Bug 150008 – Inspector Process crashes - ASSERT(hasHash()) under JSC::InferredTypeTable::willStoreValue

• Component: Web Inspector
• Status: RESOLVED DUPLICATE

[Nikita Vasilyev]

ToT Inspector randomly crashes. Sometimes it crashes on about every page a few seconds after opening.

I entered the following in the terminal to log see inspector errors:
    
    defaults write com.apple.Safari "com.apple.Safari.ContentGroupPageIdentifier.WebKit2LogsPageMessagesToSystemConsoleEnabled" -bool YES
    defaults write com.apple.Safari WebKitLogsPageMessagesToSystemConsoleEnabled -bool YES

(via https://trac.webkit.org/wiki/WebInspectorDebugging#UsingLogginginsideWebInspectorUI)

Console output:
.../WebKitBuild/Release/WebInspectorUI.framework/Resources/Controllers/FormatterContentBuilder.js:171:23: CONSOLE ERROR
.../WebKitBuild/Release/WebInspectorUI.framework/Resources/Controllers/FormatterContentBuilder.js:171:23: CONSOLE ERROR
.../WebKitBuild/Release/WebInspectorUI.framework/Resources/Controllers/FormatterContentBuilder.js:171:23: CONSOLE ERROR
.../WebKitBuild/Release/WebInspectorUI.framework/Resources/Controllers/FormatterContentBuilder.js:171:23: CONSOLE ERROR
.../WebKitBuild/Release/WebInspectorUI.framework/Resources/Controllers/FormatterContentBuilder.js:171:23: CONSOLE ERROR
.../WebKitBuild/Release/WebInspectorUI.framework/Resources/Controllers/FormatterContentBuilder.js:171:23: CONSOLE ERROR

FormatterContentBuilder.js:171:23 is just a console.assert:

    dedent()
    {
        --this._indent;

        console.assert(this._indent >= 0);
        if (this._indent < 0)
            this._indent = 0;
    }


I don't think it's related to the crash.

How do I diagnose this?

[Radar WebKit Bug Importer]

<rdar://problem/23062146>

[Blaze Burg]

(In reply to comment #0)
> ToT Inspector randomly crashes. Sometimes it crashes on about every page a
> few seconds after opening.
> 
> How do I diagnose this?

Make a debug build and launch from command line. The crash stack trace should show up in the console. You can get a fuller dump from ReportCrash, which will add a report by default to the system Console.app.

The first thing to figure out is which process crashes, and the stack trace.

[Nikita Vasilyev]

(In reply to comment #2)
> (In reply to comment #0)
> > ToT Inspector randomly crashes. Sometimes it crashes on about every page a
> > few seconds after opening.
> > 
> > How do I diagnose this?
> 
> Make a debug build and launch from command line. The crash stack trace
> should show up in the console. You can get a fuller dump from ReportCrash,
> which will add a report by default to the system Console.app.
> 
> The first thing to figure out is which process crashes, and the stack trace.

I was wondering is there is an another way. The debug build is too slow.

[Nikita Vasilyev]

I caught a crash:


