161800 2016-09-09 09:43:00 -0700 ASSERTION FAILED: The string being removed is atomic in the string table of an other thread! iterator != atomicStringTable.end() at Source/WTF/wtf/text/AtomicStringImpl.cpp(453) 2020-05-03 21:11:21 -0700 1 1 1 Unclassified WebKit WebKitGTK Other PC Linux RESOLVED FIXED https://bugs.webkit.org/show_bug.cgi?id=211365 P2 Normal --- 1 mcatanzaro mcatanzaro ap bugs-noreply cmarcelo commit-queue kondapallykalyan luiz mcatanzaro mrobinson noam tonikitoo yoon zan oldest_to_newest 1228152 0 mcatanzaro 2016-09-09 09:43:00 -0700 This is a regression from within the past month or so. It happens quite often. I need to get a better backtrace. ASSERTION FAILED: The string being removed is atomic in the string table of an other thread! iterator != atomicStringTable.end() ../../Source/WTF/wtf/text/AtomicStringImpl.cpp(453) : static void WTF::AtomicStringImpl::remove(WTF::AtomicStringImpl*) 1 0x7fbf665d1d5c /home/mcatanzaro/src/jhbuild/install/lib/libjavascriptcoregtk-4.0.so.18(WTFCrash+0x1e) [0x7fbf665d1d5c] 2 0x7fbf665ffc4e /home/mcatanzaro/src/jhbuild/install/lib/libjavascriptcoregtk-4.0.so.18(_ZN3WTF16AtomicStringImpl6removeEPS0_+0xfe) [0x7fbf665ffc4e] 3 0x7fbf6660a0ad /home/mcatanzaro/src/jhbuild/install/lib/libjavascriptcoregtk-4.0.so.18(_ZN3WTF10StringImplD1Ev+0x9b) [0x7fbf6660a0ad] 4 0x7fbf6660a200 /home/mcatanzaro/src/jhbuild/install/lib/libjavascriptcoregtk-4.0.so.18(_ZN3WTF10StringImpl7destroyEPS0_+0x18) [0x7fbf6660a200] 5 0x7fbf6c1c3666 /home/mcatanzaro/src/jhbuild/install/lib/libwebkit2gtk-4.0.so.37(_ZN3WTF10StringImpl5derefEv+0x2a) [0x7fbf6c1c3666] 6 0x7fbf6c1c6056 /home/mcatanzaro/src/jhbuild/install/lib/libwebkit2gtk-4.0.so.37(_ZN3WTF14derefIfNotNullINS_10StringImplEEEvPT_+0x28) [0x7fbf6c1c6056] 7 0x7fbf6c1c440f /home/mcatanzaro/src/jhbuild/install/lib/libwebkit2gtk-4.0.so.37(_ZN3WTF6RefPtrINS_10StringImplEED1Ev+0x2f) [0x7fbf6c1c440f] 8 0x7fbf6c1c3742 /home/mcatanzaro/src/jhbuild/install/lib/libwebkit2gtk-4.0.so.37(_ZN3WTF6StringD1Ev+0x18) [0x7fbf6c1c3742] 9 0x7fbf6c1e0a1a /home/mcatanzaro/src/jhbuild/install/lib/libwebkit2gtk-4.0.so.37(_ZN3WTF12AtomicStringD1Ev+0x18) [0x7fbf6c1e0a1a] 10 0x7fbf5998e1e8 /lib64/libc.so.6(+0x391e8) [0x7fbf5998e1e8] 11 0x7fbf5998e235 /lib64/libc.so.6(+0x39235) [0x7fbf5998e235] 12 0x7fbf6c1f0337 /home/mcatanzaro/src/jhbuild/install/lib/libwebkit2gtk-4.0.so.37(_ZN3IPC10Connection24didFailToSendSyncMessageEv+0x25) [0x7fbf6c1f0337] 13 0x7fbf6c1edcb1 /home/mcatanzaro/src/jhbuild/install/lib/libwebkit2gtk-4.0.so.37(_ZN3IPC10Connection15sendSyncMessageEmSt10unique_ptrINS_7EncoderESt14default_deleteIS2_EENSt6chrono8durationIlSt5ratioILl1ELl1000EEEEN3WTF9OptionSetINS_14SendSyncOptionEEE+0xe5) [0x7fbf6c1edcb1] 14 0x7fbf6c48deb4 /home/mcatanzaro/src/jhbuild/install/lib/libwebkit2gtk-4.0.so.37(_ZN3IPC10Connection8sendSyncIN8Messages15WebProcessProxy15ShouldTerminateEEEbOT_ONS5_5ReplyEmNSt6chrono8durationIlSt5ratioILl1ELl1000EEEEN3WTF9OptionSetINS_14SendSyncOptionEEE+0x120) [0x7fbf6c48deb4] 15 0x7fbf6c484b24 /home/mcatanzaro/src/jhbuild/install/lib/libwebkit2gtk-4.0.so.37(_ZN6WebKit10WebProcess15shouldTerminateEv+0xc0) [0x7fbf6c484b24] 16 0x7fbf6c22694b /home/mcatanzaro/src/jhbuild/install/lib/libwebkit2gtk-4.0.so.37(_ZN6WebKit12ChildProcess21terminationTimerFiredEv+0x23) [0x7fbf6c22694b] 17 0x7fbf6c2268c6 /home/mcatanzaro/src/jhbuild/install/lib/libwebkit2gtk-4.0.so.37(_ZN6WebKit12ChildProcess17enableTerminationEv+0x80) [0x7fbf6c2268c6] 18 0x7fbf6c484a60 /home/mcatanzaro/src/jhbuild/install/lib/libwebkit2gtk-4.0.so.37(_ZN6WebKit10WebProcess13removeWebPageEm+0x8e) [0x7fbf6c484a60] 19 0x7fbf6c5f645c /home/mcatanzaro/src/jhbuild/install/lib/libwebkit2gtk-4.0.so.37(_ZN6WebKit7WebPage5closeEv+0x46a) [0x7fbf6c5f645c] 20 0x7fbf6c962d77 /home/mcatanzaro/src/jhbuild/install/lib/libwebkit2gtk-4.0.so.37(_ZN3IPC22callMemberFunctionImplIN6WebKit7WebPageEMS2_FvvESt5tupleIJEEJEEEvPT_T0_OT1_St16integer_sequenceImJXspT2_EEE+0x65) [0x7fbf6c962d77] 21 0x7fbf6c961478 /home/mcatanzaro/src/jhbuild/install/lib/libwebkit2gtk-4.0.so.37(_ZN3IPC18callMemberFunctionIN6WebKit7WebPageEMS2_FvvESt5tupleIJEESt16integer_sequenceImJEEEEvOT1_PT_T0_+0x41) [0x7fbf6c961478] 22 0x7fbf6c95d358 /home/mcatanzaro/src/jhbuild/install/lib/libwebkit2gtk-4.0.so.37(_ZN3IPC13handleMessageIN8Messages7WebPage5CloseEN6WebKit7WebPageEMS5_FvvEEEvRNS_7DecoderEPT0_T1_+0x8f) [0x7fbf6c95d358] 23 0x7fbf6c95767a /home/mcatanzaro/src/jhbuild/install/lib/libwebkit2gtk-4.0.so.37(_ZN6WebKit7WebPage24didReceiveWebPageMessageERN3IPC10ConnectionERNS1_7DecoderE+0x1d9c) [0x7fbf6c95767a] 24 0x7fbf6c601b62 /home/mcatanzaro/src/jhbuild/install/lib/libwebkit2gtk-4.0.so.37(_ZN6WebKit7WebPage17didReceiveMessageERN3IPC10ConnectionERNS1_7DecoderE+0x240) [0x7fbf6c601b62] 