Bug 161800 – ASSERTION FAILED: The string being removed is atomic in the string table of an other thread! iterator != atomicStringTable.end() at Source/WTF/wtf/text/AtomicStringImpl.cpp(453)

• Component: WebKitGTK
• Status: RESOLVED FIXED

[Michael Catanzaro]

This is a regression from within the past month or so. It happens quite often. I need to get a better backtrace.

ASSERTION FAILED: The string being removed is atomic in the string table of an other thread!
iterator != atomicStringTable.end()
../../Source/WTF/wtf/text/AtomicStringImpl.cpp(453) : static void WTF::AtomicStringImpl::remove(WTF::AtomicStringImpl*)
1   0x7fbf665d1d5c /home/mcatanzaro/src/jhbuild/install/lib/libjavascriptcoregtk-4.0.so.18(WTFCrash+0x1e) [0x7fbf665d1d5c]
2   0x7fbf665ffc4e /home/mcatanzaro/src/jhbuild/install/lib/libjavascriptcoregtk-4.0.so.18(_ZN3WTF16AtomicStringImpl6removeEPS0_+0xfe) [0x7fbf665ffc4e]
3   0x7fbf6660a0ad /home/mcatanzaro/src/jhbuild/install/lib/libjavascriptcoregtk-4.0.so.18(_ZN3WTF10StringImplD1Ev+0x9b) [0x7fbf6660a0ad]
4   0x7fbf6660a200 /home/mcatanzaro/src/jhbuild/install/lib/libjavascriptcoregtk-4.0.so.18(_ZN3WTF10StringImpl7destroyEPS0_+0x18) [0x7fbf6660a200]
5   0x7fbf6c1c3666 /home/mcatanzaro/src/jhbuild/install/lib/libwebkit2gtk-4.0.so.37(_ZN3WTF10StringImpl5derefEv+0x2a) [0x7fbf6c1c3666]
6   0x7fbf6c1c6056 /home/mcatanzaro/src/jhbuild/install/lib/libwebkit2gtk-4.0.so.37(_ZN3WTF14derefIfNotNullINS_10StringImplEEEvPT_+0x28) [0x7fbf6c1c6056]
7   0x7fbf6c1c440f /home/mcatanzaro/src/jhbuild/install/lib/libwebkit2gtk-4.0.so.37(_ZN3WTF6RefPtrINS_10StringImplEED1Ev+0x2f) [0x7fbf6c1c440f]
8   0x7fbf6c1c3742 /home/mcatanzaro/src/jhbuild/install/lib/libwebkit2gtk-4.0.so.37(_ZN3WTF6StringD1Ev+0x18) [0x7fbf6c1c3742]
9   0x7fbf6c1e0a1a /home/mcatanzaro/src/jhbuild/install/lib/libwebkit2gtk-4.0.so.37(_ZN3WTF12AtomicStringD1Ev+0x18) [0x7fbf6c1e0a1a]
10  0x7fbf5998e1e8 /lib64/libc.so.6(+0x391e8) [0x7fbf5998e1e8]
11  0x7fbf5998e235 /lib64/libc.so.6(+0x39235) [0x7fbf5998e235]
12  0x7fbf6c1f0337 /home/mcatanzaro/src/jhbuild/install/lib/libwebkit2gtk-4.0.so.37(_ZN3IPC10Connection24didFailToSendSyncMessageEv+0x25) [0x7fbf6c1f0337]
13  0x7fbf6c1edcb1 /home/mcatanzaro/src/jhbuild/install/lib/libwebkit2gtk-4.0.so.37(_ZN3IPC10Connection15sendSyncMessageEmSt10unique_ptrINS_7EncoderESt14default_deleteIS2_EENSt6chrono8durationIlSt5ratioILl1ELl1000EEEEN3WTF9OptionSetINS_14SendSyncOptionEEE+0xe5) [0x7fbf6c1edcb1]
14  0x7fbf6c48deb4 /home/mcatanzaro/src/jhbuild/install/lib/libwebkit2gtk-4.0.so.37(_ZN3IPC10Connection8sendSyncIN8Messages15WebProcessProxy15ShouldTerminateEEEbOT_ONS5_5ReplyEmNSt6chrono8durationIlSt5ratioILl1ELl1000EEEEN3WTF9OptionSetINS_14SendSyncOptionEEE+0x120) [0x7fbf6c48deb4]
15  0x7fbf6c484b24 /home/mcatanzaro/src/jhbuild/install/lib/libwebkit2gtk-4.0.so.37(_ZN6WebKit10WebProcess15shouldTerminateEv+0xc0) [0x7fbf6c484b24]
16  0x7fbf6c22694b /home/mcatanzaro/src/jhbuild/install/lib/libwebkit2gtk-4.0.so.37(_ZN6WebKit12ChildProcess21terminationTimerFiredEv+0x23) [0x7fbf6c22694b]
17  0x7fbf6c2268c6 /home/mcatanzaro/src/jhbuild/install/lib/libwebkit2gtk-4.0.so.37(_ZN6WebKit12ChildProcess17enableTerminationEv+0x80) [0x7fbf6c2268c6]
18  0x7fbf6c484a60 /home/mcatanzaro/src/jhbuild/install/lib/libwebkit2gtk-4.0.so.37(_ZN6WebKit10WebProcess13removeWebPageEm+0x8e) [0x7fbf6c484a60]
19  0x7fbf6c5f645c /home/mcatanzaro/src/jhbuild/install/lib/libwebkit2gtk-4.0.so.37(_ZN6WebKit7WebPage5closeEv+0x46a) [0x7fbf6c5f645c]
20  0x7fbf6c962d77 /home/mcatanzaro/src/jhbuild/install/lib/libwebkit2gtk-4.0.so.37(_ZN3IPC22callMemberFunctionImplIN6WebKit7WebPageEMS2_FvvESt5tupleIJEEJEEEvPT_T0_OT1_St16integer_sequenceImJXspT2_EEE+0x65) [0x7fbf6c962d77]
21  0x7fbf6c961478 /home/mcatanzaro/src/jhbuild/install/lib/libwebkit2gtk-4.0.so.37(_ZN3IPC18callMemberFunctionIN6WebKit7WebPageEMS2_FvvESt5tupleIJEESt16integer_sequenceImJEEEEvOT1_PT_T0_+0x41) [0x7fbf6c961478]
22  0x7fbf6c95d358 /home/mcatanzaro/src/jhbuild/install/lib/libwebkit2gtk-4.0.so.37(_ZN3IPC13handleMessageIN8Messages7WebPage5CloseEN6WebKit7WebPageEMS5_FvvEEEvRNS_7DecoderEPT0_T1_+0x8f) [0x7fbf6c95d358]
23  0x7fbf6c95767a /home/mcatanzaro/src/jhbuild/install/lib/libwebkit2gtk-4.0.so.37(_ZN6WebKit7WebPage24didReceiveWebPageMessageERN3IPC10ConnectionERNS1_7DecoderE+0x1d9c) [0x7fbf6c95767a]
24  0x7fbf6c601b62 /home/mcatanzaro/src/jhbuild/install/lib/libwebkit2gtk-4.0.so.37(_ZN6WebKit7WebPage17didReceiveMessageERN3IPC10ConnectionERNS1_7DecoderE+0x240) [0x7fbf6c601b62]
25  0x7fbf6c20b325 /home/mcatanzaro/src/jhbuild/install/lib/libwebkit2gtk-4.0.so.37(_ZN3IPC18MessageReceiverMap15dispatchMessageERNS_10ConnectionERNS_7DecoderE+0x125) [0x7fbf6c20b325]
26  0x7fbf6c484ca4 /home/mcatanzaro/src/jhbuild/install/lib/libwebkit2gtk-4.0.so.37(_ZN6WebKit10WebProcess17didReceiveMessageERN3IPC10ConnectionERNS1_7DecoderE+0x4c) [0x7fbf6c484ca4]
27  0x7fbf6c1f04ba /home/mcatanzaro/src/jhbuild/install/lib/libwebkit2gtk-4.0.so.37(_ZN3IPC10Connection15dispatchMessageERNS_7DecoderE+0x3a) [0x7fbf6c1f04ba]
28  0x7fbf6c1f0624 /home/mcatanzaro/src/jhbuild/install/lib/libwebkit2gtk-4.0.so.37(_ZN3IPC10Connection15dispatchMessageESt10unique_ptrINS_7DecoderESt14default_deleteIS2_EE+0x166) [0x7fbf6c1f0624]
29  0x7fbf6c1f0816 /home/mcatanzaro/src/jhbuild/install/lib/libwebkit2gtk-4.0.so.37(_ZN3IPC10Connection18dispatchOneMessageEv+0xc8) [0x7fbf6c1f0816]
30  0x7fbf6c1f035a /home/mcatanzaro/src/jhbuild/install/lib/libwebkit2gtk-4.0.so.37(+0x4a7135a) [0x7fbf6c1f035a]
31  0x7fbf6c1f6f2e /home/mcatanzaro/src/jhbuild/install/lib/libwebkit2gtk-4.0.so.37(+0x4a77f2e) [0x7fbf6c1f6f2e]

