86715 2012-05-17 01:43:39 -0700 [Chromium] REGRESSION: Assertion failure on svg/custom/acid3-test-77.html 2012-05-21 09:11:33 -0700 1 1 1 Unclassified WebKit SVG 528+ (Nightly build) Unspecified Unspecified RESOLVED FIXED P2 Normal --- 1 morrita schenney mitz pdr schenney thorton webkit.review.bot zimmermann oldest_to_newest 626377 0 morrita 2012-05-17 01:43:39 -0700 http://test-results.appspot.com/dashboards/flakiness_dashboard.html#tests=svg%2Fcustom%2Facid3-test-77.html Culprit is: http://trac.webkit.org/changeset/105057 Note that this doesn't crash on Apple Mac. I didn't revert the original change since it also fixed another problem... Here is a stacktrace: ---- 00:33:18.801 14746 ASSERTION FAILED: m_purgePreventCount 00:33:18.801 14746 third_party/WebKit/Source/WebCore/platform/graphics/FontCache.cpp(280) : WebCore::SimpleFontData* WebCore::FontCache::getCachedFontData(const WebCore::FontPlatformData*, WebCore::FontCache::ShouldRetain) ... 00:33:18.804 14746 [15999:15999:4617000855690:ERROR:process_util_posix.cc(143)] Received signal 11 00:33:18.804 14746 base::debug::StackTrace::StackTrace() [0x8625be] 00:33:18.804 14746 base::(anonymous namespace)::StackDumpSignalHandler() [0x822729] 00:33:18.804 14746 0x7f0333922af0 00:33:18.804 14746 WebCore::FontCache::getCachedFontData() [0x1103fcc] 00:33:18.804 14746 WebCore::FontCache::getFontDataForCharacters() [0x11d2f2c] 00:33:18.804 14746 WebCore::Font::glyphDataAndPageForCharacter() [0x1112631] 00:33:18.804 14746 WebCore::Font::glyphDataForCharacter() [0x1111c34] 00:33:18.805 14746 WebCore::WidthIterator::glyphDataForCharacter() [0x11491d8] 00:33:18.805 14746 WebCore::WidthIterator::advance() [0x114942c] 00:33:18.805 14746 WebCore::SVGTextMetricsBuilder::advanceSimpleText() [0x1daf29a] 00:33:18.805 14746 WebCore::SVGTextMetricsBuilder::advance() [0x1daf239] 00:33:18.805 14746 WebCore::SVGTextMetricsBuilder::measureTextRenderer() [0x1dafb70] 00:33:18.805 14746 WebCore::SVGTextMetricsBuilder::walkTree() [0x1dafc80] 00:33:18.805 14746 WebCore::SVGTextMetricsBuilder::buildMetricsAndLayoutAttributes() [0x1dafe1b] 00:33:18.805 14746 WebCore::SVGTextLayoutAttributesBuilder::buildLayoutAttributesForTextRenderer() [0x1da836b] 00:33:18.805 14746 WebCore::RenderSVGText::subtreeChildWasAdded() [0x1d8a53d] 00:33:18.805 14746 WebCore::RenderSVGText::addChild() [0x1d8c020] 00:33:18.805 14746 