Bug 171091 – Regression(r215229): ASSERTION FAILED: !m_scriptHash || m_scriptHash == m_script.impl()->hash()

• Component: Page Loading
• Status: RESOLVED FIXED

[Ryan Haddad]

ASSERTION FAILED: !m_scriptHash || m_scriptHash == m_script.impl()->hash()
/Volumes/Data/slave/elcapitan-debug/build/Source/WebCore/loader/cache/CachedScript.cpp(91) : WTF::StringView WebCore::CachedScript::script()
1   0x11ac3f4f0 WTFCrash
2   0x10db1c730 WebCore::CachedScript::script()
3   0x10f686d86 WebCore::CachedScriptSourceProvider::source() const
4   0x119ce38ef JSC::SourceProvider::getRange(int, int) const
5   0x119ce3a41 JSC::UnlinkedSourceCode::view() const
6   0x119d1622c JSC::SourceCodeKey::string() const
7   0x119d160cc JSC::SourceCodeKey::operator==(JSC::SourceCodeKey const&) const
8   0x119d15fdd JSC::SourceCodeKey::Hash::equal(JSC::SourceCodeKey const&, JSC::SourceCodeKey const&)
9   0x119d15e0d bool WTF::IdentityHashTranslator<WTF::HashMap<JSC::SourceCodeKey, JSC::SourceCodeValue, JSC::SourceCodeKey::Hash, JSC::SourceCodeKey::HashTraits, WTF::HashTraits<JSC::SourceCodeValue> >::KeyValuePairTraits, JSC::SourceCodeKey::Hash>::equal<JSC::SourceCodeKey, JSC::SourceCodeKey>(JSC::SourceCodeKey const&, JSC::SourceCodeKey const&)
10  0x119d15cdc WTF::KeyValuePair<JSC::SourceCodeKey, JSC::SourceCodeValue>* WTF::HashTable<JSC::SourceCodeKey, WTF::KeyValuePair<JSC::SourceCodeKey, JSC::SourceCodeValue>, WTF::KeyValuePairKeyExtractor<WTF::KeyValuePair<JSC::SourceCodeKey, JSC::SourceCodeValue> >, JSC::SourceCodeKey::Hash, WTF::HashMap<JSC::SourceCodeKey, JSC::SourceCodeValue, JSC::SourceCodeKey::Hash, JSC::SourceCodeKey::HashTraits, WTF::HashTraits<JSC::SourceCodeValue> >::KeyValuePairTraits, JSC::SourceCodeKey::HashTraits>::inlineLookup<WTF::IdentityHashTranslator<WTF::HashMap<JSC::SourceCodeKey, JSC::SourceCodeValue, JSC::SourceCodeKey::Hash, JSC::SourceCodeKey::HashTraits, WTF::HashTraits<JSC::SourceCodeValue> >::KeyValuePairTraits, JSC::SourceCodeKey::Hash>, JSC::SourceCodeKey>(JSC::SourceCodeKey const&)
11  0x119d15b9d WTF::KeyValuePair<JSC::SourceCodeKey, JSC::SourceCodeValue>* WTF::HashTable<JSC::SourceCodeKey, WTF::KeyValuePair<JSC::SourceCodeKey, JSC::SourceCodeValue>, WTF::KeyValuePairKeyExtractor<WTF::KeyValuePair<JSC::SourceCodeKey, JSC::SourceCodeValue> >, JSC::SourceCodeKey::Hash, WTF::HashMap<JSC::SourceCodeKey, JSC::SourceCodeValue, JSC::SourceCodeKey::Hash, JSC::SourceCodeKey::HashTraits, WTF::HashTraits<JSC::SourceCodeValue> >::KeyValuePairTraits, JSC::SourceCodeKey::HashTraits>::lookup<WTF::IdentityHashTranslator<WTF::HashMap<JSC::SourceCodeKey, JSC::SourceCodeValue, JSC::SourceCodeKey::Hash, JSC::SourceCodeKey::HashTraits, WTF::HashTraits<JSC::SourceCodeValue> >::KeyValuePairTraits, JSC::SourceCodeKey::Hash>, JSC::SourceCodeKey>(JSC::SourceCodeKey const&)
12  0x119d15aff WTF::HashTableIterator<JSC::SourceCodeKey, WTF::KeyValuePair<JSC::SourceCodeKey, JSC::SourceCodeValue>, WTF::KeyValuePairKeyExtractor<WTF::KeyValuePair<JSC::SourceCodeKey, JSC::SourceCodeValue> >, JSC::SourceCodeKey::Hash, WTF::HashMap<JSC::SourceCodeKey, JSC::SourceCodeValue, JSC::SourceCodeKey::Hash, JSC::SourceCodeKey::HashTraits, WTF::HashTraits<JSC::SourceCodeValue> >::KeyValuePairTraits, JSC::SourceCodeKey::HashTraits> WTF::HashTable<JSC::SourceCodeKey, WTF::KeyValuePair<JSC::SourceCodeKey, JSC::SourceCodeValue>, WTF::KeyValuePairKeyExtractor<WTF