224033 2021-03-31 18:23:40 -0700 ASSERTION FAILED: isReactionAllowed() in enqueueDisconnectedCallbackIfNeeded during document teardown 2021-05-18 01:44:57 -0700 1 1 1 Unclassified WebKit New Bugs WebKit Nightly Build Unspecified Unspecified RESOLVED FIXED InRadar P2 Normal --- 1 jenner rniwa cdumez esprehn+autocc ews-watchlist kangil.han koivisto mjs rniwa webkit-bot-watchers-bugzilla webkit-bug-importer oldest_to_newest 1745896 0 jenner 2021-03-31 18:23:40 -0700 imported/w3c/web-platform-tests/custom-elements/reactions/HTMLMediaElement.html is a flakey crashing in iOS and macOS Debug. HISTORY URL: https://results.webkit.org/?suite=layout-tests&test=imported%2Fw3c%2Fweb-platform-tests%2Fcustom-elements%2Freactions%2FHTMLMediaElement.html ASSERTION FAILED: CustomElementReactionDisallowedScope::isReactionAllowed() ./dom/CustomElementReactionQueue.cpp(175) : static void WebCore::CustomElementReactionQueue::enqueueDisconnectedCallbackIfNeeded(WebCore::Element &) 1 0x1333a9128 WTFCrash 2 0x113e4c4c0 WebCore::JSANGLEInstancedArrays::createPrototype(JSC::VM&, WebCore::JSDOMGlobalObject&) 3 0x11679baac WebCore::CustomElementReactionQueue::enqueueDisconnectedCallbackIfNeeded(WebCore::Element&) 4 0x1168daf60 WebCore::Element::removedFromAncestor(WebCore::Node::RemovalType, WebCore::ContainerNode&) 5 0x116799f40 WebCore::notifyNodeRemovedFromDocument(WebCore::ContainerNode&, WebCore::TreeScopeChange, WebCore::Node&) 6 0x11679a010 WebCore::notifyNodeRemovedFromDocument(WebCore::ContainerNode&, WebCore::TreeScopeChange, WebCore::Node&) 7 0x116799dc0 WebCore::notifyChildNodeRemoved(WebCore::ContainerNode&, WebCore::Node&) 8 0x11679a5f4 WebCore::addChildNodesToDeletionQueue(WebCore::Node*&, WebCore::Node*&, WebCore::ContainerNode&) 9 0x11679a6c4 WebCore::removeDetachedChildrenInContainer(WebCore::ContainerNode&) 10 0x116773684 WebCore::ContainerNode::removeDetachedChildren() 11 0x1167de61c WebCore::Document::removedLastRef() 12 0x1169a6588 WebCore::Node::removedLastRef() 13 0x113f80444 WebCore::Node::deref() const 14 0x11699df48 WebCore::Node::derefEventTarget() 15 0x113ee7a44 