WebCore::NodeRendererFactory::createRendererIfNeeded() [0x774be0] 00:33:18.805 14746 WebCore::Node::createRendererIfNeeded() [0x7563c1] 00:33:18.806 14746 WebCore::Text::attach() [0x7a709a] 00:33:18.806 14746 WebCore::updateTreeAfterInsertion() [0x6c255d] 00:33:18.806 14746 WebCore::ContainerNode::appendChild() [0x6c05cd] 00:33:18.806 14746 WebCore::Node::setTextContent() [0x758919] 00:33:18.806 14746 WebCore::NodeV8Internal::textContentAttrSetter() [0x1cd152c] 00:33:18.806 14746 v8::internal::JSObject::SetPropertyWithCallback() [0xc82ba7] 00:33:18.806 14746 v8::internal::JSObject::SetPropertyForResult() [0xc86589] 00:33:18.806 14746 v8::internal::JSReceiver::SetProperty() [0xc84b29] 00:33:18.806 14746 v8::internal::JSReceiver::SetProperty() [0xc828ac] 00:33:18.806 14746 v8::internal::StoreIC::Store() [0xebe4dc] 00:33:18.806 14746 v8::internal::StoreIC_Miss() [0xec113a] 00:33:18.806 14746 0x214759a0618e 626513 1 zimmermann 2012-05-17 06:23:13 -0700 Good to know, thanks Hajime! All we need is another FontCachePurgePreventer protection in subtreeChildWasAdded() -- I was unsure whether it's needed, and locally I saw no problems with that test, but anyhow - I'll create a follow-up patch to fix this. 626629 2 schenney 2012-05-17 09:16:01 -0700 The culprit, as Nikolas has acknowledged, is http://trac.webkit.org/changeset/117225 Funny thing is, I cannot reproduce this locally at all. 626630 3 pdr 2012-05-17 09:17:09 -0700 Nor can I (Linux debug) I believe schenney tried both Linux and Win debug. 626656 4 zimmermann 2012-05-17 09:58:10 -0700 This assertion is known to be tricky to nail down. I'm busy with other work until tomorrow evening, so if anyone wants to take this over no problem - just a matter of adding a FontCachePurgePreventer. 626922 5 schenney 2012-05-17 13:47:57 -0700 I have a fix (well, Niko's fix) that seems to prevent the crash. I need to run it many times overnight, however, to be sure. So expect something tomorrow morning. I also ascertained that you need to run the full test suite, or at least a big chunk, in order to hit the crash. 627296 6 morrita 2012-05-17 20:48:41 -0700 (In reply to comment #5) > I have a fix (well, Niko's fix) that seems to prevent the crash. I need to run it many times overnight, however, to be sure. So expect something tomorrow morning. > > I also ascertained that you need to run the full test suite, or at least a big chunk, in order to hit the crash. I think it's acceptable to land the speculative fix and see what happens since it hurts little - the test already crashes. 