Bug 151929

Summary: REGRESSION(r193584): Causes heap use-after-free crashes in Web Inspector tests with AddressSanitizer (Requested by ddkilzer on #webkit).
Product: WebKit Reporter: WebKit Commit Bot <commit-queue>
Component: New BugsAssignee: WebKit Commit Bot <commit-queue>
Status: RESOLVED FIXED    
Severity: Normal CC: ddkilzer, gskachkov, keith_miller, mark.lam, msaboff, saam
Priority: P2    
Version: WebKit Nightly Build   
Hardware: Unspecified   
OS: Unspecified   
Bug Depends on:    
Bug Blocks: 149338    
Attachments:
Description Flags
ROLLOUT of r193584
none
Manual rollout ddkilzer: review+, commit-queue: commit-queue-

WebKit Commit Bot
Reported 2015-12-06 17:08:22 PST
http://trac.webkit.org/changeset/193584 broke the build: "Causes heap use-after-free crashes in Web Inspector tests with AddressSanitizer" (Requested by ddkilzer on #webkit). This is an automatic bug report generated by webkitbot. If this bug report was created because of a flaky test, please file a bug for the flaky test (if we don't already have one on file) and dup this bug against that bug so that we can track how often these flaky tests fail.
Attachments
ROLLOUT of r193584 (134.97 KB, patch)
2015-12-06 17:09 PST, WebKit Commit Bot 		no flags
DetailsFormatted DiffDiff
Manual rollout (134.01 KB, patch)
2015-12-06 17:26 PST, David Kilzer (:ddkilzer) 		ddkilzer: review+
commit-queue: commit-queue-
DetailsFormatted DiffDiff
Show Obsolete (1) View All Add attachment proposed patch, testcase, etc.
WebKit Commit Bot
Comment 1 2015-12-06 17:09:11 PST
Created attachment 266746 [details] ROLLOUT of r193584 Any committer can land this patch automatically by marking it commit-queue+. The commit-queue will build and test the patch before landing to ensure that the rollout will be successful. This process takes approximately 15 minutes. If you would like to land the rollout faster, you can use the following command: webkit-patch land-attachment ATTACHMENT_ID where ATTACHMENT_ID is the ID of this attachment.
WebKit Commit Bot
Comment 2 2015-12-06 17:12:08 PST
Comment on attachment 266746 [details] ROLLOUT of r193584 Rejecting attachment 266746 [details] from commit-queue. Failed to run "['/Volumes/Data/EWS/WebKit/Tools/Scripts/webkit-patch', '--status-host=webkit-queues.webkit.org', '--bot-id=webkit-cq-03', 'apply-attachment', '--no-update', '--non-interactive', 266746, '--port=mac']" exit_code: 2 cwd: /Volumes/Data/EWS/WebKit Last 500 characters of output: l-expected.txt' patching file LayoutTests/js/arrowfunction-supercall.html rm 'LayoutTests/js/arrowfunction-supercall.html' patching file LayoutTests/js/arrowfunction-tdz-expected.txt patching file LayoutTests/js/script-tests/arrowfunction-supercall.js rm 'LayoutTests/js/script-tests/arrowfunction-supercall.js' patching file LayoutTests/js/script-tests/arrowfunction-tdz.js Failed to run "[u'/Volumes/Data/EWS/WebKit/Tools/Scripts/svn-apply', '--force']" exit_code: 1 cwd: /Volumes/Data/EWS/WebKit Full output: http://webkit-queues.webkit.org/results/525904
David Kilzer (:ddkilzer)
Comment 3 2015-12-06 17:13:47 PST
Here's the crash log: Process: DumpRenderTree [66460] Path: /Volumes/VOLUME/*/DumpRenderTree Identifier: DumpRenderTree Version: 0 Code Type: X86-64 (Native) Parent Process: Python [66459] Responsible: bash [243] User ID: 501 Date/Time: 2015-12-06 14:22:10.237 -0800 OS Version: Mac OS X 10.10.5 (14F27) Report Version: 11 Anonymous UUID: E89566B6-171C-0D5F-266C-BBB64251FD15 Time Awake Since Boot: 2900000 seconds Crashed Thread: 0 Dispatch queue: com.apple.main-thread Exception Type: EXC_CRASH (SIGABRT) Exception Codes: 0x0000000000000000, 0x0000000000000000 Application Specific Information: CRASHING TEST: http/tests/inspector/console/cross-domain-inspected-node-access.html ================================================================ ==66460==ERROR: AddressSanitizer: heap-use-after-free on address 0x6130003fd448 at pc 0x00010a936fd6 bp 0x7fff566ce5e0 sp 0x7fff566ce5d8 READ of size 4 at 0x6130003fd448 thread T0 #0 0x10a936fd5 in 2015-12-06 14:22:09.192 atos[66756:15474146] Metadata.framework [Error]: couldn't get the client port (JavaScriptCore.framework/Versions/A/JavaScriptCore+0x462fd5) #1 0x10a5354af in JSC::RegisterID::deref() (JavaScriptCore.framework/Versions/A/JavaScriptCore+0x614af) #2 0x10b50249a in JSC::BytecodeGenerator::~BytecodeGenerator() (JavaScriptCore.framework/Versions/A/JavaScriptCore+0x102e49a) #3 0x10b501fd6 in JSC::generateUnlinkedFunctionCodeBlock(JSC::VM&, JSC::UnlinkedFunctionExecutable*, JSC::SourceCode