Bug 172490

Summary:

ASSERT(!m_beginTime) in SMILTimeContainer::begin fires on many sites

Product:

WebKit

Reporter:

Joseph Pecoraro <joepeck>

Component:

Animations

Assignee:

Fujii Hironori <fujii.hironori>

Status:

RESOLVED FIXED

Severity:

Normal

CC:

aboya, bfulgham, cturner, dino, ews-watchlist, fmalita, fujii.hironori, gyuyoung.kim, koivisto, pdr, sabouhallawa, schenney, sergio, simon.fraser, thorton, webkit-bug-importer

Priority:

Keywords:

InRadar

Version:

WebKit Nightly Build

Hardware:

Unspecified

OS:

Unspecified

Attachments:

Description	Flags
Full backtrace of crash	none
test case	none
Patch	none

Joseph Pecoraro

Reported 2017-05-22 21:24:07 PDT

Assertion failure in SMILTimeContainer.cpp: Steps to reproduce: 1. Load https://www.theverge.com/2017/5/22/15673712/anker-battery-charger-amazon-empire-steven-yang-interview 2. Wait for a bit => ASSERT ASSERTION FAILED: !m_beginTime OpenSource/Source/WebCore/svg/animation/SMILTimeContainer.cpp(141) : void WebCore::SMILTimeContainer::begin() 1 0x1207e535d WTFCrash 2 0x116c8a429 WebCore::SMILTimeContainer::begin() 3 0x116e7e7f4 WebCore::SVGDocumentExtensions::startAnimations() 4 0x114b94417 WebCore::Document::implicitClose() 5 0x114f5a87b WebCore::FrameLoader::checkCallImplicitClose() 6 0x114f5a5b0 WebCore::FrameLoader::checkCompleted() 7 0x114b9a03c WebCore::Document::checkCompleted() 8 0x114b86905 WebCore::Document::loadEventDelayTimerFired() 9 0x114bc8cfb void std::__1::__invoke_void_return_wrapper<void>::__call<std::__1::__bind<void (WebCore::Document::*&)(), WebCore::Document*>&>(std::__1::__bind<void (WebCore::Document::*&)(), WebCore::Document*>&&&) 10 0x114bc8be9 std::__1::__function::__func<std::__1::__bind<void (WebCore::Document::*&)(), WebCore::Document*>, std::__1::allocator<std::__1::__bind<void (WebCore::Document::*&)(), WebCore::Document*> >, void ()>::operator()() 11 0x11448af0a std::__1::function<void ()>::operator()() const 12 0x11448ae29 WebCore::Timer::fired() 13 0x1170082b0 WebCore::ThreadTimers::sharedTimerFiredInternal() 14 0x1170094f1 WebCore::ThreadTimers::setSharedTimer(WebCore::SharedTimer*)::$_0::operator()() const 15 0x1170094bd void std::__1::__invoke_void_return_wrapper<void>::__call<WebCore::ThreadTimers::setSharedTimer(WebCore::SharedTimer*)::$_0&>(WebCore::ThreadTimers::setSharedTimer(WebCore::SharedTimer*)::$_0&&&) 16 0x117009469 std::__1::__function::__func<WebCore::ThreadTimers::setSharedTimer(WebCore::SharedTimer*)::$_0, std::__1::allocator<WebCore::ThreadTimers::setSharedTimer(WebCore::SharedTimer*)::$_0>, void ()>::operator()() 17 0x11448af0a std::__1::function<void ()>::operator()() const 18 0x11629c448 WebCore::MainThreadSharedTimer::fired() 19 0x11629c7d9 WebCore::timerFired(__CFRunLoopTimer*, void*) 20 0x7fffb8db4e04 __CFRUNLOOP_IS_CALLING_OUT_TO_A_TIMER_CALLBACK_FUNCTION__ 21 0x7fffb8db4a93 __CFRunLoopDoTimer 22 0x7fffb8db45ea __CFRunLoopDoTimers 23 0x7fffb8dabfc1 __CFRunLoopRun 24 0x7fffb8dab544 CFRunLoopRunSpecific 25 0x7fffb830bebc RunCurrentEventLoopInMode 26 0x7fffb830bcf1 ReceiveNextEventCommon 27 0x7fffb830bb26 _BlockUntilNextEventMatchingListInModeWithFilter 28 0x7fffb68a5bf8 _DPSNextEvent 29 0x7fffb702184e -[NSApplication(NSEvent) _nextEventMatchingEventMask:untilDate:inMode:dequeue:] 30 0x7fffb689a57f -[NSApplication run] 31 0x7fffb6864fb2 NSApplicationMain