627675 7 142714 schenney 2012-05-18 07:30:18 -0700 Created attachment 142714 Patch 627679 8 schenney 2012-05-18 07:31:23 -0700 I have added font purge protections covering all cases where the SVG font metrics are cleared through the time they are rebuilt. 628362 9 142714 webkit.review.bot 2012-05-18 23:08:53 -0700 Comment on attachment 142714 Patch Rejecting attachment 142714 from commit-queue. Failed to run "['/mnt/git/webkit-commit-queue/Tools/Scripts/webkit-patch', '--status-host=queues.webkit.org', '-..." exit_code: 2 Last 500 characters of output: zz 3. patching file Source/WebCore/rendering/svg/RenderSVGText.cpp patching file LayoutTests/ChangeLog Hunk #1 succeeded at 1 with fuzz 3. patching file LayoutTests/platform/chromium/test_expectations.txt Hunk #1 FAILED at 3821. 1 out of 1 hunk FAILED -- saving rejects to file LayoutTests/platform/chromium/test_expectations.txt.rej Failed to run "[u'/mnt/git/webkit-commit-queue/Tools/Scripts/svn-apply', u'--force', u'--reviewer', u'Nikolas Zi..." exit_code: 1 cwd: /mnt/git/webkit-commit-queue/ Full output: http://queues.webkit.org/results/12730095 629162 10 schenney 2012-05-21 09:11:33 -0700 Committed r117790: <http://trac.webkit.org/changeset/117790> 142714 2012-05-18 07:30:18 -0700 2012-05-18 23:08:53 -0700 Patch bug-86715-20120518103017.patch text/plain 4311 schenney SW5kZXg6IFNvdXJjZS9XZWJDb3JlL0NoYW5nZUxvZwo9PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09Ci0tLSBTb3VyY2UvV2Vi Q29yZS9DaGFuZ2VMb2cJKHJldmlzaW9uIDExNzU4OSkKKysrIFNvdXJjZS9XZWJDb3JlL0NoYW5n ZUxvZwkod29ya2luZyBjb3B5KQpAQCAtMSwzICsxLDIzIEBACisyMDEyLTA1LTE4ICBTdGVwaGVu IENoZW5uZXkgIDxzY2hlbm5leUBjaHJvbWl1bS5vcmc+CisKKyAgICAgICAgW0Nocm9taXVtXSBS RUdSRVNTSU9OOiBBc3NlcnRpb24gZmFpbHVyZSBvbiBzdmcvY3VzdG9tL2FjaWQzLXRlc3QtNzcu aHRtbAorICAgICAgICBodHRwczovL2J1Z3Mud2Via2l0Lm9yZy9zaG93X2J1Zy5jZ2k/aWQ9ODY3 MTUKKworICAgICAgICBSZXZpZXdlZCBieSBOT0JPRFkgKE9PUFMhKS4KKworICAgICAgICBDYWxs cyB0byBjbGVhciB0aGUgdGV4dCBwb3NpdGlvbmluZyBlbGVtZW50cyBpbiBSZW5kZXJTVkdUZXh0 IG11c3QgYmUKKyAgICAgICAgcHJvdGVjdGVkIHdpdGggYSBGb250Q2FjaGVQdXJnZVByb3RlY3Rv ciBzbyB0aGF0IGZvbnRzIGFyZSBub3QgcmVtb3ZlZAorICAgICAgICBiZWZvcmUgdGhlIFNWRyBt ZXRyaWNzIGFyZSByZWJ1aWx0LiBUaGUgcHJvdGVjdGlvbiBtdXN0IGNvdmVyIGJvdGggdGhlCisg