Bug 105606

Summary: Various tests in media/track are intermittently crashing
Product: WebKit Reporter: Ryosuke Niwa <rniwa>
Component: MediaAssignee: Ilya Tikhonovsky <loislo>
Status: RESOLVED FIXED    
Severity: Critical CC: dino, eric.carlson, eric, feature-media-reviews, loislo, ojan.autocc, palmer, rniwa, simon.fraser, tony, webkit.review.bot
Priority: P1    
Version: 528+ (Nightly build)   
Hardware: Unspecified   
OS: Unspecified   
Attachments:
Description Flags
Patch none

Ryosuke Niwa
Reported 2012-12-20 20:08:26 PST
They all seem to have the same stack trace: Thread 0 Crashed:: Dispatch queue: com.apple.main-thread 0 com.apple.WebCore 0x0000000103343825 void WebCore::removeAllChildrenInContainer<WebCore::Node, WebCore::ContainerNode>(WebCore::ContainerNode*) + 229 (ContainerNodeAlgorithms.h:104) 1 com.apple.WebCore 0x000000010342d13b WebCore::Document::removedLastRef() + 539 (OwnPtr.h:72) 2 com.apple.WebCore 0x0000000103f04423 WebCore::TagNodeList::~TagNodeList() + 291 (Weak.h:143) 3 com.apple.WebCore 0x0000000103f045e3 WebCore::HTMLTagNodeList::~HTMLTagNodeList() + 67 (RefCounted.h:197) 4 com.apple.WebCore 0x0000000103991901 WebCore::JSNodeListOwner::finalize(JSC::Handle<JSC::Unknown>, void*) + 65 (JSNodeList.h:58) 5 com.apple.JavaScriptCore 0x0000000102c97f4c JSC::WeakBlock::sweep() + 108 (WeakImpl.h:84) 6 com.apple.JavaScriptCore 0x0000000102c982b8 JSC::WeakSet::sweep() + 40 (DoublyLinkedList.h:118) 7 com.apple.JavaScriptCore 0x0000000102bcf2d8 JSC::MarkedBlock::sweep(JSC::MarkedBlock::SweepMode) + 24 (MarkedBlock.cpp:112) 8 com.apple.JavaScriptCore 0x0000000102c96fa3 JSC::MarkedAllocator::allocateSlowCase(unsigned long) + 99 (MarkedAllocator.cpp:34) 9 com.apple.JavaScriptCore 0x0000000102b8c52d JSC::FunctionPrototype::create(JSC::ExecState*, JSC::JSGlobalObject*, JSC::Structure*) + 77 (MarkedAllocator.h:78) 10 com.apple.JavaScriptCore 0x0000000102b87c21 JSC::JSGlobalObject::reset(JSC::JSValue) + 209 (JSGlobalObject.cpp:202) 11 com.apple.WebCore 0x000000010389a523 WebCore::JSDOMWindowBase::finishCreation(JSC::JSGlobalData&, WebCore::JSDOMWindowShell*) + 35 (JSDOMWindowBase.cpp:69) 12 com.apple.WebCore 0x000000010389ef7f WebCore::JSDOMWindow::create(JSC::JSGlobalData&, JSC::Structure*, WTF::PassRefPtr<WebCore::DOMWindow>, WebCore::JSDOMWindowShell*) + 175 (JSDOMWindow.h:42) 13 com.apple.WebCore 0x000000010389ec7c WebCore::JSDOMWindowShell::setWindow(WTF::PassRefPtr<WebCore::DOMWindow>) + 380 (JSDOMWindowShell.cpp:75) 14 com.apple.WebCore 0x0000000103d6d234 WebCore::ScriptController::clearWindowShell(WebCore::DOMWindow*, bool) + 276 (PassRefPtr.h:68) 15 com.apple.WebCore 0x00000001035d2b9f WebCore::FrameLoader::clear(WebCore::Document*, bool, bool, bool) + 271 (FrameLoader.cpp:568) 16 com.apple.WebCore 0x0000000103459b61 WebCore::DocumentWriter::begin(WebCore::KURL const&, bool, WebCore::Document*) + 369 (DocumentWriter.cpp:135) 17 com.apple.WebCore 0x00000001034497db WebCore::DocumentLoader::commitData(char const*, unsigned long) + 91 (RefPtr.h:56) 18 com.apple.WebKit 0x0000000102fae7b4 -[WebHTMLRepresentation receivedData:withDataSource:] + 100 (WebHTMLRepresentation.mm:186) 19 com.apple.WebKit 0x0000000102f8149d -[WebDataSource(WebInternal) _receivedData:] + 77 (WebDataSource.mm:216) 20 com.apple.WebKit 0x0000000102f994f7 WebFrameLoaderClient::committedLoad(WebCore::DocumentLoader*, char const*, int) + 103 (WebFrameLoaderClient.mm:841) 21 com.apple.WebCore 0x0000000103449a20 WebCore::DocumentLoader::commitLoad(char const*, int) + 144 (RefCounted.h:148) 22 com.apple.WebCore 0x0000000103b33ec3 WebCore::MainResourceLoader::dataReceived(WebCore::CachedResource*, char const*, int) + 787 (MainResourceLoader.cpp:497) 23 com.apple.WebCore 0x0000000103300145 WebCore::CachedRawResource::data(WTF::PassRefPtr<WebCore::ResourceBuffer>, bool) + 309 (CachedRawResource.cpp:70) 