201712 2019-09-11 21:38:19 -0700 [iOS] ASSERTION FAILED: Unsafe to ref/deref of ShareableBitmap from different threads 2019-09-20 14:06:35 -0700 1 1 1 Unclassified WebKit New Bugs Other Unspecified Unspecified RESOLVED FIXED InRadar P2 Normal --- 1 ryanhaddad cdumez achristensen cdumez commit-queue ggaren sabouhallawa simon.fraser thorton webkit-bot-watchers-bugzilla webkit-bug-importer oldest_to_newest 1570133 0 ryanhaddad 2019-09-11 21:38:19 -0700 The following assertion failure was seen on the iOS Simulator debug bot with layout tests css3/filters/blur-clipped-by-ancestor.html and fast/writing-mode/english-bt-text-with-spelling-marker.html ASSERTION FAILED: Unsafe to ref/deref from different threads m_isOwnedByMainThread == isMainThread() /Volumes/Data/slave/ios-simulator-12-debug/build/WebKitBuild/Debug-iphonesimulator/usr/local/include/wtf/RefCounted.h(115) : void WTF::RefCountedBase::applyRefDerefThreadingCheck() const 1 0x5369db4a9 WTFCrash 2 0x10c22fcda WTF::RefCountedBase::applyRefDerefThreadingCheck() const 3 0x10c22faa9 WTF::RefCountedBase::derefBase() const 4 0x10c2f880f WTF::RefCounted<WebKit::ShareableBitmap, std::__1::default_delete<WebKit::ShareableBitmap> >::deref() const 5 0x10ca89802 WebKit::ShareableBitmap::releaseBitmapContextData(void*, void*) 6 0x5326f70da CGBitmapContextInfoRelease 7 0x5326f95cb context_reclaim 8 0x1160f123e _CFRelease 9 0x10c480a19 WTF::RetainPtr<CGContext*>::~RetainPtr() 10 0x10c477865 WTF::RetainPtr<CGContext*>::~RetainPtr() 11 0x10c48089f WTF::VectorDestructor<true, WTF::RetainPtr<CGContext*> >::destruct(WTF::RetainPtr<CGContext*>*, WTF::RetainPtr<CGContext*>*) 12 0x10c4807dd WTF::VectorTypeOperations<WTF::RetainPtr<CGContext*> >::destruct(WTF::RetainPtr<CGContext*>*, WTF::RetainPtr<CGContext*>*) 13 0x10c48075f WTF::Vector<WTF::RetainPtr<CGContext*>, 0ul, WTF::CrashOnOverflow, 16ul>::~Vector() 14 0x10c477ac5 WTF::Vector<WTF::RetainPtr<CGContext*>, 0ul, WTF::CrashOnOverflow, 16ul>::~Vector() 15 0x10c47d643 WebKit::RemoteLayerTreeDrawingArea::BackingStoreFlusher::~BackingStoreFlusher() 16 0x10c47d615 WebKit::RemoteLayerTreeDrawingArea::BackingStoreFlusher::~BackingStoreFlusher() 17 0x10c47d5ea WTF::ThreadSafeRefCounted<WebKit::RemoteLayerTreeDrawingArea::BackingStoreFlusher, (WTF::DestructionThread)0>::deref() const::'lambda'()::operator()() const 