59552 2011-04-26 15:58:45 -0700 ASSERTION FAILED: fontCache()->generation() == m_generation (running new-run-webkit-tests) 2012-02-05 14:06:18 -0800 1 1 1 Unclassified WebKit Layout and Rendering 528+ (Nightly build) Mac All RESOLVED FIXED P2 Normal --- 1 ggaren mitz abarth adamk ggaren hyatt johnnyg morrita ojan pkasting steveblock tony tonyg yutak oldest_to_newest 392900 0 ggaren 2011-04-26 15:58:45 -0700 This seems like a real bug, and not an artifact of new-run-webkit-tests, even though new-run-webkit-tests is essential to reproducing it reliably. * STEPS TO REPRODUCE: new-run-webkit-tests --child-processes=32 --experimental-fully-parallel ietestcenter inspector java ASSERTION FAILED: fontCache()->generation() == m_generation /Volumes/Big/ggaren/webkit/Source/WebCore/platform/graphics/FontFallbackList.cpp(104) : const WebCore::FontData* WebCore::FontFallbackList::fontDataAt(const WebCore::Font*, unsigned int) const 1 WebCore::FontFallbackList::fontDataAt(WebCore::Font const*, unsigned int) const 2 WebCore::FontFallbackList::primaryFontData(WebCore::Font const*) const 3 WebCore::FontFallbackList::primarySimpleFontData(WebCore::Font const*) 4 WebCore::Font::primaryFont() const 5 WebCore::Font::fontMetrics() const 6 WebCore::RenderInline::culledInlineBoundingBox(WebCore::RenderInline const*) const 7 WebCore::RenderInline::culledInlineBoundingBox(WebCore::RenderInline const*) const 8 WebCore::RenderInline::culledInlineVisualOverflowBoundingBox() const 9 WebCore::RenderInline::linesVisualOverflowBoundingBox() const 10 WebCore::RenderInline::clippedOverflowRectForRepaint(WebCore::RenderBoxModelObject*) 11 WebCore::RenderText::clippedOverflowRectForRepaint(WebCore::RenderBoxModelObject*) 12 WebCore::RenderObject::repaint(bool) 13 WebCore::RenderObjectChildList::removeChildNode(WebCore::RenderObject*, WebCore::RenderObject*, bool) 14 WebCore::RenderObject::removeChild(WebCore::RenderObject*) 15 WebCore::RenderObject::remove() 16 WebCore::RenderObject::destroy() 17 WebCore::RenderText::destroy() 18 WebCore::Node::detach() 19 WebCore::ContainerNode::detach() 20 WebCore::Element::detach() 21 WebCore::ContainerNode::detach() 22 WebCore::Element::detach() 23 WebCore::ContainerNode::removeChildren() 24 WebCore::replaceChildrenWithFragment(WebCore::HTMLElement*, WTF::PassRefPtr<WebCore::DocumentFragment>, int&) 25 WebCore::HTMLElement::setInnerHTML(WTF::String const&, int&) 26 WebCore::setJSHTMLElementInnerHTML(JSC::ExecState*, JSC::JSObject*, JSC::JSValue) 27 bool JSC::lookupPut<WebCore::JSHTMLElement>(JSC::ExecState*, JSC::Identifier const&, JSC::JSValue, JSC::HashTable const*, WebCore::JSHTMLElement*) 28 void JSC::lookupPut<WebCore::JSHTMLElement, WebCore::JSElement>(JSC::ExecState*, JSC::Identifier const&, JSC::JSValue, JSC::HashTable const*, WebCore::JSHTMLElement*, JSC::PutPropertySlot&) 29 WebCore::JSHTMLElement::put(JSC::ExecState*, JSC::Identifier const&, JSC::JSValue, JSC::PutPropertySlot&) 30 void JSC::lookupPut<WebCore::JSHTMLLIElement, WebCore::JSHTMLElement>(JSC::ExecState*, JSC::Identifier const&, JSC::JSValue, JSC::HashTable const*, WebCore::JSHTMLLIElement*, JSC::PutPropertySlot&) 31 WebCore::JSHTMLLIElement::put(JSC::ExecState*, JSC::Identifier const&, JSC::JSValue, JSC::PutPropertySlot&) 392905 1 ggaren 2011-04-26 15:59:36 -0700 BTW, I did this on my Mac Pro. On a less powerful computer, you may need to scale down --child-processes. 