25 0x7fbf6c20b325 /home/mcatanzaro/src/jhbuild/install/lib/libwebkit2gtk-4.0.so.37(_ZN3IPC18MessageReceiverMap15dispatchMessageERNS_10ConnectionERNS_7DecoderE+0x125) [0x7fbf6c20b325] 26 0x7fbf6c484ca4 /home/mcatanzaro/src/jhbuild/install/lib/libwebkit2gtk-4.0.so.37(_ZN6WebKit10WebProcess17didReceiveMessageERN3IPC10ConnectionERNS1_7DecoderE+0x4c) [0x7fbf6c484ca4] 27 0x7fbf6c1f04ba /home/mcatanzaro/src/jhbuild/install/lib/libwebkit2gtk-4.0.so.37(_ZN3IPC10Connection15dispatchMessageERNS_7DecoderE+0x3a) [0x7fbf6c1f04ba] 28 0x7fbf6c1f0624 /home/mcatanzaro/src/jhbuild/install/lib/libwebkit2gtk-4.0.so.37(_ZN3IPC10Connection15dispatchMessageESt10unique_ptrINS_7DecoderESt14default_deleteIS2_EE+0x166) [0x7fbf6c1f0624] 29 0x7fbf6c1f0816 /home/mcatanzaro/src/jhbuild/install/lib/libwebkit2gtk-4.0.so.37(_ZN3IPC10Connection18dispatchOneMessageEv+0xc8) [0x7fbf6c1f0816] 30 0x7fbf6c1f035a /home/mcatanzaro/src/jhbuild/install/lib/libwebkit2gtk-4.0.so.37(+0x4a7135a) [0x7fbf6c1f035a] 31 0x7fbf6c1f6f2e /home/mcatanzaro/src/jhbuild/install/lib/libwebkit2gtk-4.0.so.37(+0x4a77f2e) [0x7fbf6c1f6f2e] 1228565 1 mcatanzaro 2016-09-10 17:22:15 -0700 I added a print statement: if (iterator == atomicStringTable.end()) WTFLogAlways("******%s********", string->utf8(LenientConversion).data()); ASSERT_WITH_MESSAGE(iterator != atomicStringTable.end(), "The string being removed is atomic in the string table of an other thread!"); The next time I saw the crash, the string printed was "u_projectionMatrix" That's a local variable in WebCore/platform/graphics/texmap/TextureMapperShaderProgram.cpp. I have no clue what this file is doing, but it looks like some serious black magic. 1228566 2 mcatanzaro 2016-09-10 17:23:11 -0700 (In reply to comment #1) > The next time I saw the crash, the string printed was "u_projectionMatrix" Looks like it's always this string. 1229095 3 zan 2016-09-12 23:26:44 -0700 On what thread is the assertion occurring? These AtomicString objects should be constructed on the composition thread, and added to the AtomicString table for that thread. I assume the destruction of these is happening on the main thread, via at-exit handlers. Using static NeverDestroyed<AtomicString> objects would probably fix this. 1229185 4 mcatanzaro 2016-09-13 09:50:26 -0700 (In reply to comment #3) > On what thread is the assertion occurring? The main thread. > These AtomicString objects should be constructed on the composition thread, > and added to the AtomicString table for that thread. Sad. > I assume the destruction of these is happening on the main thread, via > at-exit handlers. Yes. > Using static NeverDestroyed<AtomicString> objects would probably fix this. OK, probably! 1229187 5 288692 mcatanzaro 2016-09-13 10:00:18 -0700 Created attachment 288692 Patch 1229207 6 288692 zan 2016-09-13 10:59:38 -0700 Comment on attachment 288692 Patch View in context: https://bugs.webkit.org/attachment.cgi?id=288692&action=review > Source/WebCore/platform/graphics/texmap/TextureMapperShaderProgram.h:35 > +#define TEXMAP_DECLARE_VARIABLE(Accessor, Name, Type) GC3Duint Accessor##Location() { static NeverDestroyed<const AtomicString> name(Name); return getLocation(name.get(), Type); } AtomicString::ConstructFromLiteral should be passed as the second argument to the constructor. I think all the strings used with the macro are literals. 1230747 7 mcatanzaro 2016-09-16 19:55:21 -0700 Committed r206061: <http://trac.webkit.org/changeset/206061> 1254750 8 mcatanzaro 2016-11-30 06:09:22 -0800 *** Bug 164919 has been marked as a duplicate of this bug. *** 288692 2016-09-13 10:00:18 -0700 2016-09-13 10:59:38 -0700 Patch bug-161800-20160913115743.patch text/plain 2405 mcatanzaro U3VidmVyc2lvbiBSZXZpc2lvbjogMjA1ODEwCmRpZmYgLS1naXQgYS9Tb3VyY2UvV2ViQ29yZS9D aGFuZ2VMb2cgYi9Tb3VyY2UvV2ViQ29yZS9DaGFuZ2VMb2cKaW5kZXggYjVkYTM3OTk4N2ZjZDdl NmVhMjQ4ODIyZTY0NDE4NDNhNTAzOTcwYi4uMWE0NGI3ZDlkMjdmNGZhMWVhNmI5MmYyOGI0NzI1 ZmFkYmE3ZmRjNyAxMDA2NDQKLS0tIGEvU291cmNlL1dlYkNvcmUvQ2hhbmdlTG9nCisrKyBiL1Nv dXJjZS9XZWJDb3JlL0NoYW5nZUxvZwpAQCAtMSwzICsxLDE2IEBACisyMDE2LTA5LTEzICBNaWNo YWVsIENhdGFuemFybyAgPG1jYXRhbnphcm9AaWdhbGlhLmNvbT4KKworICAgICAgICBBU1NFUlRJ T04gRkFJTEVEOiBUaGUgc3RyaW5nIGJlaW5nIHJlbW92ZWQgaXMgYXRvbWljIGluIHRoZSBzdHJp bmcgdGFibGUgb2YgYW4gb3RoZXIgdGhyZWFkISBpdGVyYXRvciAhPSBhdG9taWNTdHJpbmdUYWJs ZS5lbmQoKSBhdCBTb3VyY2UvV1RGL3d0Zi90ZXh0L0F0b21pY1N0cmluZ0ltcGwuY3BwKDQ1MykK KyAgICAgICAgaHR0cHM6Ly9idWdzLndlYmtpdC5vcmcvc2hvd19idWcuY2dpP2lkPTE2MTgwMAor CisgICAgICAgIFJldmlld2VkIGJ5IE5PQk9EWSAoT09QUyEpLgorCisgICAgICAgIFNwZWN1bGF0 aXZlIGZpeC4gVGhlc2Ugc3RyaW5ncyBhcmUgY3JlYXRlZCBhcyBzdGF0aWMgb2JqZWN0cyBvbiBh