[Michael Catanzaro]

I added a print statement:

if (iterator == atomicStringTable.end())
WTFLogAlways("******%s********", string->utf8(LenientConversion).data());
    ASSERT_WITH_MESSAGE(iterator != atomicStringTable.end(), "The string being removed is atomic in the string table of an other thread!");

The next time I saw the crash, the string printed was "u_projectionMatrix"

That's a local variable in WebCore/platform/graphics/texmap/TextureMapperShaderProgram.cpp. I have no clue what this file is doing, but it looks like some serious black magic.

[Michael Catanzaro]

(In reply to comment #1)
> The next time I saw the crash, the string printed was "u_projectionMatrix"

Looks like it's always this string.

[Zan Dobersek]

On what thread is the assertion occurring?

These AtomicString objects should be constructed on the composition thread, and added to the AtomicString table for that thread.

I assume the destruction of these is happening on the main thread, via at-exit handlers.

Using static NeverDestroyed<AtomicString> objects would probably fix this.

[Michael Catanzaro]

(In reply to comment #3)
> On what thread is the assertion occurring?

The main thread.

> These AtomicString objects should be constructed on the composition thread,
> and added to the AtomicString table for that thread.

Sad.

> I assume the destruction of these is happening on the main thread, via
> at-exit handlers.

Yes.

> Using static NeverDestroyed<AtomicString> objects would probably fix this.

OK, probably!

[Michael Catanzaro]

Created attachment 288692 [details]
Patch

[Zan Dobersek]

Comment on attachment 288692 [details]
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=288692&action=review

> Source/WebCore/platform/graphics/texmap/TextureMapperShaderProgram.h:35
> +#define TEXMAP_DECLARE_VARIABLE(Accessor, Name, Type) GC3Duint Accessor##Location() { static NeverDestroyed<const AtomicString> name(Name); return getLocation(name.get(), Type); }

AtomicString::ConstructFromLiteral should be passed as the second argument to the constructor. I think all the strings used with the macro are literals.

[Michael Catanzaro]

Committed r206061: <http://trac.webkit.org/changeset/206061>

[Michael Catanzaro]

*** Bug 164919 has been marked as a duplicate of this bug. ***