18 0x10c47d5ad WTF::ThreadSafeRefCounted<WebKit::RemoteLayerTreeDrawingArea::BackingStoreFlusher, (WTF::DestructionThread)0>::deref() const 19 0x10c47d531 void WTF::derefIfNotNull<WebKit::RemoteLayerTreeDrawingArea::BackingStoreFlusher>(WebKit::RemoteLayerTreeDrawingArea::BackingStoreFlusher*) 20 0x10c47d4f9 WTF::RefPtr<WebKit::RemoteLayerTreeDrawingArea::BackingStoreFlusher, WTF::DumbPtrTraits<WebKit::RemoteLayerTreeDrawingArea::BackingStoreFlusher> >::~RefPtr() 21 0x10c475215 WTF::RefPtr<WebKit::RemoteLayerTreeDrawingArea::BackingStoreFlusher, WTF::DumbPtrTraits<WebKit::RemoteLayerTreeDrawingArea::BackingStoreFlusher> >::~RefPtr() 22 0x10c47ac95 WebKit::RemoteLayerTreeDrawingArea::flushLayers()::$_2::~$_2() 23 0x10c477cc5 WebKit::RemoteLayerTreeDrawingArea::flushLayers()::$_2::~$_2() 24 0x10c477ca9 __destroy_helper_block_e8_32c62_ZTSKZN6WebKit26RemoteLayerTreeDrawingArea11flushLayersEvE3$_2 25 0x53101e9cd _Block_release 26 0x530f2ad02 _dispatch_client_callout 27 0x530f31720 _dispatch_lane_serial_drain 28 0x530f32261 _dispatch_lane_invoke 29 0x530f3afcb _dispatch_workloop_worker_thread 30 0x53130c611 _pthread_wqthread 31 0x53130c3fd start_wqthread https://build.webkit.org/results/Apple%20iOS%2012%20Simulator%20Debug%20WK2%20(Tests)/r249790%20(5549)/results.html 1570134 1 webkit-bug-importer 2019-09-11 21:38:35 -0700 <rdar://problem/55289916> 1570136 2 ryanhaddad 2019-09-11 21:45:14 -0700 Same assertion seen attributed to different tests here, so I'm not sure which one is actually responsible: https://build.webkit.org/results/Apple%20iOS%2012%20Simulator%20Debug%20WK2%20(Tests)/r249788%20(5548)/results.html 1572129 3 ryanhaddad 2019-09-18 15:44:34 -0700 Lots of tests hit this here on iOS 13: https://build.webkit.org/results/Apple%20iOS%2013%20Simulator%20Debug%20WK2%20(Tests)/r250049%20(20)/results.html We'll need to find repro steps for this. 1572130 4 379081 cdumez 2019-09-18 15:55:15 -0700 Created attachment 379081 Patch 1572201 5 379081 ggaren 2019-09-18 19:31:16 -0700 Comment on attachment 379081 Patch r=me 1572203 6 379081 ggaren 2019-09-18 19:32:52 -0700 Comment on attachment 379081 Patch Actually, I don't think this fix is complete. 