IHNlY29uZGFyeSB0aHJlYWQsIGJ1dCBhbGwKKyAgICAgICAgc3RhdGljIG9iamVjdHMgYXJlIGRl c3Ryb3llZCBpbiBleGl0IGhhbmRsZXJzIG9uIHRoZSBtYWluIHRocmVhZCwgYW5kIEF0b21pY1N0 cmluZ3MgbXVzdAorICAgICAgICBhbHdheXMgYmUgZGVzdHJveWVkIG9uIHRoZSBzYW1lIHRocmVh ZCB0aGV5IGFyZSBjcmVhdGVkLgorCisgICAgICAgICogcGxhdGZvcm0vZ3JhcGhpY3MvdGV4bWFw L1RleHR1cmVNYXBwZXJTaGFkZXJQcm9ncmFtLmg6CisKIDIwMTYtMDktMTIgIFNpbW9uIEZyYXNl ciAgPHNpbW9uLmZyYXNlckBhcHBsZS5jb20+CiAKICAgICAgICAgTWFrZSAtd2Via2l0LXRyYW5z aXRpb24tKiBhbmQgLXdlYmtpdC1hbmltYXRpb24tKiBwcm9wZXJ0aWVzIGJlIHB1cmUgYWxpYXNl cyBvZiB0aGUgdW5wcmVmaXhlZCBvbmVzCmRpZmYgLS1naXQgYS9Tb3VyY2UvV2ViQ29yZS9wbGF0 Zm9ybS9ncmFwaGljcy90ZXhtYXAvVGV4dHVyZU1hcHBlclNoYWRlclByb2dyYW0uaCBiL1NvdXJj ZS9XZWJDb3JlL3BsYXRmb3JtL2dyYXBoaWNzL3RleG1hcC9UZXh0dXJlTWFwcGVyU2hhZGVyUHJv Z3JhbS5oCmluZGV4IDlhODk1NWE2ZjhjNjA0Y2IxMDgzMmNmMzk5NzM3ODliZGE1YWQ2YmIuLmQx NWU4NDM5MTM2N2EyODA0ZWY1MjQ3Mzc3Mzk2ZDgzYzI1OGFhOWMgMTAwNjQ0Ci0tLSBhL1NvdXJj ZS9XZWJDb3JlL3BsYXRmb3JtL2dyYXBoaWNzL3RleG1hcC9UZXh0dXJlTWFwcGVyU2hhZGVyUHJv Z3JhbS5oCisrKyBiL1NvdXJjZS9XZWJDb3JlL3BsYXRmb3JtL2dyYXBoaWNzL3RleG1hcC9UZXh0 dXJlTWFwcGVyU2hhZGVyUHJvZ3JhbS5oCkBAIC0yNiwxMiArMjYsMTMgQEAKICNpbmNsdWRlICJH cmFwaGljc0NvbnRleHQzRC5oIgogI2luY2x1ZGUgIlRyYW5zZm9ybWF0aW9uTWF0cml4LmgiCiAj aW5jbHVkZSA8d3RmL0hhc2hNYXAuaD4KKyNpbmNsdWRlIDx3dGYvTmV2ZXJEZXN0cm95ZWQuaD4K ICNpbmNsdWRlIDx3dGYvUmVmLmg+CiAjaW5jbHVkZSA8d3RmL3RleHQvQXRvbWljU3RyaW5nSGFz aC5oPgogCiBuYW1lc3BhY2UgV2ViQ29yZSB7CiAKLSNkZWZpbmUgVEVYTUFQX0RFQ0xBUkVfVkFS SUFCTEUoQWNjZXNzb3IsIE5hbWUsIFR5cGUpIEdDM0R1aW50IEFjY2Vzc29yIyNMb2NhdGlvbigp IHsgc3RhdGljIGNvbnN0IEF0b21pY1N0cmluZyBuYW1lKE5hbWUpOyByZXR1cm4gZ2V0TG9jYXRp b24obmFtZSwgVHlwZSk7IH0KKyNkZWZpbmUgVEVYTUFQX0RFQ0xBUkVfVkFSSUFCTEUoQWNjZXNz b3IsIE5hbWUsIFR5cGUpIEdDM0R1aW50IEFjY2Vzc29yIyNMb2NhdGlvbigpIHsgc3RhdGljIE5l dmVyRGVzdHJveWVkPGNvbnN0IEF0b21pY1N0cmluZz4gbmFtZShOYW1lKTsgcmV0dXJuIGdldExv Y2F0aW9uKG5hbWUuZ2V0KCksIFR5cGUpOyB9CiAjZGVmaW5lIFRFWE1BUF9ERUNMQVJFX1VOSUZP Uk0oQWNjZXNzb3IpIFRFWE1BUF9ERUNMQVJFX1ZBUklBQkxFKEFjY2Vzc29yLCAidV8iI0FjY2Vz c29yLCBVbmlmb3JtVmFyaWFibGUpCiAjZGVmaW5lIFRFWE1BUF9ERUNMQVJFX0FUVFJJQlVURShB Y2Nlc3NvcikgVEVYTUFQX0RFQ0xBUkVfVkFSSUFCTEUoQWNjZXNzb3IsICJhXyIjQWNjZXNzb3Is IEF0dHJpYlZhcmlhYmxlKQogI2RlZmluZSBURVhNQVBfREVDTEFSRV9TQU1QTEVSKEFjY2Vzc29y KSBURVhNQVBfREVDTEFSRV9WQVJJQUJMRShBY2Nlc3NvciwgInNfIiNBY2Nlc3NvciwgVW5pZm9y bVZhcmlhYmxlKQo=