ICAgICAgIGNhY2hlIGNsZWFyaW5nIGFuZCB0aGUgcmVjb25zdHJ1Y3Rpb24gY2FsbHMuCisKKyAg ICAgICAgUGF0Y2ggZml4ZXMgZXhpc3RpbmcgdGVzdHMuCisKKyAgICAgICAgKiByZW5kZXJpbmcv c3ZnL1JlbmRlclNWR1RleHQuY3BwOgorICAgICAgICAoV2ViQ29yZTo6UmVuZGVyU1ZHVGV4dDo6 c3VidHJlZUNoaWxkV2FzQWRkZWQpOgorICAgICAgICAoV2ViQ29yZTo6UmVuZGVyU1ZHVGV4dDo6 c3VidHJlZUNoaWxkV2FzUmVtb3ZlZCk6CisgICAgICAgIChXZWJDb3JlOjpSZW5kZXJTVkdUZXh0 OjpzdWJ0cmVlVGV4dERpZENoYW5nZSk6CisgICAgICAgIChXZWJDb3JlOjpSZW5kZXJTVkdUZXh0 OjpyZW1vdmVDaGlsZCk6CisKIDIwMTItMDUtMTggIEFsZXhhbmRlciBQYXZsb3YgIDxhcGF2bG92 QGNocm9taXVtLm9yZz4KIAogICAgICAgICBXZWIgSW5zcGVjdG9yOiBlbXB0eSBDU1MgRGVjbGFy YXRpb24gaXMgZ2VuZXJhdGVkIGJ5IGNsaWNraW5nIHRoZSBsZWZ0IHNwYWNlIG9mICd1c2VyIGFn ZW50IHN0eWxlc2hlZXQnIG9uIFN0eWxlcyBzaWRlYmFyIG9mIEVsZW1lbnRzIHBhbmVsCkluZGV4 OiBTb3VyY2UvV2ViQ29yZS9yZW5kZXJpbmcvc3ZnL1JlbmRlclNWR1RleHQuY3BwCj09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT0KLS0tIFNvdXJjZS9XZWJDb3JlL3JlbmRlcmluZy9zdmcvUmVuZGVyU1ZHVGV4dC5jcHAJKHJl dmlzaW9uIDExNzQ3NCkKKysrIFNvdXJjZS9XZWJDb3JlL3JlbmRlcmluZy9zdmcvUmVuZGVyU1ZH VGV4dC5jcHAJKHdvcmtpbmcgY29weSkKQEAgLTE3MSw2ICsxNzEsOSBAQCB2b2lkIFJlbmRlclNW R1RleHQ6OnN1YnRyZWVDaGlsZFdhc0FkZGVkCiAgICAgaWYgKCFzaG91bGRIYW5kbGVTdWJ0cmVl TXV0YXRpb25zKCkgfHwgZG9jdW1lbnRCZWluZ0Rlc3Ryb3llZCgpKQogICAgICAgICByZXR1cm47 CiAKKyAgICAvLyBBbHdheXMgcHJvdGVjdCB0aGUgY2FjaGUgYmVmb3JlIGNsZWFyaW5nIHRleHQg cG9zaXRpb25pbmcgZWxlbWVudHMgd2hlbiB0aGUgY2FjaGUgd2lsbCBzdWJzZXF1ZW50bHkgYmUg cmVidWlsdC4KKyAgICBGb250Q2FjaGVQdXJnZVByZXZlbnRlciBmb250Q2FjaGVQdXJnZVByZXZl bnRlcjsKKwogICAgIC8vIFRoZSBwb3NpdGlvbmluZyBlbGVtZW50cyBjYWNoZSBkb2Vzbid0IGlu Y2x1ZGUgdGhlIG5ldyAnY2hpbGQnIHlldC4gQ2xlYXIgdGhlCiAgICAgLy8gY2FjaGUsIGFzIHRo ZSBuZXh0IGJ1aWxkTGF5b3V0QXR0cmlidXRlc0ZvclRleHRSZW5kZXJlcigpIGNhbGwgcmVidWls ZHMgaXQuCiAgICAgbV9sYXlvdXRBdHRyaWJ1dGVzQnVpbGRlci5jbGVhclRleHRQb3NpdGlvbmlu Z0VsZW1lbnRzKCk7CkBAIC0zMDYsNiArMzA5LDkgQEAgdm9pZCBSZW5kZXJTVkdUZXh0OjpzdWJ0 cmVlVGV4dERpZENoYW5nZQogICAgICAgICByZXR1cm47CiAgICAgfQogCisgICAgLy8gQWx3YXlz IHByb3RlY3QgdGhlIGNhY2hlIGJlZm9yZSBjbGVhcmluZyB0ZXh0IHBvc2l0aW9uaW5nIGVsZW1l bnRzIHdoZW4gdGhlIGNhY2hlIHdpbGwgc3Vic2VxdWVudGx5IGJlIHJlYnVpbHQuCisgICAgRm9u dENhY2hlUHVyZ2VQcmV2ZW50ZXIgZm9udENhY2hlUHVyZ2VQcmV2ZW50ZXI7CisKICAgICAvLyBU aGUgcG9zaXRpb25pbmcgZWxlbWVudHMgY2FjaGUgZGVwZW5kcyBvbiB0aGUgc2l6ZSBvZiBlYWNo IHRleHQgcmVuZGVyZXIgaW4gdGhlCiAgICAgLy8gc3VidHJlZS4gSWYgdGhpcyBjaGFuZ2VzLCBj bGVhciB0aGUgY2FjaGUuIEl0J3MgZ29pbmcgdG8gYmUgcmVidWlsdCBiZWxvdy4KICAgICBtX2xh