Bug 117756

Summary:

REGRESSION (r161429?): Frequent crashes on media/track/media-element-enqueue-event-crash.html

Product:

WebKit

Reporter:

WebKit Commit Bot <commit-queue>

Component:

JavaScriptCore

Assignee:

WebKit Commit Bot <commit-queue>

Status:

RESOLVED FIXED

Severity:

Normal

CC:

calvaris, eric.carlson, ggaren, glenn, jer.noble, mhahnenberg, philipj, sergio, svillar, webkit-bug-importer

Priority:

Keywords:

InRadar, Regression

Version:

528+ (Nightly build)

Hardware:

Unspecified

OS:

Unspecified

Bug Depends on:

Bug Blocks:

50856

Attachments:

Description	Flags
Archive of layout-test-results from webkit-cq-02	none
Patch	mhahnenberg: review+
Archive of layout-test-results from webkit-cq-02	none

Description WebKit Commit Bot 2013-06-18 14:24:06 PDT

This is an automatically generated bug from the commit-queue.
media/track/media-element-enqueue-event-crash.html has been flaky on the commit-queue.

media/track/media-element-enqueue-event-crash.html was authored by eric.carlson@apple.com.
http://trac.webkit.org/browser/trunk/LayoutTests/media/track/media-element-enqueue-event-crash.html

The commit-queue just saw media/track/media-element-enqueue-event-crash.html flake (DumpRenderTree crashed) while processing attachment 204936 [details] on bug 117747.
Bot: webkit-cq-02  Port: <class 'webkitpy.common.config.ports.MacPort'>  Platform: Mac OS X 10.8.3

The bots will update this with information from each new failure.

If you believe this bug to be fixed or invalid, feel free to close.  The bots will re-open if the flake re-occurs.

If you would like to track this test fix with another bug, please close this bug as a duplicate.  The bots will follow the duplicate chain when making future comments.

Comment 1 WebKit Commit Bot 2013-06-18 14:24:10 PDT

Created attachment 204942 [details]
Archive of layout-test-results from webkit-cq-02

Comment 2 Alexey Proskuryakov 2014-01-07 16:57:49 PST

I just had this test hit an assertion when running tests locally. Not sure if this is the same issue as originally seen by commit queue.

        ASSERT(node == m_head);

Thread 0 Crashed:: Dispatch queue: com.apple.main-thread
0   com.apple.JavaScriptCore      	0x0000000102df1b2a WTFCrash + 42 (Assertions.cpp:341)
1   com.apple.JavaScriptCore      	0x0000000102c2d096 WTF::DoublyLinkedList<JSC::MarkedBlock>::remove(JSC::MarkedBlock*) + 198 (DoublyLinkedList.h:169)
2   com.apple.JavaScriptCore      	0x0000000102c2cb4a JSC::MarkedAllocator::removeBlock(JSC::MarkedBlock*) + 154 (MarkedAllocator.cpp:153)
3   com.apple.JavaScriptCore      	0x0000000102c30afd JSC::MarkedSpace::freeBlock(JSC::MarkedBlock*) + 45 (MarkedSpace.cpp:234)
4   com.apple.JavaScriptCore      	0x0000000102c30bf7 JSC::MarkedSpace::freeOrShrinkBlock(JSC::MarkedBlock*) + 71 (MarkedSpace.cpp:250)
5   com.apple.JavaScriptCore      	0x0000000102a9b264 JSC::IncrementalSweeper::sweepNextBlock() + 180 (IncrementalSweeper.cpp:130)
6   com.apple.JavaScriptCore      	0x0000000102a9b12a JSC::IncrementalSweeper::doSweep(double) + 106 (IncrementalSweeper.cpp:108)
7   com.apple.JavaScriptCore      	0x0000000102a9b0b2 JSC::IncrementalSweeper::doWork() + 34 (IncrementalSweeper.cpp:100)
8   com.apple.JavaScriptCore      	0x0000000102a97222 JSC::HeapTimer::timerDidFire(__CFRunLoopTimer*, void*) + 338 (HeapTimer.cpp:98)
9   com.apple.CoreFoundation      	0x00007fff8bbd3724 __CFRUNLOOP_IS_CALLING_OUT_TO_A_TIMER_CALLBACK_FUNCTION__ + 20