392928 2 mitz 2011-04-26 16:07:42 -0700 Hyatt, is it new that we access font data as part of destroying a renderer? Sometimes we have stale font data in the render tree and we are counting on the ability to purge it by doing a forced style recalc, and not touching it before or during the style recalc. 497027 3 yutak 2011-11-07 02:07:40 -0800 *** Bug 60344 has been marked as a duplicate of this bug. *** 497029 4 yutak 2011-11-07 02:08:19 -0800 *** Bug 67031 has been marked as a duplicate of this bug. *** 497031 5 yutak 2011-11-07 02:08:40 -0800 *** Bug 71139 has been marked as a duplicate of this bug. *** 497033 6 yutak 2011-11-07 02:08:59 -0800 *** Bug 71083 has been marked as a duplicate of this bug. *** 497037 7 yutak 2011-11-07 02:21:07 -0800 Apparently this assertion failure happens intermittently on Chromium Mac bots. Here's a dashboard link showing frequency of this assertion failure: http://test-results.appspot.com/dashboards/flakiness_dashboard.html#showAllRuns=true&tests=fast%2Fcss%2Fcounters%2Fcomplex-before.html%2Cstorage%2Fdomstorage%2Fevents%2Fbasic-body-attribute.html%2Cfast%2Fdom%2FElement%2Fid-in-frame.html%2Chttp%2Ftests%2Fsecurity%2Fcross-frame-access-custom.html%2Cfast%2Fframes%2Fcontent-opacity-2.html%2Cfast%2Fparser%2Fclose-while-stopping.html%2Cfast%2Fframes%2Fsandboxed-iframe-navigation-targetlink.html%2Cfast%2Fframes%2Fiframe-double-scale-contents.html (orange bit is a crash) Some findings: - This failure happens only on SnowLeopard. Leopard seems fine. - This failure does not have something to do with CoreGraphics/Skia separation. 497552 8 tony 2011-11-07 15:57:35 -0800 Also seen in fast/frames/sandboxed-iframe-noscript.html and fast/frames/sandboxed-iframe-navigation-targetlink.html . http://test-results.appspot.com/dashboards/flakiness_dashboard.html#tests=fast%2Fframes%2Fsandboxed-iframe-noscript.html%2Cfast%2Fframes%2Fsandboxed-iframe-navigation-targetlink.html&showExpectations=true 501764 9 114909 tonyg 2011-11-14 03:14:21 -0800 Created attachment 114909 Patch 501765 10 tonyg 2011-11-14 03:15:19 -0800 Committed r100120: <http://trac.webkit.org/changeset/100120> 501766 11 tonyg 2011-11-14 03:16:36 -0800 Expected cross-frame-access-custom.html to crash. Example log: http://test-results.appspot.com/dashboards/flakiness_dashboard.html#showExpectations=true&tests=http%2Ftests%2Fsecurity%2Fcross-frame-access-custom.html 503342 12 pkasting 2011-11-15 15:19:42 -0800 *** Bug 72052 has been marked as a duplicate of this bug. *** 503344 13 pkasting 2011-11-15 15:20:35 -0800 Also now occurring in fast/dom/image-object.html (see e.g. http://build.chromium.org/p/chromium.webkit/builders/Webkit%20Mac10.6%20%28dbg%29/builds/6281/steps/webkit_tests/logs/stdio ). 504828 14 steveblock 2011-11-17 07:00:39 -0800 Also seen in fast/frames/frame-unload-crash.html - http://build.chromium.org/p/chromium.webkit/builders/Webkit%20Mac10.6%20(dbg)/builds/6313/steps/webkit_tests/logs/stdio. Will add CRASH expectation. 