151700 2015-12-01 01:44:20 -0800 [GTK] ASSERTION FAILED: m_table running /webkit2/BackForwardList/navigation in Debug build 2015-12-01 04:23:54 -0800 1 1 1 Unclassified WebKit WebKitGTK WebKit Local Build Unspecified Unspecified RESOLVED FIXED Gtk P2 Normal --- 1 cgarcia webkit-unassigned bugs-noreply oldest_to_newest 1145199 0 cgarcia 2015-12-01 01:44:20 -0800 TEST: ./Tools/gtk/../../WebKitBuild/Debug/bin/TestWebKitAPI/WebKit2Gtk/TestBackForwardList... (pid=15102) /webkit2/BackForwardList/navigation: Error receiving IPC message on socket 12 in process 15582: Connection reset by peer ASSERTION FAILED: m_table ../../Source/WTF/wtf/HashTable.h(212) : void WTF::HashTableConstIterator<Key, Value, Extractor, HashFunctions, Traits, KeyTraits>::checkValidity() const [with Key = WebCore::FrameDestructionObserver*; Value = WebCore::FrameDestructionObserver*; Extractor = WTF::IdentityExtractor; HashFunctions = WTF::PtrHash<WebCore::FrameDestructionObserver*>; Traits = WTF::HashTraits<WebCore::FrameDestructionObserver*>; KeyTraits = WTF::HashTraits<WebCore::FrameDestructionObserver*>] 1 0x7f201d2a67d7 /home/slave/webkitgtk/gtk-linux-64-debug/build/WebKitBuild/Debug/lib/libjavascriptcoregtk-4.0.so.18(WTFCrash+0x1e) [0x7f201d2a67d7] 2 0x7f202429dac9 /home/slave/webkitgtk/gtk-linux-64-debug/build/WebKitBuild/Debug/lib/libwebkit2gtk-4.0.so.37(_ZNK3WTF22HashTableConstIteratorIPN7WebCore24FrameDestructionObserverES3_NS_17IdentityExtractorENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES8_E13checkValidityEv+0x3d) [0x7f202429dac9] 3 0x7f202429d06a /home/slave/webkitgtk/gtk-linux-64-debug/build/WebKitBuild/Debug/lib/libwebkit2gtk-4.0.so.37(_ZN3WTF22HashTableConstIteratorIPN7WebCore24FrameDestructionObserverES3_NS_17IdentityExtractorENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES8_EppEv+0x18) [0x7f202429d06a] 4 0x7f202429bc30 /home/slave/webkitgtk/gtk-linux-64-debug/build/WebKitBuild/Debug/lib/libwebkit2gtk-4.0.so.37(_ZN3WTF29HashTableConstIteratorAdapterINS_9HashTableIPN7WebCore24FrameDestructionObserverES4_NS_17IdentityExtractorENS_7PtrHashIS4_EENS_10HashTraitsIS4_EES9_EES4_EppEv+0x18) [0x7f202429bc30] 5 0x7f20242995f8 /home/slave/webkitgtk/gtk-linux-64-debug/build/WebKitBuild/Debug/lib/libwebkit2gtk-4.0.so.37(_ZN7WebCore5Frame14willDetachPageEv+0xc4) [0x7f20242995f8] 6 0x7f20241580fe /home/slave/webkitgtk/gtk-linux-64-debug/build/WebKitBuild/Debug/lib/libwebkit2gtk-4.0.so.37(_ZN7WebCore11FrameLoader16detachFromParentEv+0x142) [0x7f20241580fe] 7 0x7f20233f5fc6 /home/slave/webkitgtk/gtk-linux-64-debug/build/WebKitBuild/Debug/lib/libwebkit2gtk-4.0.so.37(_ZN6WebKit7WebPage5closeEv+0x410) [0x7f20233f5fc6] 8 0x7f202360d447 /home/slave/webkitgtk/gtk-linux-64-debug/build/WebKitBuild/Debug/lib/libwebkit2gtk-4.0.so.37(_ZN3IPC22callMemberFunctionImplIN6WebKit7WebPageEMS2_FvvESt5tupleIJEEJEEEvPT_T0_OT1_St14index_sequenceIJXspT2_EEE+0x65) [0x7f202360d447] 9 0x7f202360b524 /home/slave/webkitgtk/gtk-linux-64-debug/build/WebKitBuild/Debug/lib/libwebkit2gtk-4.0.so.37(_ZN3IPC18callMemberFunctionIN6WebKit7WebPageEMS2_FvvESt5tupleIIEESt19make_index_sequenceILm0EEEEvOT1_PT_T0_+0x41) [0x7f202360b524] 10 0x7f2023607728 /home/slave/webkitgtk/gtk-linux-64-debug/build/WebKitBuild/Debug/lib/libwebkit2gtk-4.0.so.37(_ZN3IPC13handleMessageIN8Messages7WebPage5CloseEN6WebKit7WebPageEMS5_FvvEEEvRNS_14MessageDecoderEPT0_T1_+0x8f) [0x7f2023607728] 11 0x7f2023601a15 /home/slave/webkitgtk/gtk-linux-64-debug/build/WebKitBuild/Debug/lib/libwebkit2gtk-4.0.so.37(_ZN6WebKit7WebPage24didReceiveWebPageMessageERN3IPC10ConnectionERNS1_14MessageDecoderE+0x1e2b) [0x7f2023601a15] 12 0x7f2023400b64 /home/slave/webkitgtk/gtk-linux-64-debug/build/WebKitBuild/Debug/lib/libwebkit2gtk-4.0.so.37(_ZN6WebKit7WebPage17didReceiveMessageERN3IPC10ConnectionERNS1_14MessageDecoderE+0x18a) [0x7f2023400b64] 13 0x7f202306bda6 /home/slave/webkitgtk/gtk-linux-64-debug/build/WebKitBuild/Debug/lib/libwebkit2gtk-4.0.so.37(_ZN3IPC18MessageReceiverMap15dispatchMessageERNS_10ConnectionERNS_14MessageDecoderE+0x120) [0x7f202306bda6] 14 0x7f2023296eba /home/slave/webkitgtk/gtk-linux-64-debug/build/WebKitBuild/Debug/lib/libwebkit2gtk-4.0.so.37(_ZN6WebKit10WebProcess17didReceiveMessageERN3IPC10ConnectionERNS1_14MessageDecoderE+0x4c) [0x7f2023296eba] 15 0x7f2023059396 /home/slave/webkitgtk/gtk-linux-64-debug/build/WebKitBuild/Debug/lib/libwebkit2gtk-4.0.so.37(_ZN3IPC10Connection15dispatchMessageERNS_14MessageDecoderE+0x3a) [0x7f2023059396] 16 0x7f20230594f9 /home/slave/webkitgtk/gtk-linux-64-debug/build/WebKitBuild/Debug/lib/libwebkit2gtk-4.0.so.37(_ZN3IPC10Connection15dispatchMessageESt10unique_ptrINS_14MessageDecoderESt14default_deleteIS2_EE+0x161) [0x7f20230594f9] 17 0x7f20230596e0 /home/slave/webkitgtk/gtk-linux-64-debug/build/WebKitBuild/Debug/lib/libwebkit2gtk-4.0.so.37(_ZN3IPC10Connection18dispatchOneMessageEv+0xc8) [0x7f20230596e0] 18 0x7f20230591e4 /home/slave/webkitgtk/gtk-linux-64-debug/build/WebKitBuild/Debug/lib/libwebkit2gtk-4.0.so.37(+0x4b261e4) [0x7f20230591e4] 19 0x7f202305a99f /home/slave/webkitgtk/gtk-linux-64-debug/build/WebKitBuild/Debug/lib/libwebkit2gtk-4.0.so.37(+0x4b2799f) [0x7f202305a99f] 20 0x7f2022fd275a /home/slave/webkitgtk/gtk-linux-64-debug/build/WebKitBuild/Debug/lib/libwebkit2gtk-4.0.so.37(_ZNKSt8functionIFvvEEclEv+0x32) [0x7f2022fd275a] 21 0x7f201d2c00b9 /home/slave/webkitgtk/gtk-linux-64-debug/build/WebKitBuild/Debug/lib/libjavascriptcoregtk-4.0.so.18(_ZN3WTF7RunLoop11performWorkEv+0xdb) [0x7f201d2c00b9] 22 