ASSERTION FAILED: hasHash()
/Users/nv/Code/Apple/OpenSource/WebKitBuild/Debug/usr/local/include/wtf/text/StringImpl.h(555) : unsigned int WTF::StringImpl::existingHash() const
1   0x11065f980 WTFCrash
2   0x10faf7915 WTF::StringImpl::existingHash() const
3   0x10faf78a2 WTF::StringImpl::existingSymbolAwareHash() const
4   0x10faf7835 JSC::IdentifierRepHash::hash(WTF::UniquedStringImpl*)
5   0x10fb85078 unsigned int WTF::IdentityHashTranslator<JSC::IdentifierRepHash>::hash<WTF::UniquedStringImpl*>(WTF::UniquedStringImpl* const&)
6   0x110122413 std::__1::pair<WTF::KeyValuePair<WTF::UniquedStringImpl*, JSC::WriteBarrier<JSC::InferredType> >*, bool> WTF::HashTable<WTF::UniquedStringImpl*, WTF::KeyValuePair<WTF::UniquedStringImpl*, JSC::WriteBarrier<JSC::InferredType> >, WTF::KeyValuePairKeyExtractor<WTF::KeyValuePair<WTF::UniquedStringImpl*, JSC::WriteBarrier<JSC::InferredType> > >, JSC::IdentifierRepHash, WTF::HashMap<WTF::RefPtr<WTF::UniquedStringImpl>, JSC::WriteBarrier<JSC::InferredType>, JSC::IdentifierRepHash, WTF::HashTraits<WTF::UniquedStringImpl*>, WTF::HashTraits<JSC::WriteBarrier<JSC::InferredType> > >::KeyValuePairTraits, WTF::HashTraits<WTF::UniquedStringImpl*> >::lookupForWriting<WTF::IdentityHashTranslator<JSC::IdentifierRepHash>, WTF::UniquedStringImpl*>(WTF::UniquedStringImpl* const&)
7   0x110122359 WTF::HashTable<WTF::UniquedStringImpl*, WTF::KeyValuePair<WTF::UniquedStringImpl*, JSC::WriteBarrier<JSC::InferredType> >, WTF::KeyValuePairKeyExtractor<WTF::KeyValuePair<WTF::UniquedStringImpl*, JSC::WriteBarrier<JSC::InferredType> > >, JSC::IdentifierRepHash, WTF::HashMap<WTF::RefPtr<WTF::UniquedStringImpl>, JSC::WriteBarrier<JSC::InferredType>, JSC::IdentifierRepHash, WTF::HashTraits<WTF::UniquedStringImpl*>, WTF::HashTraits<JSC::WriteBarrier<JSC::InferredType> > >::KeyValuePairTraits, WTF::HashTraits<WTF::UniquedStringImpl*> >::lookupForWriting(WTF::UniquedStringImpl* const&)
8   0x110122223 WTF::HashTable<WTF::UniquedStringImpl*, WTF::KeyValuePair<WTF::UniquedStringImpl*, JSC::WriteBarrier<JSC::InferredType> >, WTF::KeyValuePairKeyExtractor<WTF::KeyValuePair<WTF::UniquedStringImpl*, JSC::WriteBarrier<JSC::InferredType> > >, JSC::IdentifierRepHash, WTF::HashMap<WTF::RefPtr<WTF::UniquedStringImpl>, JSC::WriteBarrier<JSC::InferredType>, JSC::IdentifierRepHash, WTF::HashTraits<WTF::UniquedStringImpl*>, WTF::HashTraits<JSC::WriteBarrier<JSC::InferredType> > >::KeyValuePairTraits, WTF::HashTraits<WTF::UniquedStringImpl*> >::reinsert(WTF::KeyValuePair<WTF::UniquedStringImpl*, JSC::WriteBarrier<JSC::InferredType> >&&)
9   0x1101220a5 WTF::HashTable<WTF::UniquedStringImpl*, WTF::KeyValuePair<WTF::UniquedStringImpl*, JSC::WriteBarrier<JSC::InferredType> >, WTF::KeyValuePairKeyExtractor<WTF::KeyValuePair<WTF::UniquedStringImpl*, JSC::WriteBarrier<JSC::InferredType> > >, JSC::IdentifierRepHash, WTF::HashMap<WTF::RefPtr<WTF::UniquedStringImpl>, JSC::WriteBarrier<JSC::InferredType>, JSC::IdentifierRepHash, WTF::HashTraits<WTF::UniquedStringImpl*>, WTF::HashTraits<JSC::WriteBarrier<JSC::InferredType> > >::KeyValuePairTraits, WTF::HashTraits<WTF::UniquedStringImpl*> >::rehash(unsigned int, WTF::KeyValuePair<WTF::UniquedStringImpl*, JSC::WriteBarrier<JSC::InferredType> >*)
10  0x110121e58 WTF::HashTable<WTF::UniquedStringImpl*, WTF::KeyValuePair<WTF::UniquedStringImpl*, JSC::WriteBarrier<JSC::InferredType> >, WTF::KeyValuePairKeyExtractor<WTF::KeyValuePair<WTF::UniquedStringImpl*, JSC::WriteBarrier<JSC::InferredType> > >, JSC::IdentifierRepHash, WTF::HashMap<WTF::RefPtr<WTF::UniquedStringImpl>, JSC::WriteBarrier<JSC::InferredType>, JSC::IdentifierRepHash, WTF::HashTraits<WTF::UniquedStringImpl*>, WTF::HashTraits<JSC::WriteBarrier<JSC::InferredType> > >::KeyValuePairTraits, WTF::HashTraits<WTF::UniquedStringImpl*> >::expand(WTF::KeyValuePair<WTF::UniquedStringImpl*, JSC::WriteBarrier<JSC::InferredType> >*)