const&, JSC::CodeSpecializationKind, JSC::DebuggerMode, JSC::ProfilerMode, JSC::UnlinkedFunctionKind, JSC::ParserError&, JSC::SourceParseMode) (JavaScriptCore.framework/Versions/A/JavaScriptCore+0x102dfd6) #4 0x10adea5a1 in JSC::UnlinkedFunctionExecutable::unlinkedCodeBlockFor(JSC::VM&, JSC::SourceCode const&, JSC::CodeSpecializationKind, JSC::DebuggerMode, JSC::ProfilerMode, JSC::ParserError&, JSC::SourceParseMode) (JavaScriptCore.framework/Versions/A/JavaScriptCore+0x9165a1) #5 0x10adeae0f in JSC::ScriptExecutable::newCodeBlockFor(JSC::CodeSpecializationKind, JSC::JSFunction*, JSC::JSScope*, JSC::JSObject*&) (JavaScriptCore.framework/Versions/A/JavaScriptCore+0x916e0f) #6 0x10a5374c9 in JSC::ScriptExecutable::prepareForExecutionImpl(JSC::ExecState*, JSC::JSFunction*, JSC::JSScope*, JSC::CodeSpecializationKind) (JavaScriptCore.framework/Versions/A/JavaScriptCore+0x634c9) #7 0x10b2a603c in JSC::LLInt::setUpCall(JSC::ExecState*, JSC::Instruction*, JSC::CodeSpecializationKind, JSC::JSValue, JSC::LLIntCallLinkInfo*) (JavaScriptCore.framework/Versions/A/JavaScriptCore+0xdd203c) #8 0x10b2a027a in llint_entry (JavaScriptCore.framework/Versions/A/JavaScriptCore+0xdcc27a) #9 0x10b04d09d in vmEntryToJavaScript (JavaScriptCore.framework/Versions/A/JavaScriptCore+0xb7909d) #10 0x10a53bb54 in JSC::JITCode::execute(JSC::VM*, JSC::ProtoCallFrame*) (JavaScriptCore.framework/Versions/A/JavaScriptCore+0x67b54) #11 0x10a53b7b1 in JSC::Interpreter::executeCall(JSC::ExecState*, JSC::JSObject*, JSC::CallType, JSC::CallData const&, JSC::JSValue, JSC::ArgList const&) (JavaScriptCore.framework/Versions/A/JavaScriptCore+0x677b1) #12 0x10b11d167 in JSC::call(JSC::ExecState*, JSC::JSValue, JSC::CallType, JSC::CallData const&, JSC::JSValue, JSC::ArgList const&) (JavaScriptCore.framework/Versions/A/JavaScriptCore+0xc49167) #13 0x10ec4251d in JSC::JSJobMicrotask::run(JSC::ExecState*) (WebCore.framework/Versions/A/WebCore+0x13ea51d) #14 0x10ecf1c15 in WebCore::JSMainThreadExecState::runTask(JSC::ExecState*, JSC::Microtask&) (WebCore.framework/Versions/A/WebCore+0x1499c15) #15 0x10e25e518 in WebCore::JSDOMWindowMicrotaskCallback::call() (WebCore.framework/Versions/A/WebCore+0xa06518) #16 0x10f49b0d5 in WebCore::ActiveDOMCallbackMicrotask::run() (WebCore.framework/Versions/A/WebCore+0x1c430d5) #17 0x10eb59652 in WebCore::MicrotaskQueue::performMicrotaskCheckpoint() (WebCore.framework/Versions/A/WebCore+0x1301652) #18 0x10eb59437 in WebCore::JSMainThreadExecState::~JSMainThreadExecState() (WebCore.framework/Versions/A/WebCore+0x1301437) #19 0x10f9bfc2b in WebCore::JSMainThreadExecState::call(JSC::ExecState*, JSC::JSValue, JSC::CallType, JSC::CallData const&, JSC::JSValue, JSC::ArgList const&, WTF::NakedPtr<JSC::Exception>&) (WebCore.framework/Versions/A/WebCore+0x2167c2b) #20 0x10f9bf692 in WebCore::ScheduledAction::executeFunctionInContext(JSC::JSGlobalObject*, JSC::JSValue, WebCore::ScriptExecutionContext&) (WebCore.framework/Versions/A/WebCore+0x2167692) #21 0x10da5d6a6 in WebCore::ScheduledAction::execute(WebCore::Document&) (WebCore.framework/Versions/A/WebCore+0x2056a6) #22 0x10d878b24 in WebCore::DOMTimer::fired() (WebCore.framework/Versions/A/WebCore+0x20b24) #23 0x10d87893f in WebCore::ThreadTimers::sharedTimerFiredInternal() (WebCore.framework/Versions/A/WebCore+0x2093f) #24 0x7fff9763f2e3 in WebCore::timerFired(__CFRunLoopTimer*, void*) (/System/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation+0xb72e3) #25 0x7fff9763ef72 in __CFRUNLOOP_IS_CALLING_OUT_TO_A_TIMER_CALLBACK_FUNCTION__ (/System/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation+0xb6f72) #26 0x7fff976b253c in __CFRunLoopDoTimer (/System/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation+0x12a53c) #27 0x7fff975fa607 in __CFRunLoopDoTimers (/System/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation+0x72607) #28 0x7fff975f9bd7 in __CFRunLoopRun (/System/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation+0x71bd7) #29 0x10954f2cd in CFRunLoopRunSpecific (DumpRenderTree+0x1000222cd) #30 0x10954e849 in 0x000000010954f2cd (DumpRenderTree+0x100021849) #31 0x10954db77 in 0x000000010954e849 (DumpRenderTree+0x100020b77) #32 0x10954fbd1 in 0x000000010954db77 (DumpRenderTree+0x100022bd1) #33 0x7fff94e6e5c8 in 0x000000010954fbd1 (/usr/lib/system/libdyld.dylib+0x35c8) #34 0x1 (<unknown module>) 0x6130003fd448 is located 72 bytes inside of 384-byte region [0x6130003fd400,0x6130003fd580) freed by thread T0 here: #0 0x109675679 in start (/Applications/Xcode.app/Contents/Developer/Toolchains/XcodeDefault.xctoolchain/usr/lib/clang/7.0.0/lib/darwin/libclang_rt.asan_osx_dynamic.dylib+0x42679) #1 