Attachments
Full backtrace of crash (74.49 KB, text/plain) 2020-05-11 06:24 PDT, Charlie Turner	no flags	Details
test case (533 bytes, text/html) 2022-11-01 17:20 PDT, Fujii Hironori	no flags	Details
Patch (4.80 KB, patch) 2022-11-01 18:42 PDT, Fujii Hironori	no flags	Details Formatted Diff Diff
View All Add attachment proposed patch, testcase, etc.

Charlie Turner

Comment 1 2020-05-11 06:21:13 PDT

*** Bug 190413 has been marked as a duplicate of this bug. ***

Charlie Turner

Comment 2 2020-05-11 06:21:24 PDT

*** Bug 192687 has been marked as a duplicate of this bug. ***

Charlie Turner

Comment 3 2020-05-11 06:24:44 PDT

Created attachment 399016 [details] Full backtrace of crash Attached is the full backtrace, here's the relevant thread snippet, (gdb) bt #0 0x00007f347addc4ae in WTFCrash () at /home/cht/igalia/sources/WebKit/Source/WTF/wtf/Assertions.cpp:309 #1 0x00007f3486ef72bb in WTFCrashWithInfo () at DerivedSources/ForwardingHeaders/wtf/Assertions.h:671 #2 0x00007f348bb178c9 in WebCore::SMILTimeContainer::begin (this=0x7f33ddad5bb0) at /home/cht/igalia/sources/WebKit/Source/WebCore/svg/animation/SMILTimeContainer.cpp:119 #3 0x00007f348b89cece in WebCore::SVGDocumentExtensions::startAnimations (this=0x7f33fdafb678) at /home/cht/igalia/sources/WebKit/Source/WebCore/svg/SVGDocumentExtensions.cpp:97 #4 0x00007f348a19b026 in WebCore::Document::implicitClose (this=0x7f33f2f48b88) at /home/cht/igalia/sources/WebKit/Source/WebCore/dom/Document.cpp:3111 #5 0x00007f348ab2c09b in WebCore::FrameLoader::checkCallImplicitClose (this=0x7f33f0d34d00) at /home/cht/igalia/sources/WebKit/Source/WebCore/loader/FrameLoader.cpp:966 #6 0x00007f348ab2bbfa in WebCore::FrameLoader::checkCompleted (this=0x7f33f0d34d00) at /home/cht/igalia/sources/WebKit/Source/WebCore/loader/FrameLoader.cpp:907 #7 0x00007f348ab2c160 in WebCore::FrameLoader::completed (this=0x7f33de6b6340) at /home/cht/igalia/sources/WebKit/Source/WebCore/loader/FrameLoader.cpp:1221 #8 0x00007f348ab2bc17 in WebCore::FrameLoader::checkCompleted (this=0x7f33de6b6340) at /home/cht/igalia/sources/WebKit/Source/WebCore/loader/FrameLoader.cpp:911 #9 0x00007f348ab2bc7b in WebCore::FrameLoader::loadDone (this=0x7f33de6b6340, type=WebCore::LoadCompletionType::Finish) at /home/cht/igalia/sources/WebKit/Source/WebCore/loader/FrameLoader.cpp:830 #10 0x00007f348ac42dcd in WebCore::CachedResourceLoader::loadDone (this=0x7f33f09b2880, type=WebCore::LoadCompletionType::Finish, shouldPerformPostLoadActions=true) at /home/cht/igalia/sources/WebKit/Source/WebCore/loader/cache/CachedResourceLoader.cpp:1363 #11 0x00007f348abb11ee in WebCore::SubresourceLoader::notifyDone (this=0x7f33de471a00, type=WebCore::LoadCompletionType::Finish) at /home/cht/igalia/sources/WebKit/Source/WebCore/loader/SubresourceLoader.cpp:840 #12 0x00007f348abad920 in