::KeyValuePair<JSC::SourceCodeKey, JSC::SourceCodeValue> >, JSC::SourceCodeKey::Hash, WTF::HashMap<JSC::SourceCodeKey, JSC::SourceCodeValue, JSC::SourceCodeKey::Hash, JSC::SourceCodeKey::HashTraits, WTF::HashTraits<JSC::SourceCodeValue> >::KeyValuePairTraits, JSC::SourceCodeKey::HashTraits>::find<WTF::IdentityHashTranslator<WTF::HashMap<JSC::SourceCodeKey, JSC::SourceCodeValue, JSC::SourceCodeKey::Hash, JSC::SourceCodeKey::HashTraits, WTF::HashTraits<JSC::SourceCodeValue> >::KeyValuePairTraits, JSC::SourceCodeKey::Hash>, JSC::SourceCodeKey>(JSC::SourceCodeKey const&)
13  0x119d15a74 WTF::HashTable<JSC::SourceCodeKey, WTF::KeyValuePair<JSC::SourceCodeKey, JSC::SourceCodeValue>, WTF::KeyValuePairKeyExtractor<WTF::KeyValuePair<JSC::SourceCodeKey, JSC::SourceCodeValue> >, JSC::SourceCodeKey::Hash, WTF::HashMap<JSC::SourceCodeKey, JSC::SourceCodeValue, JSC::SourceCodeKey::Hash, JSC::SourceCodeKey::HashTraits, WTF::HashTraits<JSC::SourceCodeValue> >::KeyValuePairTraits, JSC::SourceCodeKey::HashTraits>::find(JSC::SourceCodeKey const&)
14  0x119d1598f WTF::HashMap<JSC::SourceCodeKey, JSC::SourceCodeValue, JSC::SourceCodeKey::Hash, JSC::SourceCodeKey::HashTraits, WTF::HashTraits<JSC::SourceCodeValue> >::find(JSC::SourceCodeKey const&)
15  0x119d14968 JSC::CodeCacheMap::findCacheAndUpdateAge(JSC::SourceCodeKey const&)
16  0x119d13b88 JSC::UnlinkedProgramCodeBlock* JSC::CodeCache::getUnlinkedGlobalCodeBlock<JSC::UnlinkedProgramCodeBlock, JSC::ProgramExecutable>(JSC::VM&, JSC::ProgramExecutable*, JSC::SourceCode const&, JSC::JSParserStrictMode, JSC::JSParserScriptMode, JSC::DebuggerMode, JSC::ParserError&, JSC::EvalContextType)
17  0x119d12d28 JSC::CodeCache::getUnlinkedProgramCodeBlock(JSC::VM&, JSC::ProgramExecutable*, JSC::SourceCode const&, JSC::JSParserStrictMode, JSC::DebuggerMode, JSC::ParserError&)
18  0x11a967789 JSC::ProgramExecutable::initializeGlobalProperties(JSC::VM&, JSC::ExecState*, JSC::JSScope*)
19  0x11a506ed3 JSC::Interpreter::executeProgram(JSC::SourceCode const&, JSC::ExecState*, JSC::JSObject*)
20  0x119d6ebd8 JSC::evaluate(JSC::ExecState*, JSC::SourceCode const&, JSC::JSValue, WTF::NakedPtr<JSC::Exception>&)
21  0x119d6ed20 JSC::profiledEvaluate(JSC::ExecState*, JSC::ProfilingReason, JSC::SourceCode const&, JSC::JSValue, WTF::NakedPtr<JSC::Exception>&)
22  0x10ff1b52b WebCore::JSMainThreadExecState::profiledEvaluate(JSC::ExecState*, JSC::ProfilingReason, JSC::SourceCode const&, JSC::JSValue, WTF::NakedPtr<JSC::Exception>&)
23  0x10ff14b48 WebCore::ScriptController::evaluateInWorld(WebCore::ScriptSourceCode const&, WebCore::DOMWrapperWorld&, WebCore::ExceptionDetails*)
24  0x10ff14c6d WebCore::ScriptController::evaluate(WebCore::ScriptSourceCode const&, WebCore::ExceptionDetails*)
25  0x10ff2afbe WebCore::ScriptElement::executeClassicScript(WebCore::ScriptSourceCode const&)
26  0x10f6855a2 WebCore::LoadableClassicScript::execute(WebCore::ScriptElement&)
27  0x10ff2b393 WebCore::ScriptElement::executeScriptAndDispatchEvent(WebCore::LoadableScript&)
28  0x10ff2b409 WebCore::ScriptElement::executePendingScript(WebCore::PendingScript&)
29  0x10e679974 WebCore::HTMLScriptRunner::executePendingScriptAndDispatchEvent(WebCore::PendingScript&)
30  0x10e67a012 WebCore::HTMLScriptRunner::executeParsingBlockingScripts()
31  0x10e67a179 WebCore::HTMLScriptRunner::executeScriptsWaitingForLoad(WebCore::PendingScript&)