1572208 7 cdumez 2019-09-18 19:40:40 -0700 (In reply to Geoffrey Garen from comment #6) > Comment on attachment 379081 [details] > Patch > > Actually, I don't think this fix is complete. Ok, I will take a deeper look tomorrow. I assume the issue is with the SharedMemory data member (given that SharedMemory is not ThreadSafeRefCounted). Or did you identify another issue? 1572209 8 ggaren 2019-09-18 19:42:27 -0700 If ShareableBitmap::releaseDataProviderData derefs typelessData to the point of deletion, then typelessData will deref m_sharedMemory, which is a RefPtr. Mechanically, that deref is not thread-safe. Possibly, if we think hard enough, we can convince ourselves that the deref is not observable in practice, and m_sharedMemory could have been a unique_ptr instead. But it feels fishy. We'd really like pointers to be safe at a glance, without deeper thought. I think what I would prefer is either: (a) Make ShareableBitmap::releaseDataProviderData forward to the main thread. I think that might be what the author expected in the first place. OR (b) Change m_sharedMemory to unique_ptr or ThreadSafeRefCounted. 1572226 9 thorton 2019-09-18 20:36:42 -0700 (a) makes sense to me 1572228 10 cdumez 2019-09-18 20:41:05 -0700 (In reply to Tim Horton from comment #9) > (a) makes sense to me I agree that a) makes sense but this is assuming ShareableBitmap objects are ALWAYS constructed on the main thread. 1572303 11 simon.fraser 2019-09-19 03:00:34 -0700 Why doesn't the bug title have "ShareableBitmap" in it? 1572372 12 379136 cdumez 2019-09-19 09:00:45 -0700 Created attachment 379136 Patch 1572772 13 cdumez 2019-09-20 09:16:24 -0700 No takers? 1572880 14 379136 commit-queue 2019-09-20 14:06:33 -0700 Comment on attachment 379136 Patch Clearing flags on attachment: 379136 Committed r250151: <https://trac.webkit.org/changeset/250151> 1572881 15 commit-queue 2019-09-20 14:06:35 -0700 All reviewed patches have been landed. Closing bug. 379081 2019-09-18 15:55:15 -0700 2019-09-19 09:00:43 -0700 Patch bug-201712-20190918155513.patch text/plain 1578 cdumez U3VidmVyc2lvbiBSZXZpc2lvbjogMjUwMDYxCmRpZmYgLS1naXQgYS9Tb3VyY2UvV2ViS2l0L0No YW5nZUxvZyBiL1NvdXJjZS9XZWJLaXQvQ2hhbmdlTG9nCmluZGV4IDBkYzQ3OTZmMTcxZWEyZDEz MWU0N2U0OTY1N2VlNzNmY2Q4YTk1ZDIuLjc3YmJlOWMzMGJlZGJkYTM3YjAyOWMzYzhiZGQwYzdi