0x10b5dbdf0 in wrap_free (JavaScriptCore.framework/Versions/A/JavaScriptCore+0x1107df0) #2 0x10a954551 in bmalloc::Deallocator::deallocateSlowCase(void*) (JavaScriptCore.framework/Versions/A/JavaScriptCore+0x480551) #3 0x10a9544ad in WTF::SegmentedVector<JSC::RegisterID, 32ul>::deleteAllSegments() (JavaScriptCore.framework/Versions/A/JavaScriptCore+0x4804ad) #4 0x10a535456 in WTF::SegmentedVector<JSC::RegisterID, 32ul>::~SegmentedVector() (JavaScriptCore.framework/Versions/A/JavaScriptCore+0x61456) #5 0x10b50249a in JSC::BytecodeGenerator::~BytecodeGenerator() (JavaScriptCore.framework/Versions/A/JavaScriptCore+0x102e49a) #6 0x10b501fd6 in JSC::generateUnlinkedFunctionCodeBlock(JSC::VM&, JSC::UnlinkedFunctionExecutable*, JSC::SourceCode const&, JSC::CodeSpecializationKind, JSC::DebuggerMode, JSC::ProfilerMode, JSC::UnlinkedFunctionKind, JSC::ParserError&, JSC::SourceParseMode) (JavaScriptCore.framework/Versions/A/JavaScriptCore+0x102dfd6) #7 0x10adea5a1 in JSC::UnlinkedFunctionExecutable::unlinkedCodeBlockFor(JSC::VM&, JSC::SourceCode const&, JSC::CodeSpecializationKind, JSC::DebuggerMode, JSC::ProfilerMode, JSC::ParserError&, JSC::SourceParseMode) (JavaScriptCore.framework/Versions/A/JavaScriptCore+0x9165a1) #8 0x10adeae0f in JSC::ScriptExecutable::newCodeBlockFor(JSC::CodeSpecializationKind, JSC::JSFunction*, JSC::JSScope*, JSC::JSObject*&) (JavaScriptCore.framework/Versions/A/JavaScriptCore+0x916e0f) #9 0x10a5374c9 in JSC::ScriptExecutable::prepareForExecutionImpl(JSC::ExecState*, JSC::JSFunction*, JSC::JSScope*, JSC::CodeSpecializationKind) (JavaScriptCore.framework/Versions/A/JavaScriptCore+0x634c9) #10 0x10b2a603c in JSC::LLInt::setUpCall(JSC::ExecState*, JSC::Instruction*, JSC::CodeSpecializationKind, JSC::JSValue, JSC::LLIntCallLinkInfo*) (JavaScriptCore.framework/Versions/A/JavaScriptCore+0xdd203c) #11 0x10b2a027a in llint_entry (JavaScriptCore.framework/Versions/A/JavaScriptCore+0xdcc27a) #12 0x10b04d09d in vmEntryToJavaScript (JavaScriptCore.framework/Versions/A/JavaScriptCore+0xb7909d) #13 0x10a53bb54 in JSC::JITCode::execute(JSC::VM*, JSC::ProtoCallFrame*) (JavaScriptCore.framework/Versions/A/JavaScriptCore+0x67b54) #14 0x10a53b7b1 in JSC::Interpreter::executeCall(JSC::ExecState*, JSC::JSObject*, JSC::CallType, JSC::CallData const&, JSC::JSValue, JSC::ArgList const&) (JavaScriptCore.framework/Versions/A/JavaScriptCore+0x677b1) #15 0x10b11d167 in JSC::call(JSC::ExecState*, JSC::JSValue, JSC::CallType, JSC::CallData const&, JSC::JSValue, JSC::ArgList const&) (JavaScriptCore.framework/Versions/A/JavaScriptCore+0xc49167) #16 0x10ec4251d in JSC::JSJobMicrotask::run(JSC::ExecState*) (WebCore.framework/Versions/A/WebCore+0x13ea51d) #17 0x10ecf1c15 in WebCore::JSMainThreadExecState::runTask(JSC::ExecState*, JSC::Microtask&) (WebCore.framework/Versions/A/WebCore+0x1499c15) #18 0x10e25e518 in WebCore::JSDOMWindowMicrotaskCallback::call() (WebCore.framework/Versions/A/WebCore+0xa06518) #19 0x10f49b0d5 in WebCore::ActiveDOMCallbackMicrotask::run() (WebCore.framework/Versions/A/WebCore+0x1c430d5) #20 0x10eb59652 in WebCore::MicrotaskQueue::performMicrotaskCheckpoint() (WebCore.framework/Versions/A/WebCore+0x1301652) #21 0x10eb59437 in WebCore::JSMainThreadExecState::~JSMainThreadExecState() (WebCore.framework/Versions/A/WebCore+0x1301437) #22 0x10f9bfc2b in WebCore::JSMainThreadExecState::call(JSC::ExecState*, JSC::JSValue, JSC::CallType, JSC::CallData const&, JSC::JSValue, JSC::ArgList const&, WTF::NakedPtr<JSC::Exception>&) (WebCore.framework/Versions/A/WebCore+0x2167c2b) #23 0x10f9bf692 in WebCore::ScheduledAction::executeFunctionInContext(JSC::JSGlobalObject*, JSC::JSValue, WebCore::ScriptExecutionContext&) (WebCore.framework/Versions/A/WebCore+0x2167692) #24 0x10da5d6a6 in WebCore::ScheduledAction::execute(WebCore::Document&) (WebCore.framework/Versions/A/WebCore+0x2056a6) #25 0x10d878b24 in WebCore::DOMTimer::fired() (WebCore.framework/Versions/A/WebCore+0x20b24) #26 0x10d87893f in WebCore::ThreadTimers::sharedTimerFiredInternal() (WebCore.framework/Versions/A/WebCore+0x2093f) #27 0x7fff9763f2e3 in WebCore::timerFired(__CFRunLoopTimer*, void*) (/System/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation+0xb72e3) #28 0x7fff9763ef72 in __CFRUNLOOP_IS_CALLING_OUT_TO_A_TIMER_CALLBACK_FUNCTION__ (/System/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation+0xb6f72) #29 0x7fff976b253c in __CFRunLoopDoTimer (/System/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation+0x12a53c) previously allocated by thread