63127 2011-06-22 03:55:08 -0700 DatabaseTask synchronization error 2011-06-23 01:59:27 -0700 1 1 1 Unclassified WebKit New Bugs 528+ (Nightly build) All All RESOLVED FIXED P2 Normal --- 0 dvyukov webkit-unassigned dimich dslomov levin webkit.review.bot oldest_to_newest 425128 0 dvyukov 2011-06-22 03:55:08 -0700 The problem is with Source/WebCore/storage/DatabaseTask.cpp void DatabaseTaskSynchronizer::waitForTaskCompletion() { m_synchronousMutex.lock(); if (!m_taskCompleted) m_synchronousCondition.wait(m_synchronousMutex); m_synchronousMutex.unlock(); } Since POSIX condition variables are amenable to spurious wake-ups, waits must always be expressed as loops. Current implementation leads to premature returns from waitForTaskCompletion() and subsequent bad memory/stack corruptions. I observe crashes like: Program terminated with signal 11, Segmentation fault. #0 0x0000000002452d10 in WTF::RefPtr<WebCore::CSSRuleList>::RefPtr<WebCore::CSSRuleList> (this=0x0, o=<value optimized out>) at third_party/WebKit/Source/JavaScriptCore/wtf/RefPtr.h:94 94 : m_ptr(o.leakRef()) (gdb) bt #0 0x0000000002452d10 in WTF::RefPtr<WebCore::CSSRuleList>::RefPtr<WebCore::CSSRuleList> (this=0x0, o=<value optimized out>) at third_party/WebKit/Source/JavaScriptCore/wtf/RefPtr.h:94 #1 0x000000000283edd1 in append<WTF::PassRefPtr<WebCore::CSSRuleList> > (this=0x7fff75788480) at third_party/WebKit/Source/JavaScriptCore/wtf/Vector.h:992 #2 WebCore::CSSParser::createRuleList (this=0x7fff75788480) at third_party/WebKit/Source/WebCore/css/CSSParser.cpp:6316 #3 0x0000000003d3aebe in cssyyparse (parser=0x7fff75788480) at /usr/local/google/home/dvyukov/chrome/src/third_party/WebKit/Source/WebCore/css/CSSGrammar.y:430 #4 0x000000000282aa4d in WebCore::CSSParser::parseSheet (this=0x7fff75788480, sheet=0x969efe0, string=..., startLineNumber=0, ruleRangeMap=0x0) at third_party/WebKit/Source/WebCore/css/CSSParser.cpp:266 #5 0x00000000028b4c74 in WebCore::CSSStyleSheet::parseStringAtLine (this=0x969efe0, string=..., strict=true, startLineNumber=0) at third_party/WebKit/Source/WebCore/css/CSSStyleSheet.cpp:204 #6 0x0000000003ec23ff in WebCore::StyleElement::createSheet (this=0x7f765d52f868, e=0x7f765d52f7f0, startLineNumber=0, text=...) at third_party/WebKit/Source/WebCore/dom/StyleElement.cpp:157 #7 0x0000000003ec28d8 in WebCore::StyleElement::process (this=0x7f765d52f868, e=0x7f765d52f7f0) at third_party/WebKit/Source/WebCore/dom/StyleElement.cpp:133 #8 0x0000000003ec2ac8 in WebCore::StyleElement::insertedIntoDocument (this=0x7f765d52f868, document=0x6883310, element=0x7f765d52f7f0) at