WebCore::EventTarget::deref() 16 0x113ee7a10 WTF::Ref<WebCore::EventTarget, WTF::RawPtrTraits<WebCore::EventTarget> >::~Ref() 17 0x113f5ae60 WTF::Ref<WebCore::EventTarget, WTF::RawPtrTraits<WebCore::EventTarget> >::~Ref() 18 0x11425828c WebCore::JSDOMWrapper<WebCore::EventTarget>::~JSDOMWrapper() 19 0x114258254 WebCore::JSEventTarget::~JSEventTarget() 20 0x1141c97e0 WebCore::JSEventTarget::~JSEventTarget() 21 0x11415ed50 WebCore::JSEventTarget::destroy(JSC::JSCell*) 22 0x134cf0594 JSC::JSDestructibleObjectDestroyFunc::operator()(JSC::VM&, JSC::JSCell*) const 23 0x134d087a0 void JSC::MarkedBlock::Handle::specializedSweep<false, (JSC::MarkedBlock::Handle::EmptyMode)0, (JSC::MarkedBlock::Handle::SweepMode)0, (JSC::MarkedBlock::Handle::SweepDestructionMode)0, (JSC::MarkedBlock::Handle::ScribbleMode)0, (JSC::MarkedBlock::Handle::NewlyAllocatedMode)0, (JSC::MarkedBlock::Handle::MarksMode)0, JSC::JSDestructibleObjectDestroyFunc>(JSC::FreeList*, JSC::MarkedBlock::Handle::EmptyMode, JSC::MarkedBlock::Handle::SweepMode, JSC::MarkedBlock::Handle::SweepDestructionMode, JSC::MarkedBlock::Handle::ScribbleMode, JSC::MarkedBlock::Handle::NewlyAllocatedMode, JSC::MarkedBlock::Handle::MarksMode, JSC::JSDestructibleObjectDestroyFunc const&)::'lambda'(void*)::operator()(void*) const 24 0x134d0880c void JSC::MarkedBlock::Handle::specializedSweep<false, (JSC::MarkedBlock::Handle::EmptyMode)0, (JSC::MarkedBlock::Handle::SweepMode)0, (JSC::MarkedBlock::Handle::SweepDestructionMode)0, (JSC::MarkedBlock::Handle::ScribbleMode)0, (JSC::MarkedBlock::Handle::NewlyAllocatedMode)0, (JSC::MarkedBlock::Handle::MarksMode)0, JSC::JSDestructibleObjectDestroyFunc>(JSC::FreeList*, JSC::MarkedBlock::Handle::EmptyMode, JSC::MarkedBlock::Handle::SweepMode, JSC::MarkedBlock::Handle::SweepDestructionMode, JSC::MarkedBlock::Handle::ScribbleMode, JSC::MarkedBlock::Handle::NewlyAllocatedMode, JSC::MarkedBlock::Handle::MarksMode, JSC::JSDestructibleObjectDestroyFunc const&)::'lambda'(unsigned long)::operator()(unsigned long) const 25 0x134d02248 void