Bug 117756 – REGRESSION (r161429?): Frequent crashes on media/track/media-element-enqueue-event-crash.html

• Component: JavaScriptCore
• Status: RESOLVED FIXED

[WebKit Commit Bot]

This is an automatically generated bug from the commit-queue.
media/track/media-element-enqueue-event-crash.html has been flaky on the commit-queue.

media/track/media-element-enqueue-event-crash.html was authored by [e-mail].
http://trac.webkit.org/browser/trunk/LayoutTests/media/track/media-element-enqueue-event-crash.html

The commit-queue just saw media/track/media-element-enqueue-event-crash.html flake (DumpRenderTree crashed) while processing attachment 204936 [details] on bug 117747.
Bot: webkit-cq-02  Port: <class 'webkitpy.common.config.ports.MacPort'>  Platform: Mac OS X 10.8.3

The bots will update this with information from each new failure.

If you believe this bug to be fixed or invalid, feel free to close.  The bots will re-open if the flake re-occurs.

If you would like to track this test fix with another bug, please close this bug as a duplicate.  The bots will follow the duplicate chain when making future comments.

[WebKit Commit Bot]

Created attachment 204942 [details]
Archive of layout-test-results from webkit-cq-02

[Alexey Proskuryakov]

I just had this test hit an assertion when running tests locally. Not sure if this is the same issue as originally seen by commit queue.

        ASSERT(node == m_head);

Thread 0 Crashed:: Dispatch queue: com.apple.main-thread
0   com.apple.JavaScriptCore      	0x0000000102df1b2a WTFCrash + 42 (Assertions.cpp:341)
1   com.apple.JavaScriptCore      	0x0000000102c2d096 WTF::DoublyLinkedList<JSC::MarkedBlock>::remove(JSC::MarkedBlock*) + 198 (DoublyLinkedList.h:169)
2   com.apple.JavaScriptCore      	0x0000000102c2cb4a JSC::MarkedAllocator::removeBlock(JSC::MarkedBlock*) + 154 (MarkedAllocator.cpp:153)
3   com.apple.JavaScriptCore      	0x0000000102c30afd JSC::MarkedSpace::freeBlock(JSC::MarkedBlock*) + 45 (MarkedSpace.cpp:234)
4   com.apple.JavaScriptCore      	0x0000000102c30bf7 JSC::MarkedSpace::freeOrShrinkBlock(JSC::MarkedBlock*) + 71 (MarkedSpace.cpp:250)
5   com.apple.JavaScriptCore      	0x0000000102a9b264 JSC::IncrementalSweeper::sweepNextBlock() + 180 (IncrementalSweeper.cpp:130)
6   com.apple.JavaScriptCore      	0x0000000102a9b12a JSC::IncrementalSweeper::doSweep(double) + 106 (IncrementalSweeper.cpp:108)
7   com.apple.JavaScriptCore      	0x0000000102a9b0b2 JSC::IncrementalSweeper::doWork() + 34 (IncrementalSweeper.cpp:100)
8   com.apple.JavaScriptCore      	0x0000000102a97222 JSC::HeapTimer::timerDidFire(__CFRunLoopTimer*, void*) + 338 (HeapTimer.cpp:98)
9   com.apple.CoreFoundation      	0x00007fff8bbd3724 __CFRUNLOOP_IS_CALLING_OUT_TO_A_TIMER_CALLBACK_FUNCTION__ + 20

[Alexey Proskuryakov]

This test started to crash super frequently on Mac bots (debug and release) yesterday.

http://webkit-test-results.appspot.com/dashboards/flakiness_dashboard.html#showAllRuns=true&tests=media%2Ftrack%2Fmedia-element-enqueue-event-crash.html

[Eric Carlson]

(In reply to comment #2)
> I just had this test hit an assertion when running tests locally. Not sure if this is the same issue as originally seen by commit queue.
> 
>         ASSERT(node == m_head);
> 
This is not the same crash originally seen by the commit queue. This is asserting because a list node without a previous element is not the list head:

    template<typename T> inline void DoublyLinkedList<T>::remove(T* node)
    {
        if (node->prev()) {
            ASSERT(node != m_head);
            node->prev()->setNext(node->next());
        } else {
-->         ASSERT(node == m_head);
            m_head = node->next();
        }

[Eric Carlson]

I don't know much about about how the GC works but r161429 looks like it could be related - it changed the way sweeping behaves and was committed at 2014-01-07 09:36:02 PST, .