third_party/WebKit/Source/WebCore/dom/StyleElement.cpp:67 #9 0x0000000003d13fd5 in WebCore::HTMLStyleElement::insertedIntoDocument (this=0x7f765d52f7f0) at third_party/WebKit/Source/WebCore/html/HTMLStyleElement.cpp:75 #10 0x00000000028e8fa0 in WebCore::notifyChildInserted (child=0xb5d52f7f0) at third_party/WebKit/Source/WebCore/dom/ContainerNode.cpp:1066 #11 0x00000000028eba98 in WebCore::ContainerNode::appendChild (this=0x6892900, newChild=<value optimized out>, ec=@0x7fff757889ac, shouldLazyAttach=true) at third_party/WebKit/Source/WebCore/dom/ContainerNode.cpp:645 #12 0x00000000029725de in WebCore::Node::appendChild (this=0x6892900, newChild=..., ec=@0x7fff757889ac, shouldLazyAttach=true) at third_party/WebKit/Source/WebCore/dom/Node.cpp:668 #13 0x00000000027d36a8 in WebCore::V8Node::appendChildCallback (args=...) at third_party/WebKit/Source/WebCore/bindings/v8/custom/V8NodeCustom.cpp:124 #14 0x0000000001bb55c3 in v8::internal::HandleApiCallHelper<false> (args=..., isolate=0x67da280) at v8/src/builtins.cc:1105 #15 0x0000000001bb5745 in v8::internal::Builtin_HandleApiCall (args=..., isolate=0x67da280) at v8/src/builtins.cc:1122 There are a lot of similar crashes in the crash database, but due to the nature of the bug it's difficult to match them. In order to fix it, replace 'if' with 'while'. Btw, the bug is found with GCC-ThreadSanitizer which forces such bugs to occur more frequently. Below are usage instructions for GCC-ThreadSanitizer if you are interested: http://code.google.com/p/data-race-test/wiki/GccInstrumentation 425129 1 98151 dvyukov 2011-06-22 03:58:03 -0700 Created attachment 98151 Proposed patch 425453 2 dslomov 2011-06-22 12:15:45 -0700 (In reply to comment #1) > Created an attachment (id=98151) [details] > Proposed patch Patch looks good to me. 425454 3 98151 levin 2011-06-22 12:17:44 -0700 Comment on attachment 98151 Proposed patch Nice fix. This needs a changelog before it can go in. Please read the info at http://www.webkit.org/coding/contributing.html#changelogs Thanks! 426018 4 98322 dvyukov 2011-06-23 01:47:17 -0700 Created attachment 98322 Proposed patch 426019 5 dvyukov 2011-06-23 01:47:52 -0700 PTAL 426022 6 98322 levin 2011-06-23 01:49:41 -0700 Comment on attachment 98322 Proposed patch Actually a statement about how it isn't testable (or how it is covered by existing tests) would have been better for the ChangeLog, but ok. Thanks! 