11  0x110121c8e WTF::HashTableAddResult<WTF::HashTableIterator<WTF::UniquedStringImpl*, WTF::KeyValuePair<WTF::UniquedStringImpl*, JSC::WriteBarrier<JSC::InferredType> >, WTF::KeyValuePairKeyExtractor<WTF::KeyValuePair<WTF::UniquedStringImpl*, JSC::WriteBarrier<JSC::InferredType> > >, JSC::IdentifierRepHash, WTF::HashMap<WTF::RefPtr<WTF::UniquedStringImpl>, JSC::WriteBarrier<JSC::InferredType>, JSC::IdentifierRepHash, WTF::HashTraits<WTF::UniquedStringImpl*>, WTF::HashTraits<JSC::WriteBarrier<JSC::InferredType> > >::KeyValuePairTraits, WTF::HashTraits<WTF::UniquedStringImpl*> > > WTF::HashTable<WTF::UniquedStringImpl*, WTF::KeyValuePair<WTF::UniquedStringImpl*, JSC::WriteBarrier<JSC::InferredType> >, WTF::KeyValuePairKeyExtractor<WTF::KeyValuePair<WTF::UniquedStringImpl*, JSC::WriteBarrier<JSC::InferredType> > >, JSC::IdentifierRepHash, WTF::HashMap<WTF::RefPtr<WTF::UniquedStringImpl>, JSC::WriteBarrier<JSC::InferredType>, JSC::IdentifierRepHash, WTF::HashTraits<WTF::UniquedStringImpl*>, WTF::HashTraits<JSC::WriteBarrier<JSC::InferredType> > >::KeyValuePairTraits, WTF::HashTraits<WTF::UniquedStringImpl*> >::add<WTF::HashMapTranslator<WTF::HashMap<WTF::RefPtr<WTF::UniquedStringImpl>, JSC::WriteBarrier<JSC::InferredType>, JSC::IdentifierRepHash, WTF::HashTraits<WTF::UniquedStringImpl*>, WTF::HashTraits<JSC::WriteBarrier<JSC::InferredType> > >::KeyValuePairTraits, JSC::IdentifierRepHash>, WTF::UniquedStringImpl*, JSC::WriteBarrier<JSC::InferredType> >(WTF::UniquedStringImpl*&&, JSC::WriteBarrier<JSC::InferredType>&&)
12  0x110121a2c WTF::HashTableAddResult<WTF::HashTableIterator<WTF::UniquedStringImpl*, WTF::KeyValuePair<WTF::UniquedStringImpl*, JSC::WriteBarrier<JSC::InferredType> >, WTF::KeyValuePairKeyExtractor<WTF::KeyValuePair<WTF::UniquedStringImpl*, JSC::WriteBarrier<JSC::InferredType> > >, JSC::IdentifierRepHash, WTF::HashMap<WTF::RefPtr<WTF::UniquedStringImpl>, JSC::WriteBarrier<JSC::InferredType>, JSC::IdentifierRepHash, WTF::HashTraits<WTF::UniquedStringImpl*>, WTF::HashTraits<JSC::WriteBarrier<JSC::InferredType> > >::KeyValuePairTraits, WTF::HashTraits<WTF::UniquedStringImpl*> > > WTF::HashMap<WTF::RefPtr<WTF::UniquedStringImpl>, JSC::WriteBarrier<JSC::InferredType>, JSC::IdentifierRepHash, WTF::HashTraits<WTF::UniquedStringImpl*>, WTF::HashTraits<JSC::WriteBarrier<JSC::InferredType> > >::inlineAdd<WTF::UniquedStringImpl*, JSC::WriteBarrier<JSC::InferredType> >(WTF::UniquedStringImpl*&&, JSC::WriteBarrier<JSC::InferredType>&&)
13  0x11011fe2f WTF::HashTableAddResult<WTF::HashTableIterator<WTF::UniquedStringImpl*, WTF::KeyValuePair<WTF::UniquedStringImpl*, JSC::WriteBarrier<JSC::InferredType> >, WTF::KeyValuePairKeyExtractor<WTF::KeyValuePair<WTF::UniquedStringImpl*, JSC::WriteBarrier<JSC::InferredType> > >, JSC::IdentifierRepHash, WTF::HashMap<WTF::RefPtr<WTF::UniquedStringImpl>, JSC::WriteBarrier<JSC::InferredType>, JSC::IdentifierRepHash, WTF::HashTraits<WTF::UniquedStringImpl*>, WTF::HashTraits<JSC::WriteBarrier<JSC::InferredType> > >::KeyValuePairTraits, WTF::HashTraits<WTF::UniquedStringImpl*> > > WTF::HashMap<WTF::RefPtr<WTF::UniquedStringImpl>, JSC::WriteBarrier<JSC::InferredType>, JSC::IdentifierRepHash, WTF::HashTraits<WTF::UniquedStringImpl*>, WTF::HashTraits<JSC::WriteBarrier<JSC::InferredType> > >::add<JSC::WriteBarrier<JSC::InferredType> >(WTF::UniquedStringImpl*&&, JSC::WriteBarrier<JSC::InferredType>&&)
14  0x11011f3f6 JSC::InferredTypeTable::willStoreValue(JSC::VM&, JSC::PropertyName, JSC::JSValue, JSC::InferredTypeTable::StoredPropertyAge)
15  0x1105a1d60 JSC::Structure::willStoreValueSlow(JSC::VM&, JSC::PropertyName, JSC::JSValue, bool, JSC::InferredTypeTable::StoredPropertyAge)
16  0x10faf18f2 JSC::Structure::willStoreValueForNewTransition(JSC::VM&, JSC::PropertyName, JSC::JSValue, bool)
17  0x1102a8907 bool JSC::JSObject::putDirectInternal<(JSC::JSObject::PutMode)0>(JSC::VM&, JSC::PropertyName, JSC::JSValue, unsigned int, JSC::PutPropertySlot&)
18  0x1102da957 JSC::JSObject::put(JSC::JSCell*, JSC::ExecState*, JSC::PropertyName, JSC::JSValue, JSC::PutPropertySlot&)
19  0x10fe974e9 JSC::JSValue::put(JSC::ExecState*, JSC::PropertyName, JSC::JSValue, JSC::PutPropertySlot&)
20  0x11038d1b6 llint_slow_path_put_by_id
21  0x1103997d5 llint_entry
22  0x11039cba7 llint_entry
23  0x11039cb2d llint_entry
24  0x11039cba7 llint_entry
25  0x1103962fe vmEntryToJavaScript
26  0x1101f3275 JSC::JITCode::execute(JSC::VM*, JSC::ProtoCallFrame*)
27  0x1101ca7a2 JSC::Interpreter::executeCall(JSC::ExecState*, JSC::JSObject*, JSC::CallType, JSC::CallData const&, JSC::JSValue, JSC::ArgList const&)
28  0x10fb97c8e JSC::call(JSC::ExecState*, JSC::JSValue, JSC::CallType, JSC::CallData const&, JSC::JSValue, JSC::ArgList const&)
29  0x110238a5d JSC::boundFunctionCall(JSC::ExecState*)
30  0x45c80c401028
31  0x45c80c9b17a8
2015-10-14 12:37:50.280 com.apple.WebKit.WebContent.Development[28341:5861794] ### Failed to load Addressbook class CNContactNameFormatter
LEAK: 1 WebFrame
LEAK: 3 CachedResource