Comment 3 Alexey Proskuryakov 2014-01-08 10:22:32 PST

This test started to crash super frequently on Mac bots (debug and release) yesterday.

http://webkit-test-results.appspot.com/dashboards/flakiness_dashboard.html#showAllRuns=true&tests=media%2Ftrack%2Fmedia-element-enqueue-event-crash.html

Comment 4 Eric Carlson 2014-01-08 11:00:08 PST

(In reply to comment #2)
> I just had this test hit an assertion when running tests locally. Not sure if this is the same issue as originally seen by commit queue.
> 
>         ASSERT(node == m_head);
> 
This is not the same crash originally seen by the commit queue. This is asserting because a list node without a previous element is not the list head:

    template<typename T> inline void DoublyLinkedList<T>::remove(T* node)
    {
        if (node->prev()) {
            ASSERT(node != m_head);
            node->prev()->setNext(node->next());
        } else {
-->         ASSERT(node == m_head);
            m_head = node->next();
        }

Comment 5 Eric Carlson 2014-01-08 11:08:11 PST

I don't know much about about how the GC works but r161429 looks like it could be related - it changed the way sweeping behaves and was committed at 2014-01-07 09:36:02 PST, .

Comment 6 Alexey Proskuryakov 2014-01-08 12:00:34 PST

Indeed, the crashes started right after r161429. 

Let's track the new JSC crash here, old flakiness seems to be gone (there is one earlier crash recorded by flakiness dashboard, but in a revision that was all broken).

Comment 7 Radar WebKit Bug Importer 2014-01-08 12:02:20 PST

<rdar://problem/15774608>

Comment 8 Alexey Proskuryakov 2014-01-09 10:28:00 PST

In release mode, the crashes are in a different place each time. Debug assertions all seem to be in DoublyLinkedList as posted above.

Skipped in <http://trac.webkit.org/r161560>.