504829 15 steveblock 2011-11-17 07:06:17 -0800 Committed r100620: <http://trac.webkit.org/changeset/100620> 504920 16 steveblock 2011-11-17 09:39:20 -0800 Also seen in fast/dom/null-document-location-put-crash.html - http://build.chromium.org/p/chromium.webkit/waterfall?builder=Webkit+Mac10.6+(dbg) Will add CRASH expectation. 504922 17 steveblock 2011-11-17 09:40:50 -0800 Committed r100639: <http://trac.webkit.org/changeset/100639> 505857 18 steveblock 2011-11-18 09:28:52 -0800 Also seen in fast/frames/sandboxed-iframe-parsing-space-characters.html - http://build.chromium.org/p/chromium.webkit/waterfall?builder=Webkit+Mac10.6+(dbg) 505859 19 steveblock 2011-11-18 09:35:01 -0800 Committed r100784: <http://trac.webkit.org/changeset/100784> 505883 20 adamk 2011-11-18 10:24:11 -0800 Committed r100788: <http://trac.webkit.org/changeset/100788> 505884 21 adamk 2011-11-18 10:24:58 -0800 Accidentally closed by webkit-patch 506844 22 steveblock 2011-11-21 03:55:34 -0800 Also seen in jquery/offset.html - http://build.chromium.org/p/chromium.webkit/builders/Webkit%20Mac10.6%20%28CG%29%28dbg%29/builds/1692 506852 23 steveblock 2011-11-21 04:04:57 -0800 Committed r100897: <http://trac.webkit.org/changeset/100897> 549612 24 abarth 2012-02-05 14:06:18 -0800 Seems to be fixed? 114909 2011-11-14 03:14:21 -0800 2011-11-14 03:14:21 -0800 Patch bug-59552-20111114111419.patch text/plain 1435 tonyg U3VidmVyc2lvbiBSZXZpc2lvbjogMTAwMTE5CmRpZmYgLS1naXQgYS9MYXlvdXRUZXN0cy9DaGFu Z2VMb2cgYi9MYXlvdXRUZXN0cy9DaGFuZ2VMb2cKaW5kZXggMGQzYzAwMjcyMDcwZjVlZThiY2Mx MzAzMjdiYWQ4ODhkNzczYWU5Yi4uMWRkNDYzMTIyZjIyMDdiOWU3YzliODYzMmY4MmVkOWJmYWQ5 Y2MyNSAxMDA2NDQKLS0tIGEvTGF5b3V0VGVzdHMvQ2hhbmdlTG9nCisrKyBiL0xheW91dFRlc3Rz L0NoYW5nZUxvZwpAQCAtMSwzICsxLDEwIEBACisyMDExLTExLTE0ICBUb255IEdlbnRpbGNvcmUg IDx0b255Z0BjaHJvbWl1bS5vcmc+CisKKyAgICAgICAgQVNTRVJUSU9OIEZBSUxFRDogZm9udENh Y2hlKCktPmdlbmVyYXRpb24oKSA9PSBtX2dlbmVyYXRpb24gKHJ1bm5pbmcgbmV3LXJ1bi13ZWJr aXQtdGVzdHMpCisgICAgICAgIGh0dHBzOi8vYnVncy53ZWJraXQub3JnL3Nob3dfYnVnLmNnaT9p ZD01OTU1MgorCisgICAgICAgICogcGxhdGZvcm0vY2hyb21pdW0vdGVzdF9leHBlY3RhdGlvbnMu dHh0OiBFeHBlY3QgY3Jvc3MtZnJhbWUtYWNjZXNzLWN1c3RvbS5odG1sIHRvIENSQVNIIG9yIFBB U1MuCisKIDIwMTEtMTEtMTAgIFl1cnkgU2VtaWtoYXRza3kgIDx5dXJ5c0BjaHJvbWl1bS5vcmc+ CiAKICAgICAgICAgV2ViIEluc3BlY3RvcjogZnVuY3Rpb24gcmVtb3RlIG9iamV0Y3Qgc2hvdWxk IHByb3ZpZGUgYWNjZXNzIHRvIGZ1bmN0aW9uIHBvc2l0aW9uIGluIHRoZSBzY3JpcHQKZGlmZiAt LWdpdCBhL0xheW91dFRlc3RzL3BsYXRmb3JtL2Nocm9taXVtL3Rlc3RfZXhwZWN0YXRpb25zLnR4 dCBiL0xheW91dFRlc3RzL3BsYXRmb3JtL2Nocm9taXVtL3Rlc3RfZXhwZWN0YXRpb25zLnR4dApp bmRleCA2MjQ2ZDBlYzM4YWZiYjRhY2ZkZDIwYjA4YTUxYWRhY2RlMDI2MGJmLi4wOGViYTQ5ZTI2 NTFkMWRkMzAzYmI4Y2RlOWMxOTcwOTlmNmIxMjk1IDEwMDY0NAotLS0gYS9MYXlvdXRUZXN0cy9w bGF0Zm9ybS9jaHJvbWl1bS90ZXN0X2V4cGVjdGF0aW9ucy50eHQKKysrIGIvTGF5b3V0VGVzdHMv cGxhdGZvcm0vY2hyb21pdW0vdGVzdF9leHBlY3RhdGlvbnMudHh0CkBAIC0zODg1LDMgKzM4ODUs NSBAQCBCVUdXSzcyMTQ5IDogbWVkaWEvdHJhY2svdHJhY2tsaXN0LWlzLXJlYWNoYWJsZS5odG1s ID0gVEVYVAogCiBCVUdWOF8xODIxIFdJTiBMSU5VWCA6IGh0dHAvdGVzdHMvaW5zcGVjdG9yLWVu YWJsZWQvZGVkaWNhdGVkLXdvcmtlcnMtbGlzdC5odG1sID0gUEFTUyBDUkFTSAogQlVHV0s3MjEz MyBTS0lQIE1BQyA6IGh0dHAvdGVzdHMvaW5zcGVjdG9yLWVuYWJsZWQvZGVkaWNhdGVkLXdvcmtl cnMtbGlzdC5odG1sID0gUEFTUyBDUkFTSCBUSU1FT1VUCisKK0JVR1dLNTk1NTIgTUFDIERFQlVH IDogaHR0cC90ZXN0cy9zZWN1cml0eS9jcm9zcy1mcmFtZS1hY2Nlc3MtY3VzdG9tLmh0bWwgPSBQ QVNTIENSQVNICg==