PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09Ci0tLSBTb3VyY2UvV2ViQ29yZS9wbGF0Zm9ybS9tb2Nr L1BsYXRmb3JtU3BlZWNoU3ludGhlc2l6ZXJNb2NrLmNwcAkocmV2aXNpb24gMTY3ODg3KQorKysg U291cmNlL1dlYkNvcmUvcGxhdGZvcm0vbW9jay9QbGF0Zm9ybVNwZWVjaFN5bnRoZXNpemVyTW9j ay5jcHAJKHdvcmtpbmcgY29weSkKQEAgLTQ0LDggKzQ0LDEwIEBACiB2b2lkIFBsYXRmb3JtU3Bl ZWNoU3ludGhlc2l6ZXJNb2NrOjpzcGVha2luZ0ZpbmlzaGVkKFRpbWVyPFBsYXRmb3JtU3BlZWNo U3ludGhlc2l6ZXJNb2NrPiopCiB7CiAgICAgQVNTRVJUKG1fdXR0ZXJhbmNlLmdldCgpKTsKLSAg ICBjbGllbnQoKS0+ZGlkRmluaXNoU3BlYWtpbmcobV91dHRlcmFuY2UpOworICAgIFJlZlB0cjxQ bGF0Zm9ybVNwZWVjaFN5bnRoZXNpc1V0dGVyYW5jZT4gcHJvdGVjdChtX3V0dGVyYW5jZSk7CiAg ICAgbV91dHRlcmFuY2UgPSAwOworICAgIAorICAgIGNsaWVudCgpLT5kaWRGaW5pc2hTcGVha2lu Zyhwcm90ZWN0KTsKIH0KICAgICAKIHZvaWQgUGxhdGZvcm1TcGVlY2hTeW50aGVzaXplck1vY2s6 OmluaXRpYWxpemVWb2ljZUxpc3QoKQo=