Comment 9 Sergio Villar Senin 2014-04-04 03:02:52 PDT

This is also asserting in WebKitGTK debug bots

STDERR: ASSERTION FAILED: !m_deletionHasBegun || !m_referencingNodeCount
STDERR: ../../Source/WebCore/dom/Document.h(280) : void WebCore::Document::decrementReferencingNodeCount()
STDERR: 1   0x7f5d1fc16e2d /home/slave/webkitgtk/gtk-linux-64-debug/build/WebKitBuild/Debug/lib/libjavascriptcoregtk-3.0.so.0(WTFCrash+0x1e) [0x7f5d1fc16e2d]
STDERR: 2   0x7f5d1a1451b6 /home/slave/webkitgtk/gtk-linux-64-debug/build/WebKitBuild/Debug/lib/libwebkit2gtk-3.0.so.25(_ZN7WebCore8Document29decrementReferencingNodeCountEv+0x4a) [0x7f5d1a1451b6]
STDERR: 3   0x7f5d1a1d3109 /home/slave/webkitgtk/gtk-linux-64-debug/build/WebKitBuild/Debug/lib/libwebkit2gtk-3.0.so.25(_ZN7WebCore4NodeD1Ev+0x179) [0x7f5d1a1d3109]
STDERR: 4   0x7f5d1a0ff0e0 /home/slave/webkitgtk/gtk-linux-64-debug/build/WebKitBuild/Debug/lib/libwebkit2gtk-3.0.so.25(_ZN7WebCore13CharacterDataD1Ev+0x3a) [0x7f5d1a0ff0e0]
STDERR: 5   0x7f5d1a221b57 /home/slave/webkitgtk/gtk-linux-64-debug/build/WebKitBuild/Debug/lib/libwebkit2gtk-3.0.so.25(_ZN7WebCore4TextD1Ev+0x5f) [0x7f5d1a221b57]
STDERR: 6   0x7f5d1a221b86 /home/slave/webkitgtk/gtk-linux-64-debug/build/WebKitBuild/Debug/lib/libwebkit2gtk-3.0.so.25(_ZN7WebCore4TextD0Ev+0x18) [0x7f5d1a221b86]
STDERR: 7   0x7f5d1a11a737 /home/slave/webkitgtk/gtk-linux-64-debug/build/WebKitBuild/Debug/lib/libwebkit2gtk-3.0.so.25(_ZN7WebCore33removeDetachedChildrenInContainerINS_4NodeENS_13ContainerNodeEEEvRT0_+0xe8) [0x7f5d1a11a737]
STDERR: 8   0x7f5d1a113e7c /home/slave/webkitgtk/gtk-linux-64-debug/build/WebKitBuild/Debug/lib/libwebkit2gtk-3.0.so.25(_ZN7WebCore13ContainerNode22removeDetachedChildrenEv+0x62) [0x7f5d1a113e7c]
STDERR: 9   0x7f5d1a114229 /home/slave/webkitgtk/gtk-linux-64-debug/build/WebKitBuild/Debug/lib/libwebkit2gtk-3.0.so.25(_ZN7WebCore13ContainerNodeD1Ev+0x5b) [0x7f5d1a114229]
STDERR: 10  0x7f5d1a189319 /home/slave/webkitgtk/gtk-linux-64-debug/build/WebKitBuild/Debug/lib/libwebkit2gtk-3.0.so.25(_ZN7WebCore7ElementD1Ev+0x18f) [0x7f5d1a189319]
STDERR: 11  0x7f5d1a2176fc /home/slave/webkitgtk/gtk-linux-64-debug/build/WebKitBuild/Debug/lib/libwebkit2gtk-3.0.so.25(_ZN7WebCore13StyledElementD1Ev+0x5a) [0x7f5d1a2176fc]
STDERR: 12  0x7f5d1a3251ca /home/slave/webkitgtk/gtk-linux-64-debug/build/WebKitBuild/Debug/lib/libwebkit2gtk-3.0.so.25(_ZN7WebCore11HTMLElementD1Ev+0x2a) [0x7f5d1a3251ca]
STDERR: 13  0x7f5d1a36643a /home/slave/webkitgtk/gtk-linux-64-debug/build/WebKitBuild/Debug/lib/libwebkit2gtk-3.0.so.25(_ZN7WebCore16HTMLMediaElementD1Ev+0x686) [0x7f5d1a36643a]
STDERR: 14  0x7f5d1a3ba796 /home/slave/webkitgtk/gtk-linux-64-debug/build/WebKitBuild/Debug/lib/libwebkit2gtk-3.0.so.25(_ZN7WebCore16HTMLVideoElementD1Ev+0x126) [0x7f5d1a3ba796]
STDERR: 15  0x7f5d1a3ba826 /home/slave/webkitgtk/gtk-linux-64-debug/build/WebKitBuild/Debug/lib/libwebkit2gtk-3.0.so.25(_ZN7WebCore16HTMLVideoElementD0Ev+0x18) [0x7f5d1a3ba826]
STDERR: 16  0x7f5d1a1da0d8 /home/slave/webkitgtk/gtk-linux-64-debug/build/WebKitBuild/Debug/lib/libwebkit2gtk-3.0.so.25(_ZN7WebCore4Node14removedLastRefEv+0x58) [0x7f5d1a1da0d8]
STDERR: 17  0x7f5d19afd0bd /home/slave/webkitgtk/gtk-linux-64-debug/build/WebKitBuild/Debug/lib/libwebkit2gtk-3.0.so.25(_ZN7WebCore10TreeSharedINS_4NodeEE5derefEv+0x159) [0x7f5d19afd0bd]