T0 here: #0 0x1096754b0 in __CFRunLoopDoTimers (/Applications/Xcode.app/Contents/Developer/Toolchains/XcodeDefault.xctoolchain/usr/lib/clang/7.0.0/lib/darwin/libclang_rt.asan_osx_dynamic.dylib+0x424b0) #1 0x10b5d2520 in wrap_malloc (JavaScriptCore.framework/Versions/A/JavaScriptCore+0x10fe520) #2 0x10b596e65 in bmalloc::Allocator::allocateSlowCase(unsigned long) (JavaScriptCore.framework/Versions/A/JavaScriptCore+0x10c2e65) #3 0x10a959b2b in bmalloc::Allocator::allocate(unsigned long) (JavaScriptCore.framework/Versions/A/JavaScriptCore+0x485b2b) #4 0x10a935206 in WTF::SegmentedVector<JSC::RegisterID, 32ul>::allocateSegment() (JavaScriptCore.framework/Versions/A/JavaScriptCore+0x461206) #5 0x10a9152bd in void WTF::SegmentedVector<JSC::RegisterID, 32ul>::append<JSC::VirtualRegister>(JSC::VirtualRegister&&) (JavaScriptCore.framework/Versions/A/JavaScriptCore+0x4412bd) #6 0x10a9332e9 in JSC::BytecodeGenerator::newRegister() (JavaScriptCore.framework/Versions/A/JavaScriptCore+0x45f2e9) #7 0x10a9069b8 in JSC::BytecodeGenerator::addVar() (JavaScriptCore.framework/Versions/A/JavaScriptCore+0x4329b8) #8 0x10a908688 in JSC::BytecodeGenerator::allocateCalleeSaveSpace() (JavaScriptCore.framework/Versions/A/JavaScriptCore+0x434688) #9 0x10b50351a in JSC::BytecodeGenerator::BytecodeGenerator(JSC::VM&, JSC::FunctionNode*, JSC::UnlinkedFunctionCodeBlock*, JSC::DebuggerMode, JSC::ProfilerMode, JSC::VariableEnvironment const*) (JavaScriptCore.framework/Versions/A/ abort() called Thread 0 Crashed:: Dispatch queue: com.apple.main-thread 0 libsystem_kernel.dylib 0x00007fff91a41286 __pthread_kill + 10 1 libsystem_c.dylib 0x00007fff97b189b3 abort + 129 2 libclang_rt.asan_osx_dynamic.dylib 0x000000010968ad76 __sanitizer::Abort() + 6 3 libclang_rt.asan_osx_dynamic.dylib 0x000000010967eab1 __asan::AsanDie() + 209 4 libclang_rt.asan_osx_dynamic.dylib 0x000000010968224d __sanitizer::Die() + 29 5 libclang_rt.asan_osx_dynamic.dylib 0x000000010967d801 __asan::ScopedInErrorReport::~ScopedInErrorReport() + 305 6 libclang_rt.asan_osx_dynamic.dylib 0x000000010967d5b6 __asan::ScopedInErrorReport::~ScopedInErrorReport() + 6 7 libclang_rt.asan_osx_dynamic.dylib 0x000000010967d134 __asan_report_error + 3924 8 libclang_rt.asan_osx_dynamic.dylib 0x000000010967da47 __asan_report_load4 + 39 9 com.apple.JavaScriptCore 0x000000010a936fd6 JSC::RegisterID::deref() + 54 10 com.apple.JavaScriptCore 0x000000010a5354b0 JSC::BytecodeGenerator::~BytecodeGenerator() + 464 11 com.apple.JavaScriptCore 0x000000010b50249b JSC::generateUnlinkedFunctionCodeBlock(JSC::VM&, JSC::UnlinkedFunctionExecutable*, JSC::SourceCode const&, JSC::CodeSpecializationKind, JSC::DebuggerMode, JSC::ProfilerMode, JSC::UnlinkedFunctionKind, JSC::ParserError&, JSC::SourceParseMode) + 1147 12 com.apple.JavaScriptCore 0x000000010b501fd7 JSC::UnlinkedFunctionExecutable::unlinkedCodeBlockFor(JSC::VM&, JSC::SourceCode const&, JSC::CodeSpecializationKind, JSC::DebuggerMode, JSC::ProfilerMode, JSC::ParserError&, JSC::SourceParseMode) + 119 13 com.apple.JavaScriptCore 0x000000010adea5a2 JSC::ScriptExecutable::newCodeBlockFor(JSC::CodeSpecializationKind, JSC::JSFunction*, JSC::JSScope*, JSC::JSObject*&) + 514 14 com.apple.JavaScriptCore 0x000000010adeae10 JSC::ScriptExecutable::prepareForExecutionImpl(JSC::ExecState*, JSC::JSFunction*, JSC::JSScope*, JSC::CodeSpecializationKind) + 496 15 com.apple.JavaScriptCore 0x000000010a5374ca JSC::LLInt::setUpCall(JSC::ExecState*, JSC::Instruction*, JSC::CodeSpecializationKind, JSC::JSValue, JSC::LLIntCallLinkInfo*) + 522 16 com.apple.JavaScriptCore 0x000000010b2a603d llint_entry + 23519 17 com.apple.JavaScriptCore 0x000000010b2a027b vmEntryToJavaScript + 299 18 com.apple.JavaScriptCore 0x000000010b04d09e JSC::JITCode::execute(JSC::VM*, JSC::ProtoCallFrame*) + 350 19 com.apple.JavaScriptCore 0x000000010a53bb55 JSC::Interpreter::executeCall(JSC::ExecState*, JSC::JSObject*, JSC::CallType, JSC::CallData const&, JSC::JSValue, JSC::ArgList const&) + 901 20 com.apple.JavaScriptCore 0x000000010a53b7b2 JSC::call(JSC::ExecState*, JSC::JSValue, JSC::CallType, JSC::CallData const&, JSC::JSValue, JSC::ArgList const&) + 82 21 com.apple.JavaScriptCore 0x000000010b11d168 JSC::JSJobMicrotask::run(JSC::ExecState*) + 408 22 com.apple.WebCore 0x000000010ec4251e WebCore::JSMainThreadExecState::runTask(JSC::ExecState*, JSC::Microtask&) + 222 23 com.apple.WebCore 0x000000010ecf1c16 WebCore::JSDOMWindowMicrotaskCallback::call() + 262 24 com.apple.WebCore 0x000000010e25e519 WebCore::ActiveDOMCallbackMicrotask::run() + 41 25 com.apple.WebCore 