WebCore::SubresourceLoader::didFinishLoading (this=0x7f33de471a00, networkLoadMetrics=...) at /home/cht/igalia/sources/WebKit/Source/WebCore/loader/SubresourceLoader.cpp:740 #13 0x00007f34883bfe25 in WebKit::WebResourceLoader::didFinishResourceLoad (this=0x7f33db40e480, networkLoadMetrics=...) at /home/cht/igalia/sources/WebKit/Source/WebKit/WebProcess/Network/WebResourceLoader.cpp:251 #14 0x00007f348750cb60 in IPC::callMemberFunctionImpl<WebKit::WebResourceLoader, void (WebKit::WebResourceLoader::*)(WebCore::NetworkLoadMetrics const&), std::tuple<WebCore::NetworkLoadMetrics>, 0ul> (object=0x7f33db40e480, function=(void (WebKit::WebResourceLoader::*)(WebKit::WebResourceLoader * const, const WebCore::NetworkLoadMetrics &)) 0x7f34883bfad0 <WebKit::WebResourceLoader::didFinishResourceLoad(WebCore::NetworkLoadMetrics const&)>, args=...) at /home/cht/igalia/sources/WebKit/Source/WebKit/Platform/IPC/HandleMessage.h:41 #15 0x00007f348750c1d0 in IPC::callMemberFunction<WebKit::WebResourceLoader, void (WebKit::WebResourceLoader::*)(WebCore::NetworkLoadMetrics const&), std::tuple<WebCore::NetworkLoadMetrics>, std::integer_sequence<unsigned long, 0ul> > (args=..., object=0x7f33db40e480, function=(void (WebKit::WebResourceLoader::*)(WebKit::WebResourceLoader * const, const WebCore::NetworkLoadMetrics &)) 0x7f34883bfad0 <WebKit::WebResourceLoader::didFinishResourceLoad(WebCore::NetworkLoadMetrics const&)>) at /home/cht/igalia/sources/WebKit/Source/WebKit/Platform/IPC/HandleMessage.h:47 #16 0x00007f3487509d1e in IPC::handleMessage<Messages::WebResourceLoader::DidFinishResourceLoad, WebKit::WebResourceLoader, void (WebKit::WebResourceLoader::*)(WebCore::NetworkLoadMetrics const&)> (decoder=..., object=0x7f33db40e480, function=(void (WebKit::WebResourceLoader::*)(WebKit::WebResourceLoader * const, const WebCore::NetworkLoadMetrics &)) 0x7f34883bfad0 <WebKit::WebResourceLoader::didFinishResourceLoad(WebCore::NetworkLoadMetrics const&)>) at /home/cht/igalia/sources/WebKit/Source/WebKit/Platform/IPC/HandleMessage.h:114 #17 0x00007f3487509510 in WebKit::WebResourceLoader::didReceiveWebResourceLoaderMessage (this=0x7f33db40e480, connection=..., decoder=...) at DerivedSources/WebKit/WebResourceLoaderMessageReceiver.cpp:70 #18 0x00007f34883b7870 in WebKit::NetworkProcessConnection::didReceiveMessage (this=0x7f346f7ea038, connection=..., decoder=...) at /home/cht/igalia/sources/WebKit/Source/WebKit/WebProcess/Network/NetworkProcessConnection.cpp:91 #19 0x00007f3487a500af in IPC::Connection::dispatchMessage (this=0x7f346f7e51c0, decoder=...) at /home/cht/igalia/sources/WebKit/Source/WebKit/Platform/IPC/Connection.cpp:996 #20 0x00007f3487a50642 in IPC::Connection::dispatchMessage (this=0x7f346f7e51c0, message=...) at /home/cht/igalia/sources/WebKit/Source/WebKit/Platform/IPC/Connection.cpp:1065 #21 