Bug 190373 – ASSERTION FAILED: m_cachesLocks.contains(sessionID) in WebKit::CacheStorageEngineConnection::dereference(PAL::SessionID, unsigned long long)

• Component: New Bugs
• Status: RESOLVED FIXED

[Ryan Haddad]

Created attachment 351818 [details]
Crash log

ASSERTION FAILED: m_cachesLocks.contains(sessionID)
/Volumes/Data/slave/sierra-debug/build/Source/WebKit/NetworkProcess/cache/CacheStorageEngineConnection.cpp(135) : void WebKit::CacheStorageEngineConnection::dereference(PAL::SessionID, uint64_t)
1   0x121f65fe9 WTFCrash
2   0x1078012db WTFCrashWithInfo(int, char const*, char const*, int)
3   0x107b62996 WebKit::CacheStorageEngineConnection::dereference(PAL::SessionID, unsigned long long)
4   0x10782b2f0 void IPC::callMemberFunctionImpl<WebKit::CacheStorageEngineConnection, void (WebKit::CacheStorageEngineConnection::*)(PAL::SessionID, unsigned long long), std::__1::tuple<PAL::SessionID, unsigned long long>, 0ul, 1ul>(WebKit::CacheStorageEngineConnection*, void (WebKit::CacheStorageEngineConnection::*)(PAL::SessionID, unsigned long long), std::__1::tuple<PAL::SessionID, unsigned long long>&&, std::__1::integer_sequence<unsigned long, 0ul, 1ul>)
5   0x10782a868 void IPC::callMemberFunction<WebKit::CacheStorageEngineConnection, void (WebKit::CacheStorageEngineConnection::*)(PAL::SessionID, unsigned long long), std::__1::tuple<PAL::SessionID, unsigned long long>, std::__1::integer_sequence<unsigned long, 0ul, 1ul> >(std::__1::tuple<PAL::SessionID, unsigned long long>&&, WebKit::CacheStorageEngineConnection*, void (WebKit::CacheStorageEngineConnection::*)(PAL::SessionID, unsigned long long))
6   0x107829544 void IPC::handleMessage<Messages::CacheStorageEngineConnection::Dereference, WebKit::CacheStorageEngineConnection, void (WebKit::CacheStorageEngineConnection::*)(PAL::SessionID, unsigned long long)>(IPC::Decoder&, WebKit::CacheStorageEngineConnection*, void (WebKit::CacheStorageEngineConnection::*)(PAL::SessionID, unsigned long long))
7   0x107828e0d WebKit::CacheStorageEngineConnection::didReceiveMessage(IPC::Connection&, IPC::Decoder&)
8   0x107a0af64 WebKit::NetworkConnectionToWebProcess::didReceiveMessage(IPC::Connection&, IPC::Decoder&)
9   0x10784877a IPC::Connection::dispatchMessage(IPC::Decoder&)
10  0x10783b961 IPC::Connection::dispatchMessage(std::__1::unique_ptr<IPC::Decoder, std::__1::default_delete<IPC::Decoder> >)
11  0x107849293 IPC::Connection::dispatchOneIncomingMessage()
12  0x1078660d8 IPC::Connection::enqueueIncomingMessage(std::__1::unique_ptr<IPC::Decoder, std::__1::default_delete<IPC::Decoder> >)::$_14::operator()()
13  0x107865fe9 WTF::Function<void ()>::CallableWrapper<IPC::Connection::enqueueIncomingMessage(std::__1::unique_ptr<IPC::Decoder, std::__1::default_delete<IPC::Decoder> >)::$_14>::call()
14  0x121f8d2bd WTF::Function<void ()>::operator()() const
15  0x121fe5b93 WTF::RunLoop::performWork()
16  0x121fe6524 WTF::RunLoop::performWork(void*)
17  0x7fffa14ef3e1 __CFRUNLOOP_IS_CALLING_OUT_TO_A_SOURCE0_PERFORM_FUNCTION__
18  0x7fffa14d065c __CFRunLoopDoSources0
19  0x7fffa14cfb46 __CFRunLoopRun
20  0x7fffa14cf544 CFRunLoopRunSpecific
21  0x7fffa2f00252 -[NSRunLoop(NSRunLoop) runMode:beforeDate:]
22  0x7fffa2f0012a -[NSRunLoop(NSRunLoop) run]
23  0x7fffb72f289b _xpc_objc_main
24  0x7fffb72f12e4 xpc_main
25  0x1077e608e WebKit::XPCServiceMain(int, char const**)
26  0x1077e6382 main
27  0x7fffb7099235 start
28  0x1
LEAK: 2 WebPageProxy

This assertion failure was seen with layout test http/wpt/service-workers/update-service-worker.https.html here:
https://build.webkit.org/results/Apple%20Sierra%20Debug%20WK2%20(Tests)/r236798%20(8218)/results.html

https://webkit-test-results.webkit.org/dashboards/flakiness_dashboard.html#showAllRuns=true&tests=http%2Fwpt%2Fservice-workers%2Fupdate-service-worker.https.html

[Radar WebKit Bug Importer]

<rdar://problem/45106402>

[Ryan Haddad]

The first instance of this test crashing on the dashboard appears to be 10/3/2018 2:15:32 PM @ r236798

[Ryan Haddad]

I don't yet have repro steps for this.

[Ryan Haddad]

Created attachment 351836 [details]
test list to reproduce

I can reproduce the crash using the attached test list using the following command:

run-webkit-tests --debug --test-list 190373-repro-tests -g --exit-after-n-crashes-or-timeouts 1 --child-processes 1 --iter 5

[youenn fablet]

This might assert if network process is crashing but web process has a DOMCache.
In that case, when navigating away, DOMCache will dereference, network process will create a new CacheStorageEngineConnection and will crash.

We should probably dereference when DOM cache is stopped, which would help there not hitting this case.
But probably we should also remove this assert.

[youenn fablet]

Created attachment 351848 [details]
Patch

[WebKit Commit Bot]

Comment on attachment 351848 [details]
Patch

Clearing flags on attachment: 351848

Committed r236994: <https://trac.webkit.org/changeset/236994>

[WebKit Commit Bot]

All reviewed patches have been landed.  Closing bug.