[Blaze Burg]

(In reply to comment #3)
> (In reply to comment #2)
> > (In reply to comment #0)
> > > ToT Inspector randomly crashes. Sometimes it crashes on about every page a
> > > few seconds after opening.
> > > 
> > > How do I diagnose this?
> > 
> > Make a debug build and launch from command line. The crash stack trace
> > should show up in the console. You can get a fuller dump from ReportCrash,
> > which will add a report by default to the system Console.app.
> > 
> > The first thing to figure out is which process crashes, and the stack trace.
> 
> I was wondering is there is an another way. The debug build is too slow.

Too slow for what? It should still be possible to use the inspector in a debug build; only the 2nd-level inspector is seriously/unusably slow in a debug build. If this is not the case, then we are encountering performance bugs as well.

[Joseph Pecoraro]

+ Phil Pizlo and Geoffrey Garen

InferredTypeTable was recently added (9/21). Nikita saw an ASSERT under InferredTypeTable::willStoreValue.

Nikita
- steps to reproduce, however vague, are always helpful
- did you only see this ASSERT once? multiple times?

[Joseph Pecoraro]

> FormatterContentBuilder.js:171:23 is just a console.assert:

Could you file a separate bug on this console.assert in inspector? Do you remember the page you were on when you saw this output? This means that when attempting to pretty-print JS or CSS we miscalculated indentation, probably resulting in a poor pretty print. In this case, we tried to decent too much, so that isn't too bad, but would still be worth investigating.

[Joseph Pecoraro]

(In reply to comment #0)
> ToT Inspector randomly crashes.
>
> How do I diagnose this?

If a process crashes, it will generate a Crash Report. On OS X you can open the Console.app and expand "User Diagnostic Reports" in the left sidebar. You should be able to find "com.apple.WebKit.WebContent..." crash reports for WebContent processes. Attaching the crash report that corresponds to these crashes would be very important.

I'm going to re-title this bug around the ASSERT you detected below.

[Nikita Vasilyev]

Created attachment 263124 [details]
com.apple.WebKit.WebContent crash log

(In reply to comment #8)
> (In reply to comment #0)
> > ToT Inspector randomly crashes.
> >
> > How do I diagnose this?
> 
> If a process crashes, it will generate a Crash Report. On OS X you can open
> the Console.app and expand "User Diagnostic Reports" in the left sidebar.
> You should be able to find "com.apple.WebKit.WebContent..." crash reports
> for WebContent processes. Attaching the crash report that corresponds to
> these crashes would be very important.

Attached.

[Filip Pizlo]

*** This bug has been marked as a duplicate of bug 150138 ***