0x000000010f49b0d6 WebCore::MicrotaskQueue::performMicrotaskCheckpoint() + 358 26 com.apple.WebCore 0x000000010eb59653 WebCore::JSMainThreadExecState::~JSMainThreadExecState() + 83 27 com.apple.WebCore 0x000000010eb59438 WebCore::JSMainThreadExecState::call(JSC::ExecState*, JSC::JSValue, JSC::CallType, JSC::CallData const&, JSC::JSValue, JSC::ArgList const&, WTF::NakedPtr<JSC::Exception>&) + 248 28 com.apple.WebCore 0x000000010f9bfc2c WebCore::ScheduledAction::executeFunctionInContext(JSC::JSGlobalObject*, JSC::JSValue, WebCore::ScriptExecutionContext&) + 588 29 com.apple.WebCore 0x000000010f9bf693 WebCore::ScheduledAction::execute(WebCore::Document&) + 467 30 com.apple.WebCore 0x000000010da5d6a7 WebCore::DOMTimer::fired() + 775 31 com.apple.WebCore 0x000000010d878b25 WebCore::ThreadTimers::sharedTimerFiredInternal() + 389 32 com.apple.WebCore 0x000000010d878940 WebCore::timerFired(__CFRunLoopTimer*, void*) + 176 33 com.apple.CoreFoundation 0x00007fff9763f2e4 __CFRUNLOOP_IS_CALLING_OUT_TO_A_TIMER_CALLBACK_FUNCTION__ + 20 34 com.apple.CoreFoundation 0x00007fff9763ef73 __CFRunLoopDoTimer + 1059 35 com.apple.CoreFoundation 0x00007fff976b253d __CFRunLoopDoTimers + 301 36 com.apple.CoreFoundation 0x00007fff975fa608 __CFRunLoopRun + 2024 37 com.apple.CoreFoundation 0x00007fff975f9bd8 CFRunLoopRunSpecific + 296 38 DumpRenderTree 0x000000010954f2ce 0x10952d000 + 139982 39 DumpRenderTree 0x000000010954e84a 0x10952d000 + 137290 40 DumpRenderTree 0x000000010954db78 0x10952d000 + 134008 41 DumpRenderTree 0x000000010954fbd2 0x10952d000 + 142290 42 libdyld.dylib 0x00007fff94e6e5c9 start + 1 Thread 1:: Dispatch queue: com.apple.libdispatch-manager 0 libsystem_kernel.dylib 0x00007fff91a42232 kevent64 + 10 1 libdispatch.dylib 0x00007fff94956a6a _dispatch_mgr_thread + 52 Thread 2:: com.apple.NSURLConnectionLoader 0 libsystem_kernel.dylib 0x00007fff91a3c4de mach_msg_trap + 10 1 libsystem_kernel.dylib 0x00007fff91a3b64f mach_msg + 55 2 com.apple.CoreFoundation 0x00007fff975faeb4 __CFRunLoopServiceMachPort + 212 3 com.apple.CoreFoundation 0x00007fff975fa37b __CFRunLoopRun + 1371 4 com.apple.CoreFoundation 0x00007fff975f9bd8 CFRunLoopRunSpecific + 296 5 com.apple.CFNetwork 0x00007fff8c03b420 +[NSURLConnection(Loader) _resourceLoadLoop:] + 434 6 com.apple.Foundation 0x00007fff97d63e92 __NSThread__main__ + 1345 7 libsystem_pthread.dylib 0x00007fff8dfac05a _pthread_body + 131 8 libsystem_pthread.dylib 0x00007fff8dfabfd7 _pthread_start + 176 9 libsystem_pthread.dylib 0x00007fff8dfa93ed thread_start + 13 Thread 3:: WTF Parallel Helper Thread 0 libsystem_kernel.dylib 0x00007fff91a41136 __psynch_cvwait + 10 1 libc++.1.dylib 0x00007fff8a7cfc95 std::__1::condition_variable::wait(std::__1::unique_lock<std::__1::mutex>&) + 47 2 com.apple.JavaScriptCore 0x000000010b5a23f3 WTF::ParkingLot::parkConditionally(void const*, std::__1::function<bool ()>, std::__1::function<void ()>, std::__1::chrono::time_point<std::__1::chrono::steady_clock, std::__1::chrono::duration<long long, std::__1::ratio<1l, 1000000000l> > >) + 739 3 com.apple.JavaScriptCore 0x000000010adce541 bool WTF::ConditionBase::waitUntil<WTF::Lock>(WTF::Lock&, std::__1::chrono::time_point<std::__1::chrono::steady_clock, std::__1::chrono::duration<long long, std::__1::ratio<1l, 1000000000l> > >) + 273 4 com.apple.JavaScriptCore 0x000000010b5ad848 WTF::ParallelHelperPool::waitForClientWithTask(WTF::Locker<WTF::LockBase> const&) + 88 5 com.apple.JavaScriptCore 0x000000010b5ad5b5 WTF::ParallelHelperPool::helperThreadBody() + 341 6 com.apple.JavaScriptCore 0x000000010a4d88fe WTF::threadEntryPoint(void*) + 286 7 com.apple.JavaScriptCore 0x000000010a4d87ae WTF::wtfThreadEntryPoint(void*) + 62 8 libsystem_pthread.dylib 0x00007fff8dfac05a _pthread_body + 131 9 libsystem_pthread.dylib 0x00007fff8dfabfd7 _pthread_start + 176 10 libsystem_pthread.dylib 0x00007fff8dfa93ed thread_start + 13 Thread 4:: WTF Parallel Helper Thread 0 libsystem_kernel.dylib 0x00007fff91a41136 __psynch_cvwait + 10 1 libc++.1.dylib 0x00007fff8a7cfc95 std::__1::condition_variable::wait(std::__1::unique_lock<std::__1::mutex>&) + 47 2 com.apple.JavaScriptCore 0x000000010b5a23f3 WTF::ParkingLot::parkConditionally(void const*, std::__1::function<bool ()>, std::__1::function<void ()>, std::__1::chrono::time_point<std::__1::chrono::steady_clock, std::__1::chrono::duration<long long, std::__1::ratio<1l, 1000000000l> > >) + 739 3 com.apple.JavaScriptCore 0x000000010adce541 bool WTF::ConditionBase::waitUntil<WTF::Lock>(WTF::Lock&, std::__1::chrono::time_point<std::__1::chrono::steady_clock, std::__1::chrono::duration<long