[Alexey Proskuryakov]

Indeed, the crashes started right after r161429. 

Let's track the new JSC crash here, old flakiness seems to be gone (there is one earlier crash recorded by flakiness dashboard, but in a revision that was all broken).

[Radar WebKit Bug Importer]

<rdar://problem/15774608>

[Alexey Proskuryakov]

In release mode, the crashes are in a different place each time. Debug assertions all seem to be in DoublyLinkedList as posted above.

Skipped in <http://trac.webkit.org/r161560>.

[Sergio Villar Senin]

This is also asserting in WebKitGTK debug bots

STDERR: ASSERTION FAILED: !m_deletionHasBegun || !m_referencingNodeCount
STDERR: ../../Source/WebCore/dom/Document.h(280) : void WebCore::Document::decrementReferencingNodeCount()
STDERR: 1   0x7f5d1fc16e2d /home/slave/webkitgtk/gtk-linux-64-debug/build/WebKitBuild/Debug/lib/libjavascriptcoregtk-3.0.so.0(WTFCrash+0x1e) [0x7f5d1fc16e2d]
STDERR: 2   0x7f5d1a1451b6 /home/slave/webkitgtk/gtk-linux-64-debug/build/WebKitBuild/Debug/lib/libwebkit2gtk-3.0.so.25(_ZN7WebCore8Document29decrementReferencingNodeCountEv+0x4a) [0x7f5d1a1451b6]
STDERR: 3   0x7f5d1a1d3109 /home/slave/webkitgtk/gtk-linux-64-debug/build/WebKitBuild/Debug/lib/libwebkit2gtk-3.0.so.25(_ZN7WebCore4NodeD1Ev+0x179) [0x7f5d1a1d3109]
STDERR: 4   0x7f5d1a0ff0e0 /home/slave/webkitgtk/gtk-linux-64-debug/build/WebKitBuild/Debug/lib/libwebkit2gtk-3.0.so.25(_ZN7WebCore13CharacterDataD1Ev+0x3a) [0x7f5d1a0ff0e0]
STDERR: 5   0x7f5d1a221b57 /home/slave/webkitgtk/gtk-linux-64-debug/build/WebKitBuild/Debug/lib/libwebkit2gtk-3.0.so.25(_ZN7WebCore4TextD1Ev+0x5f) [0x7f5d1a221b57]
STDERR: 6   0x7f5d1a221b86 /home/slave/webkitgtk/gtk-linux-64-debug/build/WebKitBuild/Debug/lib/libwebkit2gtk-3.0.so.25(_ZN7WebCore4TextD0Ev+0x18) [0x7f5d1a221b86]
STDERR: 7   0x7f5d1a11a737 /home/slave/webkitgtk/gtk-linux-64-debug/build/WebKitBuild/Debug/lib/libwebkit2gtk-3.0.so.25(_ZN7WebCore33removeDetachedChildrenInContainerINS_4NodeENS_13ContainerNodeEEEvRT0_+0xe8) [0x7f5d1a11a737]
STDERR: 8   0x7f5d1a113e7c /home/slave/webkitgtk/gtk-linux-64-debug/build/WebKitBuild/Debug/lib/libwebkit2gtk-3.0.so.25(_ZN7WebCore13ContainerNode22removeDetachedChildrenEv+0x62) [0x7f5d1a113e7c]
STDERR: 9   0x7f5d1a114229 /home/slave/webkitgtk/gtk-linux-64-debug/build/WebKitBuild/Debug/lib/libwebkit2gtk-3.0.so.25(_ZN7WebCore13ContainerNodeD1Ev+0x5b) [0x7f5d1a114229]