0x7f201d2f8bc0 /home/slave/webkitgtk/gtk-linux-64-debug/build/WebKitBuild/Debug/lib/libjavascriptcoregtk-4.0.so.18(+0x1a7ebc0) [0x7f201d2f8bc0] 23 0x7f201d2f8be5 /home/slave/webkitgtk/gtk-linux-64-debug/build/WebKitBuild/Debug/lib/libjavascriptcoregtk-4.0.so.18(+0x1a7ebe5) [0x7f201d2f8be5] 24 0x7f201d2f8b60 /home/slave/webkitgtk/gtk-linux-64-debug/build/WebKitBuild/Debug/lib/libjavascriptcoregtk-4.0.so.18(+0x1a7eb60) [0x7f201d2f8b60] 25 0x7f201d2f8b8f /home/slave/webkitgtk/gtk-linux-64-debug/build/WebKitBuild/Debug/lib/libjavascriptcoregtk-4.0.so.18(+0x1a7eb8f) [0x7f201d2f8b8f] 26 0x7f201997ea26 /home/slave/webkitgtk/gtk-linux-64-debug/build/WebKitBuild/DependenciesGTK/Root/lib64/libglib-2.0.so.0(+0x53a26) [0x7f201997ea26] 27 0x7f201997f854 /home/slave/webkitgtk/gtk-linux-64-debug/build/WebKitBuild/DependenciesGTK/Root/lib64/libglib-2.0.so.0(g_main_context_dispatch+0x33) [0x7f201997f854] 28 0x7f201997fa39 /home/slave/webkitgtk/gtk-linux-64-debug/build/WebKitBuild/DependenciesGTK/Root/lib64/libglib-2.0.so.0(+0x54a39) [0x7f201997fa39] 29 0x7f201997fe60 /home/slave/webkitgtk/gtk-linux-64-debug/build/WebKitBuild/DependenciesGTK/Root/lib64/libglib-2.0.so.0(g_main_loop_run+0x1d7) [0x7f201997fe60] 30 0x7f201d2f9160 /home/slave/webkitgtk/gtk-linux-64-debug/build/WebKitBuild/Debug/lib/libjavascriptcoregtk-4.0.so.18(_ZN3WTF7RunLoop3runEv+0xac) [0x7f201d2f9160] 31 0x7f202356f408 /home/slave/webkitgtk/gtk-linux-64-debug/build/WebKitBuild/Debug/lib/libwebkit2gtk-4.0.so.37(_ZN6WebKit16ChildProcessMainINS_10WebProcessENS_14WebProcessMainEEEiiPPc+0x82) [0x7f202356f408] This happens when the frame notifies its observers that the page will be detached. The m_table that asserts is the FrameDestructionObserver HashSet. It happens when clearing the GObject DOM cache wrappers during frame destruction, and there's a Document object wrapped whose last reference is held by the dom wrapper. In that case the Document object is destroyed while the frame is being destroyed. Deleting the wrapper objects after the frame destruction fixes the crash. 1145204 1 266349 cgarcia 2015-12-01 01:47:13 -0800 Created attachment 266349 Patch 1145223 2 cgarcia 2015-12-01 04:23:54 -0800 Committed r192880: <http://trac.webkit.org/changeset/192880> 266349 2015-12-01 01:47:13 -0800 2015-12-01 02:53:50 -0800 Patch wcore-dom-object-cache-crash.diff text/plain 2297 cgarcia ZGlmZiAtLWdpdCBhL1NvdXJjZS9XZWJDb3JlL0NoYW5nZUxvZyBiL1NvdXJjZS9XZWJDb3JlL0No YW5nZUxvZwppbmRleCA3MTFlNjNjLi5kYzU4YzU3IDEwMDY0NAotLS0gYS9Tb3VyY2UvV2ViQ29y ZS9DaGFuZ2VMb2cKKysrIGIvU291cmNlL1dlYkNvcmUvQ2hhbmdlTG9nCkBAIC0xLDMgKzEsMjEg QEAKKzIwMTUtMTItMDEgIENhcmxvcyBHYXJjaWEgQ2FtcG9zICA8Y2dhcmNpYUBpZ2FsaWEuY29t PgorCisgICAgICAgIFtHVEtdIEFTU0VSVElPTiBGQUlMRUQ6IG1fdGFibGUgcnVubmluZyAvd2Vi