24 com.apple.WebCore 0x0000000103e4427a WebCore::SubresourceLoader::sendDataToResource(char const*, int) + 122 (PassRefPtr.h:68) 25 com.apple.WebCore 0x0000000103e4435c WebCore::SubresourceLoader::didReceiveData(char const*, int, long long, bool) + 76 (ResourceLoader.h:142) 26 com.apple.WebCore 0x0000000103d4dd48 WebCore::ResourceLoader::didReceiveData(WebCore::ResourceHandle*, char const*, int, int) + 136 (InspectorInstrumentation.h:260) 27 com.apple.Foundation 0x00007fff87ee6f58 __65-[NSURLConnectionInternal _withConnectionAndDelegate:onlyActive:]_block_invoke_0 + 28 28 com.apple.Foundation 0x00007fff87ee6e9c -[NSURLConnectionInternal _withConnectionAndDelegate:onlyActive:] + 227 29 com.apple.Foundation 0x00007fff87ee6d98 -[NSURLConnectionInternal _withActiveConnectionAndDelegate:] + 63 30 com.apple.Foundation 0x00007fff87ee992b _NSURLConnectionDidReceiveData_LengthReceived + 86 31 com.apple.CFNetwork 0x00007fff8971d7b1 ___delegate_didReceiveDataArray_block_invoke_0 + 132 32 com.apple.CFNetwork 0x00007fff89710753 ___withDelegateAsync_block_invoke_0 + 90 33 com.apple.CFNetwork 0x00007fff8979f2ca __block_global_1 + 28 34 com.apple.CoreFoundation 0x00007fff92f8c724 CFArrayApplyFunction + 68 35 com.apple.CFNetwork 0x00007fff89701a6c RunloopBlockContext::perform() + 126 36 com.apple.CFNetwork 0x00007fff8970194b MultiplexerSource::perform() + 221 37 com.apple.CoreFoundation 0x00007fff92f6e101 __CFRUNLOOP_IS_CALLING_OUT_TO_A_SOURCE0_PERFORM_FUNCTION__ + 17 38 com.apple.CoreFoundation 0x00007fff92f6da25 __CFRunLoopDoSources0 + 245 39 com.apple.CoreFoundation 0x00007fff92f90dc5 __CFRunLoopRun + 789 40 com.apple.CoreFoundation 0x00007fff92f906b2 CFRunLoopRunSpecific + 290 41 com.apple.Foundation 0x00007fff87f6489e -[NSRunLoop(NSRunLoop) runMode:beforeDate:] + 268 42 DumpRenderTree 0x00000001028b24c9 runTest(std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> > const&) + 1624 (DumpRenderTree.mm:1378) 43 DumpRenderTree 0x00000001028b1c54 dumpRenderTree(int, char const**) + 1855 (DumpRenderTree.mm:842) 44 DumpRenderTree 0x00000001028b2832 main + 86 (DumpRenderTree.mm:927) 45 libdyld.dylib 0x00007fff89a677e1 start + 1
Attachments
Patch (1.49 KB, patch)
2012-12-21 01:44 PST, Ilya Tikhonovsky 		no flags
DetailsFormatted DiffDiff
View All Add attachment proposed patch, testcase, etc.
Ryosuke Niwa
Comment 1 2012-12-20 20:09:05 PST
I’ve seen crashes on: media/track/tracklist-is-reachable.html media/track/text-track-cue-is-reachable.html media/track/text-track-is-reachable.html media/track/track-webvtt-tc005-header-comment.html media/track/track-webvtt-tc004-magic-header.html media/track/track-webvtt-tc016-align-positioning.html But looking at the commit queue, other tests are also crashing.
Ilya Tikhonovsky
Comment 2 2012-12-21 01:44:30 PST
Created attachment 180491 [details] Patch
Ryosuke Niwa
Comment 3 2012-12-21 02:01:28 PST
Comment on attachment 180491 [details] Patch The fix looks reasonable. I'm hoping that either Dean or Eric could review it.
Eric Seidel (no email)
Comment 4 2012-12-21 08:35:34 PST
Comment on attachment 180491 [details] Patch LGTM.
Ilya Tikhonovsky
Comment 5 2012-12-21 08:37:34 PST
Comment on attachment 180491 [details] Patch Clearing flags on attachment: 180491 Committed r138381: <http://trac.webkit.org/changeset/138381>
Ilya Tikhonovsky
Comment 6 2012-12-21 08:37:40 PST
All reviewed patches have been landed. Closing bug.
Eric Carlson
Comment 7 2012-12-21 09:39:24 PST
(In reply to comment #3) > (From update of attachment 180491 [details]) > The fix looks reasonable. I'm hoping that either Dean or Eric could review it. It looks correct to me as well, thank you!
Ilya Tikhonovsky
Comment 8 2012-12-24 04:35:00 PST
*** Bug 105657 has been marked as a duplicate of this bug. ***
Note You need to log in before you can comment on or make changes to this bug.