426031 7 98322 webkit.review.bot 2011-06-23 01:59:22 -0700 Comment on attachment 98322 Proposed patch Clearing flags on attachment: 98322 Committed r89544: <http://trac.webkit.org/changeset/89544> 426032 8 webkit.review.bot 2011-06-23 01:59:27 -0700 All reviewed patches have been landed. Closing bug. 98151 2011-06-22 03:58:03 -0700 2011-06-23 01:47:17 -0700 Proposed patch patch text/plain 537 dvyukov SW5kZXg6IFNvdXJjZS9XZWJDb3JlL3N0b3JhZ2UvRGF0YWJhc2VUYXNrLmNwcAo9PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 Ci0tLSBTb3VyY2UvV2ViQ29yZS9zdG9yYWdlL0RhdGFiYXNlVGFzay5jcHAJKHJldmlzaW9uIDg4 ODAxKQorKysgU291cmNlL1dlYkNvcmUvc3RvcmFnZS9EYXRhYmFzZVRhc2suY3BwCSh3b3JraW5n IGNvcHkpCkBAIC00Niw3ICs0Niw3IEBAIERhdGFiYXNlVGFza1N5bmNocm9uaXplcjo6RGF0YWJh c2VUYXNrU3kKIHZvaWQgRGF0YWJhc2VUYXNrU3luY2hyb25pemVyOjp3YWl0Rm9yVGFza0NvbXBs ZXRpb24oKQogewogICAgIG1fc3luY2hyb25vdXNNdXRleC5sb2NrKCk7Ci0gICAgaWYgKCFtX3Rh c2tDb21wbGV0ZWQpCisgICAgd2hpbGUgKCFtX3Rhc2tDb21wbGV0ZWQpCiAgICAgICAgIG1fc3lu Y2hyb25vdXNDb25kaXRpb24ud2FpdChtX3N5bmNocm9ub3VzTXV0ZXgpOwogICAgIG1fc3luY2hy b25vdXNNdXRleC51bmxvY2soKTsKIH0K 98322 2011-06-23 01:47:17 -0700 2011-06-23 01:59:22 -0700 Proposed patch patch text/plain 1219 dvyukov SW5kZXg6IFNvdXJjZS9XZWJDb3JlL0NoYW5nZUxvZwo9PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09Ci0tLSBTb3VyY2UvV2Vi Q29yZS9DaGFuZ2VMb2cJKHJldmlzaW9uIDg5NTQzKQorKysgU291cmNlL1dlYkNvcmUvQ2hhbmdl TG9nCSh3b3JraW5nIGNvcHkpCkBAIC0xLDMgKzEsMTYgQEAKKzIwMTEtMDYtMjMgIERtaXRyaXkg Vnl1a292ICA8ZHZ5dWtvdkBnb29nbGUuY29tPgorCisgICAgICAgIFJldmlld2VkIGJ5IE5PQk9E WSAoT09QUyEpLgorCisgICAgICAgIEZpeCBpbmNvcnJlY3QgdXNhZ2Ugb2YgYSBjb25kaXRpb24g dmFyaWFibGUuCisgICAgICAgIGh0dHBzOi8vYnVncy53ZWJraXQub3JnL3Nob3dfYnVnLmNnaT9p ZD02MzEyNworCisgICAgICAgIE5vIG5ldyB0ZXN0cy4gVGhpcyBkb2VzIG5vdCBhZmZlY3QgZXhp c3RpbmcKKyAgICAgICAgZnVuY3Rpb25hbGl0eS4KKworICAgICAgICAqIHN0b3JhZ2UvRGF0YWJh c2VUYXNrLmNwcDoKKyAgICAgICAgKFdlYkNvcmU6OkRhdGFiYXNlVGFza1N5bmNocm9uaXplcjo6 d2FpdEZvclRhc2tDb21wbGV0aW9uKToKKwogMjAxMS0wNi0yMyAgRGF2aWQgR3JvZ2FuICA8ZGdy b2dhbkBjaHJvbWl1bS5vcmc+CiAKICAgICAgICAgUmV2aWV3ZWQgYnkgRXJpYyBTZWlkZWwuCklu ZGV4OiBTb3VyY2UvV2ViQ29yZS9zdG9yYWdlL0RhdGFiYXNlVGFzay5jcHAKPT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PQot LS0gU291cmNlL1dlYkNvcmUvc3RvcmFnZS9EYXRhYmFzZVRhc2suY3BwCShyZXZpc2lvbiA4OTQx NykKKysrIFNvdXJjZS9XZWJDb3JlL3N0b3JhZ2UvRGF0YWJhc2VUYXNrLmNwcAkod29ya2luZyBj b3B5KQpAQCAtNDYsNyArNDYsNyBAQCBEYXRhYmFzZVRhc2tTeW5jaHJvbml6ZXI6OkRhdGFiYXNl VGFza1N5CiB2b2lkIERhdGFiYXNlVGFza1N5bmNocm9uaXplcjo6d2FpdEZvclRhc2tDb21wbGV0 aW9uKCkKIHsKICAgICBtX3N5bmNocm9ub3VzTXV0ZXgubG9jaygpOwotICAgIGlmICghbV90YXNr Q29tcGxldGVkKQorICAgIHdoaWxlICghbV90YXNrQ29tcGxldGVkKQogICAgICAgICBtX3N5bmNo cm9ub3VzQ29uZGl0aW9uLndhaXQobV9zeW5jaHJvbm91c011dGV4KTsKICAgICBtX3N5bmNocm9u b3VzTXV0ZXgudW5sb2NrKCk7CiB9Cg==