a2l0Mi9CYWNrRm9yd2FyZExpc3QvbmF2aWdhdGlvbiBpbiBEZWJ1ZyBidWlsZAorICAgICAgICBo dHRwczovL2J1Z3Mud2Via2l0Lm9yZy9zaG93X2J1Zy5jZ2k/aWQ9MTUxNzAwCisKKyAgICAgICAg UmV2aWV3ZWQgYnkgTk9CT0RZIChPT1BTISkuCisKKyAgICAgICAgVGhpcyBoYXBwZW5zIHdoZW4g dGhlIGZyYW1lIG5vdGlmaWVzIGl0cyBvYnNlcnZlcnMgdGhhdCB0aGUgcGFnZQorICAgICAgICB3 aWxsIGJlIGRldGFjaGVkLiBUaGUgbV90YWJsZSB0aGF0IGFzc2VydHMgaXMgdGhlCisgICAgICAg IEZyYW1lRGVzdHJ1Y3Rpb25PYnNlcnZlciBIYXNoU2V0LiBJdCBoYXBwZW5zIHdoZW4gY2xlYXJp bmcgdGhlCisgICAgICAgIEdPYmplY3QgRE9NIGNhY2hlIHdyYXBwZXJzIGR1cmluZyBmcmFtZSBk ZXN0cnVjdGlvbiwgYW5kIHRoZXJlJ3MgYQorICAgICAgICBEb2N1bWVudCBvYmplY3Qgd3JhcHBl ZCB3aG9zZSBsYXN0IHJlZmVyZW5jZSBpcyBoZWxkIGJ5IHRoZSBET00KKyAgICAgICAgd3JhcHBl ci4gSW4gdGhhdCBjYXNlLCB0aGUgRG9jdW1lbnQgb2JqZWN0IGlzIGRlc3Ryb3llZCB3aGlsZSB0 aGUKKyAgICAgICAgZnJhbWUgaXMgYmVpbmcgZGVzdHJveWVkLiBEZWxldGluZyB0aGUgd3JhcHBl ciBvYmplY3RzIGFmdGVyIHRoZQorICAgICAgICBmcmFtZSBkZXN0cnVjdGlvbiBmaXhlcyB0aGUg Y3Jhc2guCisKKyAgICAgICAgKiBiaW5kaW5ncy9nb2JqZWN0L0RPTU9iamVjdENhY2hlLmNwcDoK KwogMjAxNS0xMi0wMSAgWW91ZW5uIEZhYmxldCAgPHlvdWVubi5mYWJsZXRAY3JmLmNhbm9uLmZy PgogCiAgICAgICAgIFtTdHJlYW1zIEFQSV0gc3RyZWFtcyBzaG91bGQgbm90IGRpcmVjdGx5IHVz ZSBOdW1iZXIgYW5kIHJlbGF0ZWQgbWV0aG9kcwpkaWZmIC0tZ2l0IGEvU291cmNlL1dlYkNvcmUv YmluZGluZ3MvZ29iamVjdC9ET01PYmplY3RDYWNoZS5jcHAgYi9Tb3VyY2UvV2ViQ29yZS9iaW5k aW5ncy9nb2JqZWN0L0RPTU9iamVjdENhY2hlLmNwcAppbmRleCA2ZjM0N2JiLi5kNTJmYWVhIDEw MDY0NAotLS0gYS9Tb3VyY2UvV2ViQ29yZS9iaW5kaW5ncy9nb2JqZWN0L0RPTU9iamVjdENhY2hl LmNwcAorKysgYi9Tb3VyY2UvV2ViQ29yZS9iaW5kaW5ncy9nb2JqZWN0L0RPTU9iamVjdENhY2hl LmNwcApAQCAtMTU1LDEwICsxNTUsMTcgQEAgcHJpdmF0ZToKICAgICAgICAgICAgIHJldHVybjsK IAogICAgICAgICBhdXRvIG9iamVjdHMgPSBXVEY6Om1vdmUobV9vYmplY3RzKTsKLSAgICAgICAg Zm9yIChhdXRvKiBkYXRhIDogb2JqZWN0cykgeworCisgICAgICAgIC8vIERlbGV0aW5nIG9mIERP TSB3cmFwcGVycyBtaWdodCBlbmQgdXAgZGVsZXRpbmcgdGhlIHdyYXBwZWQgY29yZSBvYmplY3Qg d2hpY2ggY291bGQgY2F1c2Ugc29tZSBwcm9ibGVtcworICAgICAgICAvLyBmb3IgZXhhbXBsZSBp ZiBhIERvY3VtZW50IGlzIGRlbGV0ZWQgZHVyaW5nIHRoZSBmcmFtZSBkZXN0cnVjdGlvbiwgc28g d2UgcmVtb3ZlIHRoZSB3ZWFrIHJlZmVyZW5jZXMgbm93CisgICAgICAgIC8vIGFuZCBkZWxldGUg dGhlIG9iamVjdHMgb24gbmV4dCBydW4gbG9vcCBpdGVyYXRpb24uIFNlZSBodHRwczovL2J1Z3Mu d2Via2l0Lm9yZy9zaG93X2J1Zy5jZ2k/aWQ9MTUxNzAwLgorICAgICAgICBmb3IgKGF1dG8qIGRh dGEgOiBvYmplY3RzKQogICAgICAgICAgICAgZ19vYmplY3Rfd2Vha191bnJlZihkYXRhLT5vYmpl Y3QsIERPTU9iamVjdENhY2hlRnJhbWVPYnNlcnZlcjo6b2JqZWN0RmluYWxpemVkQ2FsbGJhY2ss IHRoaXMpOwotICAgICAgICAgICAgZGF0YS0+Y2xlYXJPYmplY3QoKTsKLSAgICAgICAgfQorCisg ICAgICAgIFJ1bkxvb3A6Om1haW4oKS5kaXNwYXRjaChbb2JqZWN0c10geworICAgICAgICAgICAg Zm9yIChhdXRvKiBkYXRhIDogb2JqZWN0cykKKyAgICAgICAgICAgICAgICBkYXRhLT5jbGVhck9i amVjdCgpOworICAgICAgICB9KTsKICAgICB9CiAKICAgICB2aXJ0dWFsIHZvaWQgd2lsbERldGFj aFBhZ2UoKSBvdmVycmlkZQo=