0x00007f3487a50ba0 in IPC::Connection::dispatchOneIncomingMessage (this=0x7f346f7e51c0) at /home/cht/igalia/sources/WebKit/Source/WebKit/Platform/IPC/Connection.cpp:1134 #22 0x00007f3487a5456e in IPC::Connection::enqueueIncomingMessage(std::unique_ptr<IPC::Decoder, std::default_delete<IPC::Decoder> >)::$_7::operator()() (this=0x7f33fc4fa868) at /home/cht/igalia/sources/WebKit/Source/WebKit/Platform/IPC/Connection.cpp:973 #23 0x00007f3487a544fe in WTF::Detail::CallableWrapper<IPC::Connection::enqueueIncomingMessage(std::unique_ptr<IPC::Decoder, std::default_delete<IPC::Decoder> >)::$_7, void>::call() (this=0x7f33fc4fa860) at DerivedSources/ForwardingHeaders/wtf/Function.h:52 #24 0x00007f3486ef6b22 in WTF::Function<void ()>::operator()() const (this=0x7ffed4029cf8) at DerivedSources/ForwardingHeaders/wtf/Function.h:84 #25 0x00007f347ae131c8 in WTF::RunLoop::performWork (this=0x7f346f7f8000) at /home/cht/igalia/sources/WebKit/Source/WTF/wtf/RunLoop.cpp:119 #26 0x00007f347aea67fc in WTF::RunLoop::RunLoop()::$_0::operator()(void*) const (this=0x7f346f7f8000, userData=0x7f346f7f8000) at /home/cht/igalia/sources/WebKit/Source/WTF/wtf/glib/RunLoopGLib.cpp:68 #27 0x00007f347aea67d5 in WTF::RunLoop::RunLoop()::$_0::__invoke(void*) (userData=0x7f346f7f8000) at /home/cht/igalia/sources/WebKit/Source/WTF/wtf/glib/RunLoopGLib.cpp:67 #28 0x00007f347aea67b1 in WTF::$_3::operator() (this=0x1660d60, source=0x1660d60, callback=0x7f347aea67c0 <WTF::RunLoop::RunLoop()::$_0::__invoke(void*)>, userData=0x7f346f7f8000) at /home/cht/igalia/sources/WebKit/Source/WTF/wtf/glib/RunLoopGLib.cpp:45 #29 0x00007f347aea6755 in WTF::$_3::__invoke (source=0x1660d60, callback=0x7f347aea67c0 <WTF::RunLoop::RunLoop()::$_0::__invoke(void*)>, userData=0x7f346f7f8000) at /home/cht/igalia/sources/WebKit/Source/WTF/wtf/glib/RunLoopGLib.cpp:40 #30 0x00007f3473b31dd8 in ?? () from /lib/x86_64-linux-gnu/libglib-2.0.so.0 #31 0x0000000001555820 in ?? () #32 0x00007f3400000000 in ?? () #33 0x0000000000000000 in ?? ()

Brent Fulgham

Comment 4 2022-06-30 09:31:50 PDT

This seems to be tracked by this radar: <rdar://45153186>

Fujii Hironori

Comment 5 2022-11-01 17:20:18 PDT

Created attachment 463354 [details] test case

Fujii Hironori

Comment 6 2022-11-01 18:42:48 PDT

Created attachment 463355 [details] Patch

Simon Fraser (smfr)

Comment 7 2022-11-02 14:13:11 PDT

Comment on attachment 463355 [details] Patch Nice fix!

Fujii Hironori

Comment 8 2022-11-02 15:00:58 PDT

Comment on attachment 463355 [details] Patch Thank you!

EWS

Comment 9 2022-11-02 15:49:12 PDT

Committed 256253@main (58eb1cbd097a): <https://commits.webkit.org/256253@main> All reviewed patches have been landed. Closing bug and clearing flags on attachment 463355 [details].

Note You need to log in before you can comment on or make changes to this bug.