Bug 168356 – ASSERTION FAILED: m_normalWorld->hasOneRef() under WorkerThread::stop

• Component: JavaScriptCore
• Status: RESOLVED FIXED

[Joseph Pecoraro]

Created attachment 301579 [details]
[CRASH] Crash Log

Assert seen while adding new Worker web-platform-tests. Seen at r212337.

* Steps to reproduce: (with local changes)
1. Add new Worker web-platform-test tests (to be added soon to bug 168086)
2. Enable Resource Timing
3. http://localhost:8800/resource-timing/rt-performance-extensions.worker.html
4. Reload
  => CRASH

ASSERTION FAILED: m_normalWorld->hasOneRef()
/Users/pecoraro/Code/safari/OpenSource/Source/WebCore/bindings/js/WebCoreJSClientData.cpp(55) : virtual WebCore::JSVMClientData::~JSVMClientData()
1   0x1112b83ed WTFCrash
2   0x11666227a WebCore::JSVMClientData::~JSVMClientData()
3   0x116662485 WebCore::JSVMClientData::~JSVMClientData()
4   0x1166624a9 WebCore::JSVMClientData::~JSVMClientData()
5   0x11118b8fc JSC::VM::~VM()
6   0x11118d4e5 JSC::VM::~VM()
7   0x110b6c7b7 WTF::ThreadSafeRefCounted<JSC::VM>::deref() const
8   0x110b6c761 void WTF::derefIfNotNull<JSC::VM>(JSC::VM*)
9   0x110d6652b WTF::RefPtr<JSC::VM>::operator=(std::nullptr_t)
10  0x110d770aa JSC::JSLockHolder::~JSLockHolder()
11  0x110d77125 JSC::JSLockHolder::~JSLockHolder()
12  0x1167c3cff WebCore::WorkerScriptController::~WorkerScriptController()
13  0x1167c3ee5 WebCore::WorkerScriptController::~WorkerScriptController()
14  0x1167cbe42 WebCore::WorkerGlobalScope::clearScript()
15  0x1167cbd86 WebCore::WorkerThread::stop()::$_0::operator()(WebCore::ScriptExecutionContext&) const::'lambda'(WebCore::ScriptExecutionContext&)::operator()(WebCore::ScriptExecutionContext&) const
16  0x1167cbd34 WTF::Function<void (WebCore::ScriptExecutionContext&)>::CallableWrapper<WebCore::WorkerThread::stop()::$_0::operator()(WebCore::ScriptExecutionContext&) const::'lambda'(WebCore::ScriptExecutionContext&)>::call(WebCore::ScriptExecutionContext&)
17  0x11427f741 WTF::Function<void (WebCore::ScriptExecutionContext&)>::operator()(WebCore::ScriptExecutionContext&) const
18  0x11426abdd WebCore::ScriptExecutionContext::Task::performTask(WebCore::ScriptExecutionContext&)
19  0x1167c08c9 WebCore::WorkerRunLoop::Task::performTask(WebCore::WorkerRunLoop const&, WebCore::WorkerGlobalScope*)
20  0x1167bfd72 WebCore::WorkerRunLoop::runCleanupTasks(WebCore::WorkerGlobalScope*)
21  0x1167bf4d0 WebCore::WorkerRunLoop::run(WebCore::WorkerGlobalScope*)
22  0x1167c8903 WebCore::WorkerThread::runEventLoop()
23  0x1141de318 WebCore::DedicatedWorkerThread::runEventLoop()
24  0x1167c866d WebCore::WorkerThread::workerThread()
25  0x1167c80f5 WebCore::WorkerThread::workerThreadStart(void*)
26  0x111329f99 WTF::createThread(void (*)(void*), void*, char const*)::$_0::operator()() const
27  0x111329f6d void std::__1::__invoke_void_return_wrapper<void>::__call<WTF::createThread(void (*)(void*), void*, char const*)::$_0&>(WTF::createThread(void (*)(void*), void*, char const*)::$_0&&&)
28  0x111329f19 std::__1::__function::__func<WTF::createThread(void (*)(void*), void*, char const*)::$_0, std::__1::allocator<WTF::createThread(void (*)(void*), void*, char const*)::$_0>, void ()>::operator()()
29  0x1108a07ca std::__1::function<void ()>::operator()() const
30  0x1113289a7 WTF::threadEntryPoint(void*)
31  0x11132a581 WTF::wtfThreadEntryPoint(void*)
LEAK: 1 WebFrame
LEAK: 50 WebCoreNode
LEAK: 1 CachedResource
LEAK: 1 BidiRun

[Joseph Pecoraro]

I'm able to reproduce this almost 100%. So don't hesitate to ask me questions.