STDERR: 10  0x7f5d1a189319 /home/slave/webkitgtk/gtk-linux-64-debug/build/WebKitBuild/Debug/lib/libwebkit2gtk-3.0.so.25(_ZN7WebCore7ElementD1Ev+0x18f) [0x7f5d1a189319]
STDERR: 11  0x7f5d1a2176fc /home/slave/webkitgtk/gtk-linux-64-debug/build/WebKitBuild/Debug/lib/libwebkit2gtk-3.0.so.25(_ZN7WebCore13StyledElementD1Ev+0x5a) [0x7f5d1a2176fc]
STDERR: 12  0x7f5d1a3251ca /home/slave/webkitgtk/gtk-linux-64-debug/build/WebKitBuild/Debug/lib/libwebkit2gtk-3.0.so.25(_ZN7WebCore11HTMLElementD1Ev+0x2a) [0x7f5d1a3251ca]
STDERR: 13  0x7f5d1a36643a /home/slave/webkitgtk/gtk-linux-64-debug/build/WebKitBuild/Debug/lib/libwebkit2gtk-3.0.so.25(_ZN7WebCore16HTMLMediaElementD1Ev+0x686) [0x7f5d1a36643a]
STDERR: 14  0x7f5d1a3ba796 /home/slave/webkitgtk/gtk-linux-64-debug/build/WebKitBuild/Debug/lib/libwebkit2gtk-3.0.so.25(_ZN7WebCore16HTMLVideoElementD1Ev+0x126) [0x7f5d1a3ba796]
STDERR: 15  0x7f5d1a3ba826 /home/slave/webkitgtk/gtk-linux-64-debug/build/WebKitBuild/Debug/lib/libwebkit2gtk-3.0.so.25(_ZN7WebCore16HTMLVideoElementD0Ev+0x18) [0x7f5d1a3ba826]
STDERR: 16  0x7f5d1a1da0d8 /home/slave/webkitgtk/gtk-linux-64-debug/build/WebKitBuild/Debug/lib/libwebkit2gtk-3.0.so.25(_ZN7WebCore4Node14removedLastRefEv+0x58) [0x7f5d1a1da0d8]
STDERR: 17  0x7f5d19afd0bd /home/slave/webkitgtk/gtk-linux-64-debug/build/WebKitBuild/Debug/lib/libwebkit2gtk-3.0.so.25(_ZN7WebCore10TreeSharedINS_4NodeEE5derefEv+0x159) [0x7f5d19afd0bd]
STDERR: 18  0x7f5d1a1d43fe /home/slave/webkitgtk/gtk-linux-64-debug/build/WebKitBuild/Debug/lib/libwebkit2gtk-3.0.so.25(_ZN7WebCore4Node16derefEventTargetEv+0x1c) [0x7f5d1a1d43fe]
STDERR: 19  0x7f5d19d77381 /home/slave/webkitgtk/gtk-linux-64-debug/build/WebKitBuild/Debug/lib/libwebkit2gtk-3.0.so.25(_ZN7WebCore11EventTarget5derefEv+0x23) [0x7f5d19d77381]
STDERR: 20  0x7f5d19d79818 /home/slave/webkitgtk/gtk-linux-64-debug/build/WebKitBuild/Debug/lib/libwebkit2gtk-3.0.so.25(_ZN3WTF14derefIfNotNullIN7WebCore11EventTargetEEEvPT_+0x28) [0x7f5d19d79818]
STDERR: 21  0x7f5d19da372b /home/slave/webkitgtk/gtk-linux-64-debug/build/WebKitBuild/Debug/lib/libwebkit2gtk-3.0.so.25(_ZN3WTF6RefPtrIN7WebCore11EventTargetEED1Ev+0x1b) [0x7f5d19da372b]
STDERR: 22  0x7f5d1a19ee12 /home/slave/webkitgtk/gtk-linux-64-debug/build/WebKitBuild/Debug/lib/libwebkit2gtk-3.0.so.25(_ZN7WebCore5EventD1Ev+0x3e) [0x7f5d1a19ee12]