JSC::MarkedBlock::Handle::specializedSweep<false, (JSC::MarkedBlock::Handle::EmptyMode)0, (JSC::MarkedBlock::Handle::SweepMode)0, (JSC::MarkedBlock::Handle::SweepDestructionMode)0, (JSC::MarkedBlock::Handle::ScribbleMode)0, (JSC::MarkedBlock::Handle::NewlyAllocatedMode)0, (JSC::MarkedBlock::Handle::MarksMode)0, JSC::JSDestructibleObjectDestroyFunc>(JSC::FreeList*, JSC::MarkedBlock::Handle::EmptyMode, JSC::MarkedBlock::Handle::SweepMode, JSC::MarkedBlock::Handle::SweepDestructionMode, JSC::MarkedBlock::Handle::ScribbleMode, JSC::MarkedBlock::Handle::NewlyAllocatedMode, JSC::MarkedBlock::Handle::MarksMode, JSC::JSDestructibleObjectDestroyFunc const&) 26 0x134cf0528 void JSC::MarkedBlock::Handle::finishSweepKnowingHeapCellType<JSC::JSDestructibleObjectDestroyFunc>(JSC::FreeList*, JSC::JSDestructibleObjectDestroyFunc const&) 27 0x134cf03e8 JSC::JSDestructibleObjectHeapCellType::finishSweep(JSC::MarkedBlock::Handle&, JSC::FreeList*) 28 0x13461e238 JSC::Subspace::finishSweep(JSC::MarkedBlock::Handle&, JSC::FreeList*) 29 0x1345f65d8 JSC::MarkedBlock::Handle::sweep(JSC::FreeList*) 30 0x1345df124 JSC::LocalAllocator::tryAllocateIn(JSC::MarkedBlock::Handle*) 31 0x1345dee6c JSC::LocalAllocator::tryAllocateWithoutCollecting() LEAK: 1 WebPageProxy 1745900 1 jenner 2021-03-31 18:36:37 -0700 I did attempt to reproduce the crash, but I was unable to an Intel Mac. The crashing is v very flakey and rarely occurs. Most recent crashes have been on an Apple silicon Mac. I don't have access to an AS Mac, so I could not attempt to reproduce the crash there. 1745901 2 webkit-bug-importer 2021-03-31 18:36:55 -0700 <rdar://problem/76082151> 1745908 3 jenner 2021-03-31 18:43:48 -0700 Updated test expectations to Pass Crash while test is reviewed here: https://trac.webkit.org/changeset/275335/webkit 1761036 4 428913 rniwa 2021-05-17 22:37:39 -0700 Created attachment 428913 Fixes the bug 1761040 5 428913 mjs 2021-05-17 23:02:36 -0700 Comment on attachment 428913 Fixes the bug r=ne 1761086 6 428913 rniwa 2021-05-18 01:44:55 -0700 Comment on attachment 428913 Fixes the bug Clearing flags on attachment: 428913 Committed r277646 (237852@main): <https://commits.webkit.org/237852@main> 1761087 7 rniwa 2021-05-18 01:44:57 -0700 All reviewed patches have been landed. Closing bug. 428913 2021-05-17 22:37:39 -0700 2021-05-18 01:44:55 -0700 Fixes the bug bug-224033-20210517223738.patch text/plain 4459 rniwa U3VidmVyc2lvbiBSZXZpc2lvbjogMjc3NjQxCmRpZmYgLS1naXQgYS9Tb3VyY2UvV2ViQ29yZS9D aGFuZ2VMb2cgYi9Tb3VyY2UvV2ViQ29yZS9DaGFuZ2VMb2cKaW5kZXggYjE1NDQwNmMyMGU5NTIy MzhjYzE1NTA1ODE2YTZhZGUzOGMyZDQ4Ni4uMTg4ODVkMWYzYWFkNTQ4ODFjMTUzYWY5YWY2MjIx NDBiNzA2YWE0OSAxMDA2NDQKLS0tIGEvU291cmNlL1dlYkNvcmUvQ2hhbmdlTG9nCisrKyBiL1Nv dXJjZS9XZWJDb3JlL0NoYW5nZUxvZwpAQCAtMSwzICsxLDE5IEBACisyMDIxLTA1LTE3ICBSeW9z dWtlIE5pd2EgIDxybml3YUB3ZWJraXQub3JnPgorCisgICAgICAgIEFTU0VSVElPTiBGQUlMRUQ6 IGlzUmVhY3Rpb25BbGxvd2VkKCkgaW4gZW5xdWV1ZURpc2Nvbm5lY3RlZENhbGxiYWNrSWZOZWVk ZWQgZHVyaW5nIGRvY3VtZW50IHRlYXJkb3duCisgICAgICAgIGh0dHBzOi8vYnVncy53ZWJraXQu b3JnL3Nob3dfYnVnLmNnaT9pZD0yMjQwMzMKKworICAgICAgICBSZXZpZXdlZCBieSBOT0JPRFkg KE9PUFMhKS4KKworICAgICAgICBNb3ZlZCB0aGUgYnVnIGFzc2VydGlvbiB0byBhZnRlciBhbiBl YXJseSBleGl0IGZvciB3aGVuIHdlJ3JlIGluIHRoZSBtaWRkbGUgb2YgZGVzdG9yeWluZyB0aGUg ZG9jdW1lbnQuCisKKyAgICAgICAgZW5xdWV1ZURpc2Nvbm5lY3RlZENhbGxiYWNrSWZOZWVkZWQg d2lsbCBiZSBjYWxsZWQgb24gY3VzdG9tIGVsZW1lbnRzIGluIHRoZXNlIGNpcmN1bXN0YW5jZXMK KyAgICAgICAgYnV0IHRoZXJlIGlzIG5vIGNvcnJlY3RuZXNzIGlzc3VlIGhlcmUgc2luY2Ugd2Ug ZXhpdCBlYXJseS4KKworCisgICAgICAgICogZG9tL0N1c3RvbUVsZW1lbnRSZWFjdGlvblF1ZXVl LmNwcDoKKyAgICAgICAgKFdlYkNvcmU6OkN1c3RvbUVsZW1lbnRSZWFjdGlvblF1ZXVlOjplbnF1 ZXVlRGlzY29ubmVjdGVkQ2FsbGJhY2tJZk5lZWRlZCk6CisKIDIwMjEtMDUtMTcgIFNpaHVpIExp dSAgPHNpaHVpX2xpdUBhcHBsZS5jb20+CiAKICAgICAgICAgUmVtb3ZlIFNRTGl0ZVN0YXRlbWVu dDo6aXNDb2x1bW5OdWxsIGFuZCBpdHMgdXNlCmRpZmYgLS1naXQgYS9Tb3VyY2UvV2ViQ29yZS9k b20vQ3VzdG9tRWxlbWVudFJlYWN0aW9uUXVldWUuY3BwIGIvU291cmNlL1dlYkNvcmUvZG9tL0N1 c3RvbUVsZW1lbnRSZWFjdGlvblF1ZXVlLmNwcAppbmRleCA5NDgxNzI4YzI0ZjkxNGRjNWU3ODU5 ODY5YjIxZDQ1MDgxNzNkZmJiLi4wNThjZmExMDZkZjc5ODk3OTgwNTc0MzEyMWI3YzI1MmZiYzg0 ZmYxIDEwMDY0NAotLS0gYS9Tb3VyY2UvV2ViQ29yZS9kb20vQ3VzdG9tRWxlbWVudFJlYWN0aW9u UXVldWUuY3BwCisrKyBiL1NvdXJjZS9XZWJDb3JlL2RvbS9DdXN0b21FbGVtZW50UmVhY3Rpb25R