| Summary: | IndexedDB: Several test crash in when destroying a IDBKeyData | ||||||||
|---|---|---|---|---|---|---|---|---|---|
| Product: | WebKit | Reporter: | Carlos Garcia Campos <cgarcia> | ||||||
| Component: | WebKit2 | Assignee: | Fujii Hironori <Hironori.Fujii> | ||||||
| Status: | RESOLVED FIXED | ||||||||
| Severity: | Normal | CC: | achristensen, alecflett, beidson, bugs-noreply, commit-queue, csaavedra, ews-watchlist, Hironori.Fujii, jsbell, mcatanzaro, webkit-bug-importer, zan | ||||||
| Priority: | P2 | Keywords: | InRadar, LayoutTestFailure | ||||||
| Version: | WebKit Local Build | ||||||||
| Hardware: | Unspecified | ||||||||
| OS: | Unspecified | ||||||||
| Bug Depends on: | |||||||||
| Bug Blocks: | 160306 | ||||||||
| Attachments: |
|
||||||||
|
Description
Carlos Garcia Campos
2017-01-30 00:20:18 PST
Same issue with the WPE port: imported/w3c/IndexedDB-private-browsing/idbcursor_iterating.html [ Crash ] imported/w3c/IndexedDB-private-browsing/idbcursor_iterating_index.html [ Crash ] Pretty much the same stacktraces. This might be an issue in the GCC compiler: - doesn't occur in "-O -DNDEBUG" builds (i.e. release builds with optimizations disabled), - doesn't occur when building with Clang. Quite possible. Let's see how these tests behave in the next few days and act accordingly. (In reply to Claudio Saavedra from comment #3) > Could this have been fixed by r218516 ? Sadly the tests are still crashing. (In reply to Michael Catanzaro from comment #5) > (In reply to Claudio Saavedra from comment #3) > > Could this have been fixed by r218516 ? > > Sadly the tests are still crashing. :( Created attachment 333160 [details]
debug patch
An instance of IDBKeyData seems broken.
If you apply this debug patch, you can observe the broken value even in debug build.
I think this bug is *not* a GCC optimizer bug.
> struct IDBKeyDataHashTraits : public WTF::CustomHashTraits<IDBKeyData> { > [...] > static void constructDeletedValue(IDBKeyData& key) > { > key = IDBKeyData::deletedValue(); > } > constructDeletedValue is using operator= to assign deleteValue. > template<typename Traits, typename T> > typename std::enable_if<!HashTraitHasCustomDelete<Traits, T>::value>::type > hashTraitsDeleteBucket(T& value) > { > value.~T(); > Traits::constructDeletedValue(value); > } But, the value is destructed just before calling constructDeletedValue. You can't use operator= for a destructed value. Created attachment 333249 [details]
Patch
Comment on attachment 333249 [details] Patch View in context: https://bugs.webkit.org/attachment.cgi?id=333249&action=review > Source/WebCore/Modules/indexeddb/IDBKeyData.h:211 > + new (&key) IDBKeyData; Again, I'll wait a couple days for Brady to review it first, but it looks right. Thanks Fujii! Comment on attachment 333249 [details] Patch Clearing flags on attachment: 333249 Committed r228560: <https://trac.webkit.org/changeset/228560> All reviewed patches have been landed. Closing bug. |