N2ViYTRiZTEgMTAwNjQ0Ci0tLSBhL1NvdXJjZS9XZWJLaXQvQ2hhbmdlTG9nCisrKyBiL1NvdXJj ZS9XZWJLaXQvQ2hhbmdlTG9nCkBAIC0xLDMgKzEsMTUgQEAKKzIwMTktMDktMTggIENocmlzIER1 bWV6ICA8Y2R1bWV6QGFwcGxlLmNvbT4KKworICAgICAgICBbaU9TXSBBU1NFUlRJT04gRkFJTEVE OiBVbnNhZmUgdG8gcmVmL2RlcmVmIGZyb20gZGlmZmVyZW50IHRocmVhZHMgaW4gV1RGOjpSZWZD b3VudGVkQmFzZTo6YXBwbHlSZWZEZXJlZlRocmVhZGluZ0NoZWNrKCkKKyAgICAgICAgaHR0cHM6 Ly9idWdzLndlYmtpdC5vcmcvc2hvd19idWcuY2dpP2lkPTIwMTcxMgorICAgICAgICA8cmRhcjov L3Byb2JsZW0vNTUyODk5MTY+CisKKyAgICAgICAgUmV2aWV3ZWQgYnkgTk9CT0RZIChPT1BTISku CisKKyAgICAgICAgTWFyayBTaGFyZWFibGVCaXRtYXAgYXMgVGhyZWFkU2FmZVJlZkNvdW50ZWQg YXMgaXQgaXMgcmVmJ2QgLyBkZXJlZidkIGZyb20gc2V2ZXJhbCB0aHJlYWRzLgorCisgICAgICAg ICogU2hhcmVkL1NoYXJlYWJsZUJpdG1hcC5oOgorCiAyMDE5LTA5LTE4ICBDaHJpcyBEdW1leiAg PGNkdW1lekBhcHBsZS5jb20+CiAKICAgICAgICAgQmxvYlJlZ2lzdHJ5IG5vIGxvbmdlciBuZWVk cyBTZXNzaW9uSURzCmRpZmYgLS1naXQgYS9Tb3VyY2UvV2ViS2l0L1NoYXJlZC9TaGFyZWFibGVC aXRtYXAuaCBiL1NvdXJjZS9XZWJLaXQvU2hhcmVkL1NoYXJlYWJsZUJpdG1hcC5oCmluZGV4IGEy YjRmMzU1MTVkMTkwYmJlMmJmYzZjZjg4YzEwNTJjMDQzNzExODkuLmY4MDQzNjY2OGQ5NzU3NGNi MDNiNDAyNzU3MmYxMGJmMTRiMjMzM2QgMTAwNjQ0Ci0tLSBhL1NvdXJjZS9XZWJLaXQvU2hhcmVk L1NoYXJlYWJsZUJpdG1hcC5oCisrKyBiL1NvdXJjZS9XZWJLaXQvU2hhcmVkL1NoYXJlYWJsZUJp dG1hcC5oCkBAIC0yNyw4ICsyNyw4IEBACiAKICNpbmNsdWRlICJTaGFyZWRNZW1vcnkuaCIKICNp bmNsdWRlIDxXZWJDb3JlL0ludFJlY3QuaD4KLSNpbmNsdWRlIDx3dGYvUmVmQ291bnRlZC5oPgog I2luY2x1ZGUgPHd0Zi9SZWZQdHIuaD4KKyNpbmNsdWRlIDx3dGYvVGhyZWFkU2FmZVJlZkNvdW50 ZWQuaD4KIAogI2lmIFVTRShDRykKICNpbmNsdWRlICJDb2xvclNwYWNlRGF0YS5oIgpAQCAtNTYs NyArNTYsNyBAQCBjbGFzcyBHcmFwaGljc0NvbnRleHQ7CiAKIG5hbWVzcGFjZSBXZWJLaXQgewog ICAgIAotY2xhc3MgU2hhcmVhYmxlQml0bWFwIDogcHVibGljIFJlZkNvdW50ZWQ8U2hhcmVhYmxl Qml0bWFwPiB7CitjbGFzcyBTaGFyZWFibGVCaXRtYXAgOiBwdWJsaWMgVGhyZWFkU2FmZVJlZkNv dW50ZWQ8U2hhcmVhYmxlQml0bWFwPiB7CiBwdWJsaWM6CiAgICAgc3RydWN0IENvbmZpZ3VyYXRp b24gewogICAgICAgICBib29sIGlzT3BhcXVlIHsgZmFsc2UgfTsK 379136 2019-09-19 09:00:45 -0700 2019-09-20 14:06:33 -0700 Patch bug-201712-20190919090044.patch text/plain 3599 cdumez U3VidmVyc2lvbiBSZXZpc2lvbjogMjUwMDkwCmRpZmYgLS1naXQgYS9Tb3VyY2UvV2ViS2l0L0No YW5nZUxvZyBiL1NvdXJjZS9XZWJLaXQvQ2hhbmdlTG9nCmluZGV4IDA0OTMyNzFmMWFmYjhkMWEw ZGIwNGUzOTBlNzI5YzUzMjUxZTEwNTAuLmQxNzYzOTcwOGI1NTIxOWVlOTdlZjJmYjFhZThkZGZi NDZmNjYxZTMgMTAwNjQ0Ci0tLSBhL1NvdXJjZS9XZWJLaXQvQ2hhbmdlTG9nCisrKyBiL1NvdXJj