STDERR: 18  0x7f5d1a1d43fe /home/slave/webkitgtk/gtk-linux-64-debug/build/WebKitBuild/Debug/lib/libwebkit2gtk-3.0.so.25(_ZN7WebCore4Node16derefEventTargetEv+0x1c) [0x7f5d1a1d43fe]
STDERR: 19  0x7f5d19d77381 /home/slave/webkitgtk/gtk-linux-64-debug/build/WebKitBuild/Debug/lib/libwebkit2gtk-3.0.so.25(_ZN7WebCore11EventTarget5derefEv+0x23) [0x7f5d19d77381]
STDERR: 20  0x7f5d19d79818 /home/slave/webkitgtk/gtk-linux-64-debug/build/WebKitBuild/Debug/lib/libwebkit2gtk-3.0.so.25(_ZN3WTF14derefIfNotNullIN7WebCore11EventTargetEEEvPT_+0x28) [0x7f5d19d79818]
STDERR: 21  0x7f5d19da372b /home/slave/webkitgtk/gtk-linux-64-debug/build/WebKitBuild/Debug/lib/libwebkit2gtk-3.0.so.25(_ZN3WTF6RefPtrIN7WebCore11EventTargetEED1Ev+0x1b) [0x7f5d19da372b]
STDERR: 22  0x7f5d1a19ee12 /home/slave/webkitgtk/gtk-linux-64-debug/build/WebKitBuild/Debug/lib/libwebkit2gtk-3.0.so.25(_ZN7WebCore5EventD1Ev+0x3e) [0x7f5d1a19ee12]
STDERR: 23  0x7f5d1a19ee72 /home/slave/webkitgtk/gtk-linux-64-debug/build/WebKitBuild/Debug/lib/libwebkit2gtk-3.0.so.25(_ZN7WebCore5EventD0Ev+0x18) [0x7f5d1a19ee72]
STDERR: 24  0x7f5d19b87306 /home/slave/webkitgtk/gtk-linux-64-debug/build/WebKitBuild/Debug/lib/libwebkit2gtk-3.0.so.25(_ZN3WTF10RefCountedIN7WebCore5EventEE5derefEv+0x48) [0x7f5d19b87306]
STDERR: 25  0x7f5d1b115a18 /home/slave/webkitgtk/gtk-linux-64-debug/build/WebKitBuild/Debug/lib/libwebkit2gtk-3.0.so.25(_ZN7WebCore7JSEvent11releaseImplEv+0x20) [0x7f5d1b115a18]
STDERR: 26  0x7f5d1b115934 /home/slave/webkitgtk/gtk-linux-64-debug/build/WebKitBuild/Debug/lib/libwebkit2gtk-3.0.so.25(_ZN7WebCore12JSEventOwner8finalizeEN3JSC6HandleINS1_7UnknownEEEPv+0x6a) [0x7f5d1b115934]
STDERR: 27  0x7f5d1f94c15d /home/slave/webkitgtk/gtk-linux-64-debug/build/WebKitBuild/Debug/lib/libjavascriptcoregtk-3.0.so.0(_ZN3JSC9WeakBlock8finalizeEPNS_8WeakImplE+0xb5) [0x7f5d1f94c15d]
STDERR: 28  0x7f5d1f94bb7f /home/slave/webkitgtk/gtk-linux-64-debug/build/WebKitBuild/Debug/lib/libjavascriptcoregtk-3.0.so.0(_ZN3JSC9WeakBlock5sweepEv+0x89) [0x7f5d1f94bb7f]
STDERR: 29  0x7f5d1f94c4b8 /home/slave/webkitgtk/gtk-linux-64-debug/build/WebKitBuild/Debug/lib/libjavascriptcoregtk-3.0.so.0(_ZN3JSC7WeakSet5sweepEv+0x2e) [0x7f5d1f94c4b8]
STDERR: 30  0x7f5d1f94327a /home/slave/webkitgtk/gtk-linux-64-debug/build/WebKitBuild/Debug/lib/libjavascriptcoregtk-3.0.so.0(_ZN3JSC11MarkedBlock5sweepENS0_9SweepModeE+0x66) [0x7f5d1f94327a]
STDERR: 31  0x7f5d1f946199 /home/slave/webkitgtk/gtk-linux-64-debug/build/WebKitBuild/Debug/lib/libjavascriptcoregtk-3.0.so.0(_ZN3JSC5SweepclEPNS_11MarkedBlockE+0x21) [0x7f5d1f946199]

Comment 10 Geoffrey Garen 2014-05-07 17:06:05 PDT

Created attachment 231030 [details]
Patch

Comment 11 Mark Hahnenberg 2014-05-07 17:06:42 PDT

Comment on attachment 231030 [details]
Patch

r=me

Comment 12 Geoffrey Garen 2014-05-07 17:07:33 PDT

Committed r168453: <http://trac.webkit.org/changeset/168453>

Comment 13 WebKit Commit Bot 2017-03-07 21:18:01 PST

The commit-queue just saw media/track/media-element-enqueue-event-crash.html flake (text diff) while processing attachment 303766 [details] on bug 169336.
Bot: webkit-cq-02  Port: <class 'webkitpy.common.config.ports.MacPort'>  Platform: Mac OS X 10.11.6

Comment 14 WebKit Commit Bot 2017-03-07 21:18:05 PST

Created attachment 303776 [details]
Archive of layout-test-results from webkit-cq-02