STDERR: 23  0x7f5d1a19ee72 /home/slave/webkitgtk/gtk-linux-64-debug/build/WebKitBuild/Debug/lib/libwebkit2gtk-3.0.so.25(_ZN7WebCore5EventD0Ev+0x18) [0x7f5d1a19ee72]
STDERR: 24  0x7f5d19b87306 /home/slave/webkitgtk/gtk-linux-64-debug/build/WebKitBuild/Debug/lib/libwebkit2gtk-3.0.so.25(_ZN3WTF10RefCountedIN7WebCore5EventEE5derefEv+0x48) [0x7f5d19b87306]
STDERR: 25  0x7f5d1b115a18 /home/slave/webkitgtk/gtk-linux-64-debug/build/WebKitBuild/Debug/lib/libwebkit2gtk-3.0.so.25(_ZN7WebCore7JSEvent11releaseImplEv+0x20) [0x7f5d1b115a18]
STDERR: 26  0x7f5d1b115934 /home/slave/webkitgtk/gtk-linux-64-debug/build/WebKitBuild/Debug/lib/libwebkit2gtk-3.0.so.25(_ZN7WebCore12JSEventOwner8finalizeEN3JSC6HandleINS1_7UnknownEEEPv+0x6a) [0x7f5d1b115934]
STDERR: 27  0x7f5d1f94c15d /home/slave/webkitgtk/gtk-linux-64-debug/build/WebKitBuild/Debug/lib/libjavascriptcoregtk-3.0.so.0(_ZN3JSC9WeakBlock8finalizeEPNS_8WeakImplE+0xb5) [0x7f5d1f94c15d]
STDERR: 28  0x7f5d1f94bb7f /home/slave/webkitgtk/gtk-linux-64-debug/build/WebKitBuild/Debug/lib/libjavascriptcoregtk-3.0.so.0(_ZN3JSC9WeakBlock5sweepEv+0x89) [0x7f5d1f94bb7f]
STDERR: 29  0x7f5d1f94c4b8 /home/slave/webkitgtk/gtk-linux-64-debug/build/WebKitBuild/Debug/lib/libjavascriptcoregtk-3.0.so.0(_ZN3JSC7WeakSet5sweepEv+0x2e) [0x7f5d1f94c4b8]
STDERR: 30  0x7f5d1f94327a /home/slave/webkitgtk/gtk-linux-64-debug/build/WebKitBuild/Debug/lib/libjavascriptcoregtk-3.0.so.0(_ZN3JSC11MarkedBlock5sweepENS0_9SweepModeE+0x66) [0x7f5d1f94327a]
STDERR: 31  0x7f5d1f946199 /home/slave/webkitgtk/gtk-linux-64-debug/build/WebKitBuild/Debug/lib/libjavascriptcoregtk-3.0.so.0(_ZN3JSC5SweepclEPNS_11MarkedBlockE+0x21) [0x7f5d1f946199]

[Geoffrey Garen]

Created attachment 231030 [details]
Patch

[Mark Hahnenberg]

Comment on attachment 231030 [details]
Patch

r=me

[Geoffrey Garen]

Committed r168453: <http://trac.webkit.org/changeset/168453>

[WebKit Commit Bot]

The commit-queue just saw media/track/media-element-enqueue-event-crash.html flake (text diff) while processing attachment 303766 [details] on bug 169336.
Bot: webkit-cq-02  Port: <class 'webkitpy.common.config.ports.MacPort'>  Platform: Mac OS X 10.11.6

[WebKit Commit Bot]

Created attachment 303776 [details]
Archive of layout-test-results from webkit-cq-02