dWV1ZS5jcHAKQEAgLTE3MiwxMCArMTcyLDEwIEBAIHZvaWQgQ3VzdG9tRWxlbWVudFJlYWN0aW9u UXVldWU6OmVucXVldWVDb25uZWN0ZWRDYWxsYmFja0lmTmVlZGVkKEVsZW1lbnQmIGVsZW1lCiAK IHZvaWQgQ3VzdG9tRWxlbWVudFJlYWN0aW9uUXVldWU6OmVucXVldWVEaXNjb25uZWN0ZWRDYWxs YmFja0lmTmVlZGVkKEVsZW1lbnQmIGVsZW1lbnQpCiB7Ci0gICAgQVNTRVJUKEN1c3RvbUVsZW1l bnRSZWFjdGlvbkRpc2FsbG93ZWRTY29wZTo6aXNSZWFjdGlvbkFsbG93ZWQoKSk7CiAgICAgQVNT RVJUKGVsZW1lbnQuaXNEZWZpbmVkQ3VzdG9tRWxlbWVudCgpKTsKICAgICBpZiAoZWxlbWVudC5k b2N1bWVudCgpLnJlZkNvdW50KCkgPD0gMCkKICAgICAgICAgcmV0dXJuOyAvLyBEb24ndCBlbnF1 ZXVlIGRpc2Nvbm5lY3RlZENhbGxiYWNrIGlmIHRoZSBlbnRpcmUgZG9jdW1lbnQgaXMgZ2V0dGlu ZyBkZXN0cnVjdGVkLgorICAgIEFTU0VSVChDdXN0b21FbGVtZW50UmVhY3Rpb25EaXNhbGxvd2Vk U2NvcGU6OmlzUmVhY3Rpb25BbGxvd2VkKCkpOwogICAgIEFTU0VSVChlbGVtZW50LnJlYWN0aW9u UXVldWUoKSk7CiAgICAgYXV0byYgcXVldWUgPSAqZWxlbWVudC5yZWFjdGlvblF1ZXVlKCk7CiAg ICAgaWYgKCFxdWV1ZS5tX2ludGVyZmFjZS0+aGFzRGlzY29ubmVjdGVkQ2FsbGJhY2soKSkKZGlm ZiAtLWdpdCBhL0xheW91dFRlc3RzL0NoYW5nZUxvZyBiL0xheW91dFRlc3RzL0NoYW5nZUxvZwpp bmRleCA1YzA4MmQ0NzQyYTE0MTY4YjNjMTEwMmRkYWE0ODc0NTMwMjA1NzQ5Li4zNGM0YmIyNGFl ZjA0ZjM0ZjQ4YjczNDMyOTMyOGRlZTc0YTliYjEzIDEwMDY0NAotLS0gYS9MYXlvdXRUZXN0cy9D aGFuZ2VMb2cKKysrIGIvTGF5b3V0VGVzdHMvQ2hhbmdlTG9nCkBAIC0xLDMgKzEsMTUgQEAKKzIw MjEtMDUtMTcgIFJ5b3N1a2UgTml3YSAgPHJuaXdhQHdlYmtpdC5vcmc+CisKKyAgICAgICAgQVNT RVJUSU9OIEZBSUxFRDogaXNSZWFjdGlvbkFsbG93ZWQoKSBpbiBlbnF1ZXVlRGlzY29ubmVjdGVk Q2FsbGJhY2tJZk5lZWRlZCBkdXJpbmcgZG9jdW1lbnQgdGVhcmRvd24KKyAgICAgICAgaHR0cHM6 Ly9idWdzLndlYmtpdC5vcmcvc2hvd19idWcuY2dpP2lkPTIyNDAzMworCisgICAgICAgIFJldmll d2VkIGJ5IE5PQk9EWSAoT09QUyEpLgorCisgICAgICAgIFJlbW92ZWQgZmxha3kgdGVzdCBleHBl Y3RhdGlvbi4KKworICAgICAgICAqIHBsYXRmb3JtL2lvcy1zaW11bGF0b3IvVGVzdEV4cGVjdGF0 aW9uczoKKyAgICAgICAgKiBwbGF0Zm9ybS9tYWMvVGVzdEV4cGVjdGF0aW9uczoKKwogMjAyMS0w NS0xNyAgTGF1cm8gTW91cmEgIDxsbW91cmFAaWdhbGlhLmNvbT4KIAogICAgICAgICBbR0xJQl0g R2FyZGVuIGEgZmV3IHRlc3RzIGFuZCB1bmlmeSBzb21lIGV4cGVjdGF0aW9ucwpkaWZmIC0tZ2l0 IGEvTGF5b3V0VGVzdHMvcGxhdGZvcm0vaW9zLXNpbXVsYXRvci9UZXN0RXhwZWN0YXRpb25zIGIv TGF5b3V0VGVzdHMvcGxhdGZvcm0vaW9zLXNpbXVsYXRvci9UZXN0RXhwZWN0YXRpb25zCmluZGV4 