long, std::__1::ratio<1l, 1000000000l> > >) + 273 4 com.apple.JavaScriptCore 0x000000010b5ad848 WTF::ParallelHelperPool::waitForClientWithTask(WTF::Locker<WTF::LockBase> const&) + 88 5 com.apple.JavaScriptCore 0x000000010b5ad5b5 WTF::ParallelHelperPool::helperThreadBody() + 341 6 com.apple.JavaScriptCore 0x000000010a4d88fe WTF::threadEntryPoint(void*) + 286 7 com.apple.JavaScriptCore 0x000000010a4d87ae WTF::wtfThreadEntryPoint(void*) + 62 8 libsystem_pthread.dylib 0x00007fff8dfac05a _pthread_body + 131 9 libsystem_pthread.dylib 0x00007fff8dfabfd7 _pthread_start + 176 10 libsystem_pthread.dylib 0x00007fff8dfa93ed thread_start + 13 Thread 5:: WTF Parallel Helper Thread 0 libsystem_kernel.dylib 0x00007fff91a41136 __psynch_cvwait + 10 1 libc++.1.dylib 0x00007fff8a7cfc95 std::__1::condition_variable::wait(std::__1::unique_lock<std::__1::mutex>&) + 47 2 com.apple.JavaScriptCore 0x000000010b5a23f3 WTF::ParkingLot::parkConditionally(void const*, std::__1::function<bool ()>, std::__1::function<void ()>, std::__1::chrono::time_point<std::__1::chrono::steady_clock, std::__1::chrono::duration<long long, std::__1::ratio<1l, 1000000000l> > >) + 739 3 com.apple.JavaScriptCore 0x000000010adce541 bool WTF::ConditionBase::waitUntil<WTF::Lock>(WTF::Lock&, std::__1::chrono::time_point<std::__1::chrono::steady_clock, std::__1::chrono::duration<long long, std::__1::ratio<1l, 1000000000l> > >) + 273 4 com.apple.JavaScriptCore 0x000000010b5ad848 WTF::ParallelHelperPool::waitForClientWithTask(WTF::Locker<WTF::LockBase> const&) + 88 5 com.apple.JavaScriptCore 0x000000010b5ad5b5 WTF::ParallelHelperPool::helperThreadBody() + 341 6 com.apple.JavaScriptCore 0x000000010a4d88fe WTF::threadEntryPoint(void*) + 286 7 com.apple.JavaScriptCore 0x000000010a4d87ae WTF::wtfThreadEntryPoint(void*) + 62 8 libsystem_pthread.dylib 0x00007fff8dfac05a _pthread_body + 131 9 libsystem_pthread.dylib 0x00007fff8dfabfd7 _pthread_start + 176 10 libsystem_pthread.dylib 0x00007fff8dfa93ed thread_start + 13 Thread 6:: WTF Parallel Helper Thread 0 libsystem_kernel.dylib 0x00007fff91a41136 __psynch_cvwait + 10 1 libc++.1.dylib 0x00007fff8a7cfc95 std::__1::condition_variable::wait(std::__1::unique_lock<std::__1::mutex>&) + 47 2 com.apple.JavaScriptCore 0x000000010b5a23f3 WTF::ParkingLot::parkConditionally(void const*, std::__1::function<bool ()>, std::__1::function<void ()>, std::__1::chrono::time_point<std::__1::chrono::steady_clock, std::__1::chrono::duration<long long, std::__1::ratio<1l, 1000000000l> > >) + 739 3 com.apple.JavaScriptCore 0x000000010adce541 bool WTF::ConditionBase::waitUntil<WTF::Lock>(WTF::Lock&, std::__1::chrono::time_point<std::__1::chrono::steady_clock, std::__1::chrono::duration<long long, std::__1::ratio<1l, 1000000000l> > >) + 273 4 com.apple.JavaScriptCore 0x000000010b5ad848 WTF::ParallelHelperPool::waitForClientWithTask(WTF::Locker<WTF::LockBase> const&) + 88 5 com.apple.JavaScriptCore 0x000000010b5ad5b5 WTF::ParallelHelperPool::helperThreadBody() + 341 6 com.apple.JavaScriptCore 0x000000010a4d88fe WTF::threadEntryPoint(void*) + 286 7 com.apple.JavaScriptCore 0x000000010a4d87ae WTF::wtfThreadEntryPoint(void*) + 62 8 libsystem_pthread.dylib 0x00007fff8dfac05a _pthread_body + 131 9 libsystem_pthread.dylib 0x00007fff8dfabfd7 _pthread_start + 176 10 libsystem_pthread.dylib 0x00007fff8dfa93ed thread_start + 13 Thread 7:: WTF Parallel Helper Thread 0 libsystem_kernel.dylib 0x00007fff91a41136 __psynch_cvwait + 10 1 libc++.1.dylib 0x00007fff8a7cfc95 std::__1::condition_variable::wait(std::__1::unique_lock<std::__1::mutex>&) + 47 2 com.apple.JavaScriptCore 0x000000010b5a23f3 WTF::ParkingLot::parkConditionally(void const*, std::__1::function<bool ()>, std::__1::function<void ()>, std::__1::chrono::time_point<std::__1::chrono::steady_clock, std::__1::chrono::duration<long long, std::__1::ratio<1l, 1000000000l> > >) + 739 3 com.apple.JavaScriptCore 0x000000010adce541 bool WTF::ConditionBase::waitUntil<WTF::Lock>(WTF::Lock&, std::__1::chrono::time_point<std::__1::chrono::steady_clock, std::__1::chrono::duration<long long, std::__1::ratio<1l, 1000000000l> > >) + 273 4 com.apple.JavaScriptCore 0x000000010b5ad848 WTF::ParallelHelperPool::waitForClientWithTask(WTF::Locker<WTF::LockBase> const&) + 88 5 com.apple.JavaScriptCore 0x000000010b5ad5b5 WTF::ParallelHelperPool::helperThreadBody() + 341 6 com.apple.JavaScriptCore 0x000000010a4d88fe WTF::threadEntryPoint(void*) + 286 7 com.apple.JavaScriptCore 0x000000010a4d87ae WTF::wtfThreadEntryPoint(void*) + 62 8 libsystem_pthread.dylib 0x00007fff8dfac05a _pthread_body + 131 9 libsystem_pthread.dylib 0x00007fff8dfabfd7 _pthread_start + 176 10 libsystem_pthread.dylib 0x00007fff8dfa93ed thread_start + 13 Thread 8:: WTF Parallel Helper Thread 0 libsystem_kernel.dylib 0x00007fff91a41136 __psynch_cvwait + 10 1 libc++.1.dylib 0x00007fff8a7cfc95 std::__1::condition_variable::wait(std::__1::unique_lock<std::__1::mutex>&) + 47 2 com.apple.JavaScriptCore 0x000000010b5a23f3 WTF::ParkingLot::parkConditionally(void const*, std::__1::function<bool ()>, std::__1::function<void ()>, std::__1::chrono::time_point<std::__1::chrono::steady_clock, std::__1::chrono::duration<long long, std::__1::ratio<1l, 1000000000l> > >) + 739 3 com.apple.JavaScriptCore 0x000000010adce541 bool WTF::ConditionBase::waitUntil<WTF::Lock>(WTF::Lock&, std::__1::chrono::time_point<std::__1::chrono::steady_clock, std::__1::chrono::duration<long long, std::__1::ratio<1l, 1000000000l> > >) + 273 4 com.apple.JavaScriptCore 0x000000010b5ad848 WTF::ParallelHelperPool::waitForClientWithTask(WTF::Locker<WTF::LockBase> const&) + 88 5 com.apple.JavaScriptCore 0x000000010b5ad5b5 WTF::ParallelHelperPool::helperThreadBody() + 341 6 com.apple.JavaScriptCore 0x000000010a4d88fe WTF::threadEntryPoint(void*) + 286 7 com.apple.JavaScriptCore 0x000000010a4d87ae WTF::wtfThreadEntryPoint(void*) + 62 8 libsystem_pthread.dylib 0x00007fff8dfac05a _pthread_body + 131 9 libsystem_pthread.dylib 0x00007fff8dfabfd7 _pthread_start + 176 10 libsystem_pthread.dylib 0x00007fff8dfa93ed thread_start + 13 Thread 9: 0 libsystem_kernel.dylib 0x00007fff91a4194a __workq_kernreturn + 10 1 libsystem_pthread.dylib 0x00007fff8dfa93dd start_wqthread + 13 Thread 10: 0 libsystem_kernel.dylib 0x00007fff91a4194a __workq_kernreturn + 10 1 libsystem_pthread.dylib 0x00007fff8dfa93dd start_wqthread + 13 Thread 11: 0 libsystem_kernel.dylib 0x00007fff91a4194a __workq_kernreturn + 10 1 libsystem_pthread.dylib 0x00007fff8dfa93dd start_wqthread + 13 Thread 12: 0 libsystem_kernel.dylib 0x00007fff91a4194a __workq_kernreturn + 10 1 libsystem_pthread.dylib 0x00007fff8dfa93dd start_wqthread + 13 Thread 13: 0 libsystem_kernel.dylib 0x00007fff91a4194a __workq_kernreturn + 10 1 libsystem_pthread.dylib 0x00007fff8dfa93dd start_wqthread + 13 Thread 14: 0 libsystem_kernel.dylib 0x00007fff91a4194a __workq_kernreturn + 10 1 libsystem_pthread.dylib 0x00007fff8dfa93dd start_wqthread + 13 Thread 15: 0 libsystem_kernel.dylib 0x00007fff91a4194a __workq_kernreturn + 10 1 libsystem_pthread.dylib 0x00007fff8dfa93dd start_wqthread + 13 Thread 16: 0 libsystem_kernel.dylib 0x00007fff91a4194a __workq_kernreturn + 10 1 libsystem_pthread.dylib 0x00007fff8dfa93dd start_wqthread + 13 Thread 17: 0 libsystem_kernel.dylib 0x00007fff91a4194a __workq_kernreturn + 10 1 libsystem_pthread.dylib 0x00007fff8dfa93dd start_wqthread + 13 Thread 18: 0 libsystem_kernel.dylib 0x00007fff91a4194a __workq_kernreturn + 10 1 libsystem_pthread.dylib 0x00007fff8dfa93dd start_wqthread + 13 Thread 19: 0 libsystem_kernel.dylib 0x00007fff91a4194a __workq_kernreturn + 10 1 libsystem_pthread.dylib 0x00007fff8dfa93dd start_wqthread + 13 Thread 20: 0 libsystem_kernel.dylib 0x00007fff91a4194a __workq_kernreturn + 10 1 libsystem_pthread.dylib 0x00007fff8dfa93dd start_wqthread + 13 Thread 21: 0 libsystem_kernel.dylib 0x00007fff91a4194a __workq_kernreturn + 10 1 libsystem_pthread.dylib 0x00007fff8dfa93dd start_wqthread + 13 Thread 22: 0 libsystem_kernel.dylib 0x00007fff91a4194a __workq_kernreturn + 10 1 libsystem_pthread.dylib 0x00007fff8dfa93dd start_wqthread + 13 Thread 23: 0 libsystem_kernel.dylib 0x00007fff91a4194a __workq_kernreturn + 10 1 libsystem_pthread.dylib 0x00007fff8dfa93dd start_wqthread + 13 Thread 24:: com.apple.CFSocket.private 0 libsystem_kernel.dylib 0x00007fff91a413fa __select + 10 1 libsystem_pthread.dylib 0x00007fff8dfac05a _pthread_body + 131 2 libsystem_pthread.dylib 0x00007fff8dfabfd7 _pthread_start + 176 3 libsystem_pthread.dylib 0x00007fff8dfa93ed thread_start + 13 Thread 25:: com.apple.coremedia.asyncio 0 libsystem_kernel.dylib 0x00007fff91a41136 __psynch_cvwait + 10 1 com.apple.CoreMedia 0x00007fff8cfda471 WaitOnCondition + 11 2 com.apple.CoreMedia 0x00007fff8cfda27e FigSemaphoreWaitRelative + 156 3 com.apple.MediaToolbox 0x00007fff956cfe6b 0x7fff9569f000 + 200299 4 com.apple.CoreMedia 0x00007fff8cfdaef5 figThreadMain + 417 5 libsystem_pthread.dylib 0x00007fff8dfac05a _pthread_body + 131 6 libsystem_pthread.dylib 0x00007fff8dfabfd7 _pthread_start + 176 7 libsystem_pthread.dylib 0x00007fff8dfa93ed thread_start + 13 Thread 26:: com.apple.coreaudio.AQClient 0 libsystem_kernel.dylib 