This is seen with LayoutTest imported/w3c/web-platform-tests/dom/ranges/Range-surroundContents.html, but the crash log lists imported/w3c/csswg-test/css-shapes-1/shape-outside/values/shape-outside-shape-notation-000.html as the crashing test.

https://webkit-test-results.webkit.org/dashboards/flakiness_dashboard.html#showAllRuns=true&tests=imported%2Fw3c%2Fweb-platform-tests%2Fdom%2Franges%2FRange-surroundContents.html

[Ryan Haddad]

The earliest crash seen with this test on the flakiness dashboard appears to be Apr 13 01:25:20 2017 @ r215314

https://build.webkit.org/builders/Apple%20Sierra%20Debug%20WK2%20(Tests)/builds/456

[Alexey Proskuryakov]

This assertion has been hit many times before, when using Safari with debug builds of WebKit.

But it does look like it started being hit on tests recently indeed. The earliest test crash I see was on April 11th, https/tests/xmlhttprequest/zero-length-response.html.

Not really enough data to blame, but could well be new tests added in <http://trac.webkit.org/r215164>.

[Radar WebKit Bug Importer]

<rdar://problem/31752046>

[Alexey Proskuryakov]

*** Bug 172094 has been marked as a duplicate of this bug. ***

[Alexey Proskuryakov]

One test got skipped in r216846, but that's one of the many victims, not the culprit.

[Chris Dumez]

*** Bug 172506 has been marked as a duplicate of this bug. ***

[Chris Dumez]

Created attachment 311023 [details]
Patch

[Alexey Proskuryakov]

Comment on attachment 311023 [details]
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=311023&action=review

> LayoutTests/fast/dom/script-charset-update.html:33
> +<script src="../../resources/js-test-post.js"></script>

Can you get rid of pre/post variants in favor of "js-test.js"?