eW91dEF0dHJpYnV0ZXNCdWlsZGVyLmNsZWFyVGV4dFBvc2l0aW9uaW5nRWxlbWVudHMoKTsKQEAg LTUyNiw2ICs1MzIsNyBAQCB2b2lkIFJlbmRlclNWR1RleHQ6OnJlbW92ZUNoaWxkKFJlbmRlck9i CiAKICAgICBSZW5kZXJTVkdJbmxpbmVUZXh0KiB0ZXh0ID0gdG9SZW5kZXJTVkdJbmxpbmVUZXh0 KGNoaWxkKTsKICAgICBWZWN0b3I8U1ZHVGV4dExheW91dEF0dHJpYnV0ZXMqLCAyPiBhZmZlY3Rl ZEF0dHJpYnV0ZXM7CisgICAgRm9udENhY2hlUHVyZ2VQcmV2ZW50ZXIgZm9udENhY2hlUHVyZ2VQ cmV2ZW50ZXI7CiAgICAgc3VidHJlZUNoaWxkV2lsbEJlUmVtb3ZlZCh0ZXh0LCBhZmZlY3RlZEF0 dHJpYnV0ZXMpOwogICAgIFJlbmRlclNWR0Jsb2NrOjpyZW1vdmVDaGlsZChjaGlsZCk7CiAgICAg c3VidHJlZUNoaWxkV2FzUmVtb3ZlZChhZmZlY3RlZEF0dHJpYnV0ZXMpOwpJbmRleDogTGF5b3V0 VGVzdHMvQ2hhbmdlTG9nCj09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT0KLS0tIExheW91dFRlc3RzL0NoYW5nZUxvZwkocmV2 aXNpb24gMTE3NTg5KQorKysgTGF5b3V0VGVzdHMvQ2hhbmdlTG9nCSh3b3JraW5nIGNvcHkpCkBA IC0xLDMgKzEsMTIgQEAKKzIwMTItMDUtMTggIFN0ZXBoZW4gQ2hlbm5leSAgPHNjaGVubmV5QGNo cm9taXVtLm9yZz4KKworICAgICAgICBbQ2hyb21pdW1dIFJFR1JFU1NJT046IEFzc2VydGlvbiBm YWlsdXJlIG9uIHN2Zy9jdXN0b20vYWNpZDMtdGVzdC03Ny5odG1sCisgICAgICAgIGh0dHBzOi8v YnVncy53ZWJraXQub3JnL3Nob3dfYnVnLmNnaT9pZD04NjcxNQorCisgICAgICAgIFJldmlld2Vk IGJ5IE5PQk9EWSAoT09QUyEpLgorCisgICAgICAgICogcGxhdGZvcm0vY2hyb21pdW0vdGVzdF9l eHBlY3RhdGlvbnMudHh0OiBSZW1vdmluZyBleHBlY3RhdGlvbiBmb3IgYWNpZDMgdGVzdC4KKwog MjAxMi0wNS0xOCAgQ3NhYmEgT3N6dHJvZ29uw6FjICA8b3NzeUB3ZWJraXQub3JnPgogCiAgICAg ICAgIFtRdF0gVW5yZXZpZXdlZCBnYXJkZW5pbmcsIHNraXBwZWQgbGlzdCBjbGVhbnVwLgpJbmRl eDogTGF5b3V0VGVzdHMvcGxhdGZvcm0vY2hyb21pdW0vdGVzdF9leHBlY3RhdGlvbnMudHh0Cj09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT0KLS0tIExheW91dFRlc3RzL3BsYXRmb3JtL2Nocm9taXVtL3Rlc3RfZXhwZWN0YXRp b25zLnR4dAkocmV2aXNpb24gMTE3NDc0KQorKysgTGF5b3V0VGVzdHMvcGxhdGZvcm0vY2hyb21p dW0vdGVzdF9leHBlY3RhdGlvbnMudHh0CSh3b3JraW5nIGNvcHkpCkBAIC0zODIxLDkgKzM4MjEs NiBAQCBCVUdXSzg2NzEyIDogZmFzdC9tdWx0aWNvbC92ZXJ0aWNhbC1sci9jCiBCVUdXSzg2NzEy IDogZmFzdC9tdWx0aWNvbC92ZXJ0aWNhbC1ybC9jb2x1bW4tY291bnQtd2l0aC1ydWxlcy5odG1s ID0gSU1BR0UKIEJVR1dLODY3MTIgOiBmYXN0L211bHRpY29sL3ZlcnRpY2FsLXJsL2NvbHVtbi1y dWxlcy5odG1sID0gSU1BR0UKIAotCi1CVUdXSzg2NzE1IERFQlVHIDogc3ZnL2N1c3RvbS9hY2lk My10ZXN0LTc3Lmh0bWwgPSBDUkFTSAotCiAvLyBOZWVkcyByZWJhc2VsaW5lIGFmdGVyIGJ1ZyA4 NjQ0MQogQlVHV0s4NjQ0MSBXSU4gTElOVVggTUFDIDogZmFzdC9ib3JkZXJzL2JvcmRlci1hbnRp YWxpYXNpbmcuaHRtbCA9IElNQUdFCiBCVUdXSzg2NDQxIFdJTiBMSU5VWCBNQUMgOiBmYXN0L211 bHRpY29sL3NoYWRvdy1icmVha2luZy5odG1sID0gSU1BR0UK