[Ryan Haddad]

Hit this with imported/w3c/web-platform-tests/resource-timing/rt-resource-errors.html. Skipped the test on debug in http://trac.webkit.org/projects/webkit/changeset/212460

[Ryan Haddad]

Same with imported/w3c/web-platform-tests/resource-timing/rt-resource-ignored.html
http://trac.webkit.org/projects/webkit/changeset/212467

[Ryan Haddad]

I ended up skipping the entire directory on Debug in http://trac.webkit.org/projects/webkit/changeset/212509

[Radar WebKit Bug Importer]

<rdar://problem/30592486>

[Joseph Pecoraro]

Seems to be related to WebCore::Performance destruction with EventListeners.

[Joseph Pecoraro]

<rdar://problem/30608413>

[Joseph Pecoraro]

Created attachment 302203 [details]
[PATCH] Proposed Fix

[Joseph Pecoraro]

Created attachment 302206 [details]
[PATCH] Proposed Fix

[WebKit Commit Bot]

Attachment 302206 [details] did not pass style-queue:


ERROR: Source/WebCore/ChangeLog:9:  You should remove the 'No new tests' and either add and list tests, or explain why no new tests were possible.  [changelog/nonewtests] [5]
Total errors found: 1 in 6 files


If any of these errors are false positives, please file a bug against check-webkit-style.

[Ryosuke Niwa]

Comment on attachment 302206 [details]
[PATCH] Proposed Fix

View in context: https://bugs.webkit.org/attachment.cgi?id=302206&action=review

> LayoutTests/TestExpectations:314
> +webkit.org/b/161088 imported/w3c/web-platform-tests/resource-timing/resource-timing.html [ Pass Failure ]
>  webkit.org/b/168357 imported/w3c/web-platform-tests/resource-timing/rt-initiatorType-media.html [ Failure ]

Why is this flaky failure??

[Joseph Pecoraro]

Comment on attachment 302206 [details]
[PATCH] Proposed Fix

View in context: https://bugs.webkit.org/attachment.cgi?id=302206&action=review

>> LayoutTests/TestExpectations:314
>>  webkit.org/b/168357 imported/w3c/web-platform-tests/resource-timing/rt-initiatorType-media.html [ Failure ]
> 
> Why is this flaky failure??

This is flakey because of: https://bugs.webkit.org/show_bug.cgi?id=168351

We are getting a timestamp from the NetworkProcess which may have been shifted compared to the WebProcess. So the WebProcess's timestamps and NetworkProcess timestamps may result in an incorrect order.

> LayoutTests/TestExpectations:982
>  webkit.org/b/168356 [ Debug ] imported/w3c/web-platform-tests/resource-timing [ Skip ]

I meant to be removing this line, but horribly merged this with Git... Sorry!

[Joseph Pecoraro]

Created attachment 302218 [details]
[PATCH] For Landing

[Joseph Pecoraro]

Comment on attachment 302218 [details]
[PATCH] For Landing

View in context: https://bugs.webkit.org/attachment.cgi?id=302218&action=review

> LayoutTests/TestExpectations:-319
> -webkit.org/b/161176 [ Debug ] imported/w3c/web-platform-tests/url/url-setters.html [ Skip ]

Wrong one... I'm really bad at this.

[Joseph Pecoraro]

Created attachment 302220 [details]
[PATCH] For Landing

[WebKit Commit Bot]

Comment on attachment 302220 [details]
[PATCH] For Landing

Clearing flags on attachment: 302220

Committed r212698: <http://trac.webkit.org/changeset/212698>

[Joseph Pecoraro]

<https://trac.webkit.org/changeset/212698>