123029 2013-10-18 10:56:34 -0700 platform/mac/editing/attributed-string tests all flakily assert 2025-11-21 07:46:07 -0800 1 1 1 Unclassified WebKit WebCore Misc. 528+ (Nightly build) Unspecified Unspecified RESOLVED CONFIGURATION CHANGED InRadar, LayoutTestFailure P2 Normal --- 1 ap webkit-unassigned darin ggaren jbedard mhahnenberg rniwa simon.fraser thorton oldest_to_newest 941269 0 ap 2013-10-18 10:56:34 -0700 This is an extremely common assertion on bots. http://webkit-test-results.appspot.com/dashboards/flakiness_dashboard.html#tests=attributed-string Thread 0 Crashed:: Dispatch queue: com.apple.main-thread 0 com.apple.JavaScriptCore 0x0000000104ee85ca WTFCrash + 42 (Assertions.cpp:342) 1 com.apple.WebCore 0x0000000106881ca3 JSC::Bindings::Instance::createRuntimeObject(JSC::ExecState*) + 163 (BridgeJSC.cpp:74) 2 com.apple.WebCore 0x000000010795da73 JSC::Bindings::convertObjcValueToValue(JSC::ExecState*, void*, JSC::Bindings::ObjcValueType, JSC::Bindings::RootObject*) + 1571 (objc_utility.mm:202) 3 com.apple.WebCore 0x0000000107959864 JSC::Bindings::ObjcInstance::invokeObjcMethod(JSC::ExecState*, JSC::Bindings::ObjcMethod*) + 2356 (objc_instance.mm:343) 4 com.apple.WebCore 0x0000000107958f08 JSC::Bindings::ObjcInstance::invokeMethod(JSC::ExecState*, JSC::RuntimeMethod*) + 312 (objc_instance.mm:233) 5 com.apple.WebCore 0x0000000107d44e67 JSC::callRuntimeMethod(JSC::ExecState*) + 503 (runtime_method.cpp:100) 6 com.apple.JavaScriptCore 0x0000000104d571c2 JSC::LLInt::handleHostCall(JSC::ExecState*, JSC::Instruction*, JSC::JSValue, JSC::CodeSpecializationKind) + 306 (LLIntSlowPaths.cpp:960) 7 com.apple.JavaScriptCore 0x0000000104d57f9c JSC::LLInt::setUpCall(JSC::ExecState*, JSC::Instruction*, JSC::CodeSpecializationKind, JSC::JSValue, JSC::LLIntCallLinkInfo*) + 92 (LLIntSlowPaths.cpp:1004) 941656 1 ap 2013-10-19 21:57:12 -0700 <rdar://problem/15196388> 941659 2 ap 2013-10-19 22:04:25 -0700 It was very difficult for me to reproduce this locally. I managed to hit it once with run-webkit-tests platform/mac/editing/attributed-string/ --iter 1000 -v -gf 941664 3 rniwa 2013-10-19 22:41:53 -0700 This isn't this the same assertion we're hitting on other layout tests? 941666 4 ap 2013-10-19 23:01:29 -0700 I don't know which assertion you have in mind, but the answer is likely no. It's only a small subset of tests that have a code path through ObjcInstance::invokeMethod. 943771 5 simon.fraser 2013-10-25 14:55:26 -0700 Still seeing this quite often http://build.webkit.org/results/Apple%20MountainLion%20Debug%20WK1%20(Tests)/r158041%20(10993)/platform/mac/editing/attributed-string/font-size-crash-log.txt 944476 6 simon.fraser 2013-10-29 10:48:47 -0700 Still seeing it a few times a day: http://build.webkit.org/results/Apple%20Mavericks%20Debug%20WK1%20(Tests)/r158194%20(146)/platform/mac/editing/attributed-string/font-size-crash-log.txt 950931 7 thorton 2013-11-14 19:04:17 -0800 And still! 961419 8 ap 2013-12-19 10:01:53 -0800 Looks like there are at least two problems here: - Somehow, s_instanceWrapperCache contains an entry with an invalidated root object, which makes no sense. - The cache should not be global, because Objective C instances can be used in multiple pages at once, and they need separate ObjcInstances then. Both are pretty bad bugs I think. This was failing extremely frequently lately - most of the time, multiple bots were red because of this issue alone. Marked as flakily crashing in debug in <http://trac.webkit.org/r160840>. 961440 9 rniwa 2013-12-19 10:51:37 -0800 Looks like this is a bug in Objective-C binding code? 961445 10 darin 2013-12-19 11:05:23 -0800 This lurked for four years before we noticed!? 961453 11 ap 2013-12-19 11:19:06 -0800 Yes, it appears so. These attributed string tests were added this August, and I guess we didn't cover this aspect of Objective-C bindings in tests before. Also, these crashes became more frequent over the last few months, presumably because of some timing differences in loading, GC, or just different hardware on bots. 1001011 12 ap 2014-04-15 16:09:51 -0700 platform/mac/plugins/jsobjc-simple.html is affected too. 2160571 13 jbedard 2025-11-21 07:45:52 -0800 I don't see this happening any more: https://results.webkit.org/?suite=layout-tests&suite=layout-tests&suite=layout-tests&suite=layout-tests&suite=layout-tests&suite=layout-tests&suite=layout-tests&suite=layout-tests&suite=layout-tests&suite=layout-tests&test=editing%2Fmac%2Fattributed-string%2Fattributed-string-across-shadow-boundaries-with-style-1.html&test=editing%2Fmac%2Fattributed-string%2Fattributed-string-across-shadow-boundaries-5.html&test=editing%2Fmac%2Fattributed-string%2Fattributed-string-across-shadow-boundaries-4.html&test=editing%2Fmac%2Fattributed-string%2Fattributed-string-across-shadow-boundaries-3.html&test=editing%2Fmac%2Fattributed-string%2Fattributed-string-across-shadow-boundaries-2.html&test=editing%2Fmac%2Fattributed-string%2Fattributed-string-across-shadow-boundaries-1.html&test=editing%2Fmac%2Fattributed-string%2Fattribute-string-for-copy-with-color-filter.html&test=editing%2Fmac%2Fattributed-string%2Fattrib-string-range-with-color-filter.html&test=editing%2Fmac%2Fattributed-string%2Fattrib-string-colors-with-color-filter.html&test=editing%2Fmac%2Fattributed-string%2Fanchor-element.html Closing this as "Configuration Changed"