0x00007fff91a3c4de mach_msg_trap + 10 1 libsystem_kernel.dylib 0x00007fff91a3b64f mach_msg + 55 2 com.apple.CoreFoundation 0x00007fff975faeb4 __CFRunLoopServiceMachPort + 212 3 com.apple.CoreFoundation 0x00007fff975fa37b __CFRunLoopRun + 1371 4 com.apple.CoreFoundation 0x00007fff975f9bd8 CFRunLoopRunSpecific + 296 5 com.apple.audio.toolbox.AudioToolbox 0x00007fff92da0d2a GenericRunLoopThread::Entry(void*) + 194 6 com.apple.audio.toolbox.AudioToolbox 0x00007fff92da0bb7 CAPThread::Entry(CAPThread*) + 109 7 libsystem_pthread.dylib 0x00007fff8dfac05a _pthread_body + 131 8 libsystem_pthread.dylib 0x00007fff8dfabfd7 _pthread_start + 176 9 libsystem_pthread.dylib 0x00007fff8dfa93ed thread_start + 13 Thread 27:: DFG Worklist Worker Thread 0 libsystem_kernel.dylib 0x00007fff91a41136 __psynch_cvwait + 10 1 libc++.1.dylib 0x00007fff8a7cfc95 std::__1::condition_variable::wait(std::__1::unique_lock<std::__1::mutex>&) + 47 2 com.apple.JavaScriptCore 0x000000010b5a23f3 WTF::ParkingLot::parkConditionally(void const*, std::__1::function<bool ()>, std::__1::function<void ()>, std::__1::chrono::time_point<std::__1::chrono::steady_clock, std::__1::chrono::duration<long long, std::__1::ratio<1l, 1000000000l> > >) + 739 3 com.apple.JavaScriptCore 0x000000010adce541 bool WTF::ConditionBase::waitUntil<WTF::Lock>(WTF::Lock&, std::__1::chrono::time_point<std::__1::chrono::steady_clock, std::__1::chrono::duration<long long, std::__1::ratio<1l, 1000000000l> > >) + 273 4 com.apple.JavaScriptCore 0x000000010adc7d6b JSC::DFG::Worklist::runThread(JSC::DFG::ThreadData*) + 795 5 com.apple.JavaScriptCore 0x000000010a4d88fe WTF::threadEntryPoint(void*) + 286 6 com.apple.JavaScriptCore 0x000000010a4d87ae WTF::wtfThreadEntryPoint(void*) + 62 7 libsystem_pthread.dylib 0x00007fff8dfac05a _pthread_body + 131 8 libsystem_pthread.dylib 0x00007fff8dfabfd7 _pthread_start + 176 9 libsystem_pthread.dylib 0x00007fff8dfa93ed thread_start + 13 Thread 28: 0 libsystem_kernel.dylib 0x00007fff91a4194a __workq_kernreturn + 10 1 libsystem_pthread.dylib 0x00007fff8dfa93dd start_wqthread + 13 Thread 0 crashed with X86 Thread State (64-bit): rax: 0x0000000000000000 rbx: 0x0000000000000006 rcx: 0x00007fff566cdb68 rdx: 0x0000000000000000 rdi: 0x0000000000000d0f rsi: 0x0000000000000006 rbp: 0x00007fff566cdb90 rsp: 0x00007fff566cdb68 r8: 0xb5002d7272e3ee26 r9: 0x0000000000000001 r10: 0x0000000008000000 r11: 0x0000000000000206 r12: 0x00007fff566ce580 r13: 0x00000001096974f3 r14: 0x00007fff7a9ab300 r15: 0x000000010969314c rip: 0x00007fff91a41286 rfl: 0x0000000000000206 cr2: 0x00007fff7be3d070 Logical CPU: 0 Error Code: 0x02000148 Trap Number: 133
David Kilzer (:ddkilzer)
Comment 4 2015-12-06 17:26:27 PST
Created attachment 266747 [details] Manual rollout
WebKit Commit Bot
Comment 5 2015-12-06 17:28:40 PST
Comment on attachment 266747 [details] Manual rollout Rejecting attachment 266747 [details] from commit-queue. Failed to run "['/Volumes/Data/EWS/WebKit/Tools/Scripts/webkit-patch', '--status-host=webkit-queues.webkit.org', '--bot-id=webkit-cq-02', 'validate-changelog', '--check-oops', '--non-interactive', 266747, '--port=mac']" exit_code: 1 cwd: /Volumes/Data/EWS/WebKit /Volumes/Data/EWS/WebKit/LayoutTests/ChangeLog neither lists a valid reviewer nor contains the string "Unreviewed" or "Rubber stamp" (case insensitive). Full output: http://webkit-queues.webkit.org/results/525984
WebKit Commit Bot
Comment 6 2015-12-06 17:29:27 PST
Attachment 266747 [details] did not pass style-queue: ERROR: Source/JavaScriptCore/runtime/Executable.cpp:498: Code inside a namespace should not be indented. [whitespace/indent] [4] ERROR: Source/JavaScriptCore/runtime/Executable.cpp:498: Wrong number of spaces before statement. (expected: 8) [whitespace/indent] [4] ERROR: Source/JavaScriptCore/runtime/Executable.h:396: The parameter name "structure" adds no information, so it should be removed. [readability/parameter_name] [5] ERROR: Source/JavaScriptCore/runtime/Executable.h:396: The parameter name "vm" adds no information, so it should be removed. [readability/parameter_name] [5] ERROR: Source/JavaScriptCore/runtime/Executable.h:396: The parameter name "source" adds no information, so it should be removed. [readability/parameter_name] [5] Total errors found: 5 in 57 files If any of these errors are false positives, please file a bug against check-webkit-style.
David Kilzer (:ddkilzer)
Comment 7 2015-12-06 17:55:24 PST
Committed r193606: <http://trac.webkit.org/changeset/193606>
Note You need to log in before you can comment on or make changes to this bug.