IDIzZmEwNjI2Yjk4M2U2ZGI2OTExNjRmMmM2MWIyMTFlMDc4MjBlYzAuLmI3MTdmM2RiZjAzYzdl Y2VjZDE0NWExYjIwM2IxMzY0ZDAwNmRlNWYgMTAwNjQ0Ci0tLSBhL0xheW91dFRlc3RzL3BsYXRm b3JtL2lvcy1zaW11bGF0b3IvVGVzdEV4cGVjdGF0aW9ucworKysgYi9MYXlvdXRUZXN0cy9wbGF0 Zm9ybS9pb3Mtc2ltdWxhdG9yL1Rlc3RFeHBlY3RhdGlvbnMKQEAgLTExOCw2ICsxMTgsNCBAQCB3 ZWJncHUgWyBTa2lwIF0KIGh0dHAvdGVzdHMvc2VjdXJpdHkvd2ViYXVkaW8tcmVuZGVyLXJlbW90 ZS1hdWRpby1hbGxvd2VkLWNyb3Nzb3JpZ2luLmh0bWwgWyBQYXNzIFRpbWVvdXQgXQogaHR0cC90 ZXN0cy9zZWN1cml0eS93ZWJhdWRpby1yZW5kZXItcmVtb3RlLWF1ZGlvLWFsbG93ZWQtY3Jvc3Nv cmlnaW4tcmVkaXJlY3QuaHRtbCBbIFBhc3MgVGltZW91dCBdCiAKLXdlYmtpdC5vcmcvYi8yMjQw MzMgaW1wb3J0ZWQvdzNjL3dlYi1wbGF0Zm9ybS10ZXN0cy9jdXN0b20tZWxlbWVudHMvcmVhY3Rp b25zL0hUTUxNZWRpYUVsZW1lbnQuaHRtbCBbIFBhc3MgQ3Jhc2ggXQotCiB3ZWJraXQub3JnL2Iv MjIzOTQ5IGNyeXB0by9jcnlwdG8tcmFuZG9tLXZhbHVlcy1vb20uaHRtbCBbIFNsb3cgXQpcIE5v IG5ld2xpbmUgYXQgZW5kIG9mIGZpbGUKZGlmZiAtLWdpdCBhL0xheW91dFRlc3RzL3BsYXRmb3Jt L21hYy9UZXN0RXhwZWN0YXRpb25zIGIvTGF5b3V0VGVzdHMvcGxhdGZvcm0vbWFjL1Rlc3RFeHBl Y3RhdGlvbnMKaW5kZXggZWVkODQ0YWM5MjNiZDkzNjIwNjVmMTlhN2U5ZTdkOGY2ZjUwZWZiNi4u MGE3ZGExNjZhYzU3MDEyMzQyZThlOTcxNmUzYjFkMzY5YmYxOTY4ZSAxMDA2NDQKLS0tIGEvTGF5 b3V0VGVzdHMvcGxhdGZvcm0vbWFjL1Rlc3RFeHBlY3RhdGlvbnMKKysrIGIvTGF5b3V0VGVzdHMv cGxhdGZvcm0vbWFjL1Rlc3RFeHBlY3RhdGlvbnMKQEAgLTIyMzUsOCArMjIzNSw2IEBAIHdlYmtp dC5vcmcvYi8yMjA3NTQgaHR0cC93cHQvc2VydmljZS13b3JrZXJzL3NlcnZpY2Utd29ya2VyLXNw aW5uaW5nLWFjdGl2YXRlLmh0CiAKIHdlYmtpdC5vcmcvYi8yMjM5NzYgWyBEZWJ1ZyBdIGltcG9y dGVkL3czYy93ZWItcGxhdGZvcm0tdGVzdHMvY29ycy9yZWRpcmVjdC1wcmVmbGlnaHQuaHRtIFsg UGFzcyBGYWlsdXJlIF0KIAotd2Via2l0Lm9yZy9iLzIyNDAzMyBpbXBvcnRlZC93M2Mvd2ViLXBs YXRmb3JtLXRlc3RzL2N1c3RvbS1lbGVtZW50cy9yZWFjdGlvbnMvSFRNTE1lZGlhRWxlbWVudC5o dG1sIFsgUGFzcyBDcmFzaCBdCi0KIHdlYmtpdC5vcmcvYi8yMjQxMjMgbWVkaWEvbW9kZXJuLW1l ZGlhLWNvbnRyb2xzL21hY29zLWlubGluZS1tZWRpYS1jb250cm9scy9tYWNvcy1pbmxpbmUtbWVk aWEtZHJvcHBpbmctY29udHJvbHMuaHRtbCBbIFBhc3MgRmFpbHVyZSBdCiAKIHdlYmtpdC5vcmcv Yi8yMjQyMTIgWyBhcm02NCBdIGNvbXBvc2l0aW5nL2JhY2tncm91bmQtY29sb3Ivbm8tY29tcG9z aXRlZC1iYWNrZ3JvdW5kLWNvbG9yLXdoZW4tcGVyc3BlY3RpdmUuaHRtbCBbIFBhc3MgSW1hZ2VP bmx5RmFpbHVyZSBdCg==