ZS9XZWJLaXQvQ2hhbmdlTG9nCkBAIC0xLDMgKzEsMjEgQEAKKzIwMTktMDktMTkgIENocmlzIER1 bWV6ICA8Y2R1bWV6QGFwcGxlLmNvbT4KKworICAgICAgICBbaU9TXSBBU1NFUlRJT04gRkFJTEVE OiBVbnNhZmUgdG8gcmVmL2RlcmVmIG9mIFNoYXJlYWJsZUJpdG1hcCBmcm9tIGRpZmZlcmVudCB0 aHJlYWRzCisgICAgICAgIGh0dHBzOi8vYnVncy53ZWJraXQub3JnL3Nob3dfYnVnLmNnaT9pZD0y MDE3MTIKKyAgICAgICAgPHJkYXI6Ly9wcm9ibGVtLzU1Mjg5OTE2PgorCisgICAgICAgIFJldmll d2VkIGJ5IE5PQk9EWSAoT09QUyEpLgorCisgICAgICAgIE1ha2Ugc3VyZSBTaGFyZWFibGVCaXRt YXAgb2JqZWN0cyBhcmUgYWx3YXlzIHJlZidkIC8gZGVyZWYnZCBvbiB0aGUgbWFpbiB0aHJlYWQg YnkgZGlzcGF0Y2hpbmcgdG8KKyAgICAgICAgdGhlIG1haW4gdGhyZWFkIGluIFNoYXJlYWJsZUJp dG1hcDo6cmVsZWFzZUJpdG1hcENvbnRleHREYXRhKCkgYmVmb3JlIGNhbGxpbmcgZGVyZWYoKS4K KworICAgICAgICAqIFNoYXJlZC9TaGFyZWFibGVCaXRtYXAuY3BwOgorICAgICAgICAoV2ViS2l0 OjpTaGFyZWFibGVCaXRtYXA6OlNoYXJlYWJsZUJpdG1hcCk6CisgICAgICAgIChXZWJLaXQ6OlNo YXJlYWJsZUJpdG1hcDo6flNoYXJlYWJsZUJpdG1hcCk6CisgICAgICAgICogU2hhcmVkL2NnL1No YXJlYWJsZUJpdG1hcENHLmNwcDoKKyAgICAgICAgKFdlYktpdDo6U2hhcmVhYmxlQml0bWFwOjpj cmVhdGVHcmFwaGljc0NvbnRleHQpOgorICAgICAgICAoV2ViS2l0OjpTaGFyZWFibGVCaXRtYXA6 OnJlbGVhc2VCaXRtYXBDb250ZXh0RGF0YSk6CisKIDIwMTktMDktMTggIENocmlzIER1bWV6ICA8 Y2R1bWV6QGFwcGxlLmNvbT4KIAogICAgICAgICBBZGRQbHVnSW5BdXRvU3RhcnRPcmlnaW5IYXNo IC8gUGx1Z0luRGlkUmVjZWl2ZVVzZXJJbnRlcmFjdGlvbiBJUEMgc2hvdWxkIG5vdCBuZWVkIHRv IHBhc3MgYSBTZXNzaW9uSUQKZGlmZiAtLWdpdCBhL1NvdXJjZS9XZWJLaXQvU2hhcmVkL1NoYXJl YWJsZUJpdG1hcC5jcHAgYi9Tb3VyY2UvV2ViS2l0L1NoYXJlZC9TaGFyZWFibGVCaXRtYXAuY3Bw CmluZGV4IDA4MTQ3NDAwMzdkMzk3YzEyMjg0NzA5OTljM2NhODEzMGJlNzUxM2MuLjAwNGY0OTE1 NTZiYTBhODBjNjJhZTRkMjZhYWY3M2IyZmZkZGI5ZDMgMTAwNjQ0Ci0tLSBhL1NvdXJjZS9XZWJL aXQvU2hhcmVkL1NoYXJlYWJsZUJpdG1hcC5jcHAKKysrIGIvU291cmNlL1dlYktpdC9TaGFyZWQv U2hhcmVhYmxlQml0bWFwLmNwcApAQCAtMTYzLDYgKzE2Myw3IEBAIFNoYXJlYWJsZUJpdG1hcDo6 U2hhcmVhYmxlQml0bWFwKGNvbnN0IEludFNpemUmIHNpemUsIENvbmZpZ3VyYXRpb24gY29uZmln dXJhdGlvCiAgICAgLCBtX2NvbmZpZ3VyYXRpb24oY29uZmlndXJhdGlvbikKICAgICAsIG1fZGF0 YShkYXRhKQogeworICAgIEFTU0VSVChSdW5Mb29wOjppc01haW4oKSk7CiB9CiAKIFNoYXJlYWJs ZUJpdG1hcDo6U2hhcmVhYmxlQml0bWFwKGNvbnN0IEludFNpemUmIHNpemUsIENvbmZpZ3VyYXRp b24gY29uZmlndXJhdGlvbiwgUmVmUHRyPFNoYXJlZE1lbW9yeT4gc2hhcmVkTWVtb3J5KQpAQCAt MTcxLDYgKzE3Miw4IEBAIFNoYXJlYWJsZUJpdG1hcDo6U2hhcmVhYmxlQml0bWFwKGNvbnN0IElu dFNpemUmIHNpemUsIENvbmZpZ3VyYXRpb24gY29uZmlndXJhdGlvCiAgICAgLCBtX3NoYXJlZE1l