[Build Bot]

Comment on attachment 311023 [details]
Patch

Attachment 311023 [details] did not pass mac-ews (mac):
Output: http://webkit-queues.webkit.org/results/3801439

New failing tests:
imported/w3c/web-platform-tests/html/semantics/scripting-1/the-script-element/script-charset-01.html
fast/loader/cache-encoding.html

[Build Bot]

Created attachment 311028 [details]
Archive of layout-test-results from ews100 for mac-elcapitan

The attached test failures were seen while running run-webkit-tests on the mac-ews.
Bot: ews100  Port: mac-elcapitan  Platform: Mac OS X 10.11.6

[Build Bot]

Comment on attachment 311023 [details]
Patch

Attachment 311023 [details] did not pass mac-wk2-ews (mac-wk2):
Output: http://webkit-queues.webkit.org/results/3801448

New failing tests:
imported/w3c/web-platform-tests/html/semantics/scripting-1/the-script-element/script-charset-01.html
fast/loader/cache-encoding.html

[Build Bot]

Created attachment 311030 [details]
Archive of layout-test-results from ews106 for mac-elcapitan-wk2

The attached test failures were seen while running run-webkit-tests on the mac-wk2-ews.
Bot: ews106  Port: mac-elcapitan-wk2  Platform: Mac OS X 10.11.6

[Build Bot]

Comment on attachment 311023 [details]
Patch

Attachment 311023 [details] did not pass mac-debug-ews (mac):
Output: http://webkit-queues.webkit.org/results/3801614

New failing tests:
imported/w3c/web-platform-tests/html/semantics/scripting-1/the-script-element/script-charset-01.html
fast/loader/cache-encoding.html

[Build Bot]

Created attachment 311036 [details]
Archive of layout-test-results from ews115 for mac-elcapitan

The attached test failures were seen while running run-webkit-tests on the mac-debug-ews.
Bot: ews115  Port: mac-elcapitan  Platform: Mac OS X 10.11.6

[Build Bot]

Comment on attachment 311023 [details]
Patch

Attachment 311023 [details] did not pass ios-sim-ews (ios-simulator-wk2):
Output: http://webkit-queues.webkit.org/results/3801577

New failing tests:
imported/w3c/web-platform-tests/html/semantics/scripting-1/the-script-element/script-charset-01.html
fast/loader/cache-encoding.html

[Build Bot]

Created attachment 311037 [details]
Archive of layout-test-results from ews122 for ios-simulator-wk2

The attached test failures were seen while running run-webkit-tests on the ios-sim-ews.
Bot: ews122  Port: ios-simulator-wk2  Platform: Mac OS X 10.11.6

[Chris Dumez]

(In reply to Alexey Proskuryakov from comment #8)
> Comment on attachment 311023 [details]
> Patch
> 
> View in context:
> https://bugs.webkit.org/attachment.cgi?id=311023&action=review
> 
> > LayoutTests/fast/dom/script-charset-update.html:33
> > +<script src="../../resources/js-test-post.js"></script>
> 
> Can you get rid of pre/post variants in favor of "js-test.js"?

Sure, whenever you answer me this:
https://bugs.webkit.org/show_bug.cgi?id=172401#c7

[Chris Dumez]

Rolled out patch that caused this via https://trac.webkit.org/r217289. I'll use this bug to add a test that was consistently crashing.

[Chris Dumez]

Created attachment 311039 [details]
Patch

[Chris Dumez]

Comment on attachment 311039 [details]
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=311039&action=review

> LayoutTests/fast/dom/script-charset-update.html:5
> +<script src="../../resources/js-test-pre.js"></script>

The test is not passing is js-test.js, I am investigating separately.

[Geoffrey Garen]

Comment on attachment 311039 [details]
Patch

r=me

[Chris Dumez]

Comment on attachment 311039 [details]
Patch

Clearing flags on attachment: 311039

Committed r217300: <http://trac.webkit.org/changeset/217300>

[Chris Dumez]

All reviewed patches have been landed.  Closing bug.