bW9yeShzaGFyZWRNZW1vcnkpCiAgICAgLCBtX2RhdGEobnVsbHB0cikKIHsKKyAgICBBU1NFUlQo UnVuTG9vcDo6aXNNYWluKCkpOworCiAjaWYgVVNFKERJUkVDVDJEKQogICAgIGNyZWF0ZVNoYXJl ZFJlc291cmNlKCk7CiAjZW5kaWYKQEAgLTE3OCw2ICsxODEsOCBAQCBTaGFyZWFibGVCaXRtYXA6 OlNoYXJlYWJsZUJpdG1hcChjb25zdCBJbnRTaXplJiBzaXplLCBDb25maWd1cmF0aW9uIGNvbmZp Z3VyYXRpbwogCiBTaGFyZWFibGVCaXRtYXA6On5TaGFyZWFibGVCaXRtYXAoKQogeworICAgIEFT U0VSVChSdW5Mb29wOjppc01haW4oKSk7CisKICAgICBpZiAoIWlzQmFja2VkQnlTaGFyZWRNZW1v cnkoKSkKICAgICAgICAgZmFzdEZyZWUobV9kYXRhKTsKICNpZiBVU0UoRElSRUNUMkQpCmRpZmYg LS1naXQgYS9Tb3VyY2UvV2ViS2l0L1NoYXJlZC9jZy9TaGFyZWFibGVCaXRtYXBDRy5jcHAgYi9T b3VyY2UvV2ViS2l0L1NoYXJlZC9jZy9TaGFyZWFibGVCaXRtYXBDRy5jcHAKaW5kZXggMDE2YWJi ZDk5M2UxOGE0NWMwMWE3ZjA0OTdkY2MzMWE1M2I0MzcwNy4uM2UzMWNkZWMwNzQ1NjIyMDYwNTgw ZjBmNjNkYjQ5ZTI1ZGEzN2Y3YiAxMDA2NDQKLS0tIGEvU291cmNlL1dlYktpdC9TaGFyZWQvY2cv U2hhcmVhYmxlQml0bWFwQ0cuY3BwCisrKyBiL1NvdXJjZS9XZWJLaXQvU2hhcmVkL2NnL1NoYXJl YWJsZUJpdG1hcENHLmNwcApAQCAtODcsNiArODcsNyBAQCB1bnNpZ25lZCBTaGFyZWFibGVCaXRt YXA6OmNhbGN1bGF0ZUJ5dGVzUGVyUGl4ZWwoY29uc3QgQ29uZmlndXJhdGlvbiYgY29uZmlndXJh dAogCiBzdGQ6OnVuaXF1ZV9wdHI8R3JhcGhpY3NDb250ZXh0PiBTaGFyZWFibGVCaXRtYXA6OmNy ZWF0ZUdyYXBoaWNzQ29udGV4dCgpCiB7CisgICAgQVNTRVJUKFJ1bkxvb3A6OmlzTWFpbigpKTsK ICAgICByZWYoKTsgLy8gQmFsYW5jZWQgYnkgZGVyZWYgaW4gcmVsZWFzZUJpdG1hcENvbnRleHRE YXRhLgogCiAgICAgdW5zaWduZWQgYnl0ZXNQZXJQaXhlbCA9IGNhbGN1bGF0ZUJ5dGVzUGVyUGl4 ZWwobV9jb25maWd1cmF0aW9uKTsKQEAgLTE0MSw2ICsxNDIsMTMgQEAgUmV0YWluUHRyPENHSW1h Z2VSZWY+IFNoYXJlYWJsZUJpdG1hcDo6Y3JlYXRlQ0dJbWFnZShDR0RhdGFQcm92aWRlclJlZiBk YXRhUHJvdmkKIAogdm9pZCBTaGFyZWFibGVCaXRtYXA6OnJlbGVhc2VCaXRtYXBDb250ZXh0RGF0 YSh2b2lkKiB0eXBlbGVzc0JpdG1hcCwgdm9pZCogdHlwZWxlc3NEYXRhKQogeworICAgIGlmICgh UnVuTG9vcDo6aXNNYWluKCkpIHsKKyAgICAgICAgUnVuTG9vcDo6bWFpbigpLmRpc3BhdGNoKFt0 eXBlbGVzc0JpdG1hcCwgdHlwZWxlc3NEYXRhXSB7CisgICAgICAgICAgICByZWxlYXNlQml0bWFw Q29udGV4dERhdGEodHlwZWxlc3NCaXRtYXAsIHR5cGVsZXNzRGF0YSk7CisgICAgICAgIH0pOwor ICAgICAgICByZXR1cm47CisgICAgfQorCiAgICAgU2hhcmVhYmxlQml0bWFwKiBiaXRtYXAgPSBz dGF0aWNfY2FzdDxTaGFyZWFibGVCaXRtYXAqPih0eXBlbGVzc0JpdG1hcCk7CiAgICAgQVNTRVJU X1VOVVNFRCh0eXBlbGVzc0RhdGEsIGJpdG1hcC0+ZGF0YSgpID09IHR5cGVsZXNzRGF0YSk7CiAg ICAgYml0bWFwLT5kZXJlZigpOyAvLyBCYWxhbmNlZCBieSByZWYgaW4gY3JlYXRlR3JhcGhpY3ND b250ZXh0Lgo=