Bug 192673 – REGRESSION: Crashes in MarkedBlock::aboutToMarkSlow on imported/w3c/web-platform-tests/FileAPI/idlharness.worker.html and other tests

• Component: JavaScriptCore
• Status: RESOLVED DUPLICATE

[WebKit Commit Bot]

This is an automatically generated bug from the commit-queue.
imported/w3c/web-platform-tests/FileAPI/idlharness.worker.html has been flaky on the commit-queue.

imported/w3c/web-platform-tests/FileAPI/idlharness.worker.html was authored by .
https://trac.webkit.org/browser/trunk/LayoutTests/imported/w3c/web-platform-tests/FileAPI/idlharness.worker.html

The commit-queue just saw imported/w3c/web-platform-tests/FileAPI/idlharness.worker.html flake (DumpRenderTree crashed) while processing attachment 357239 [details] on bug 192639.
Bot: webkit-cq-02  Port: <class 'webkitpy.common.config.ports.MacPort'>  Platform: Mac OS X 10.12.6

The bots will update this with information from each new failure.

If you believe this bug to be fixed or invalid, feel free to close.  The bots will re-open if the flake re-occurs.

If you would like to track this test fix with another bug, please close this bug as a duplicate.  The bots will follow the duplicate chain when making future comments.

[WebKit Commit Bot]

Created attachment 357242 [details]
Archive of layout-test-results from webkit-cq-02

[Alexey Proskuryakov]

Thread 0 Crashed:: Dispatch queue: com.apple.main-thread
0   com.apple.JavaScriptCore      	0x00000001038e1a6e JSC::MarkedBlock::aboutToMarkSlow(unsigned int) + 94 (atomic:882)
1   com.apple.JavaScriptCore      	0x0000000103c3cd0a JSC::JSImmutableButterfly::visitChildren(JSC::JSCell*, JSC::SlotVisitor&) + 298 (MarkedBlock.h:559)
2   com.apple.JavaScriptCore      	0x00000001038edb34 JSC::SlotVisitor::drain(WTF::MonotonicTime)::$_3::operator()(JSC::MarkStackArray&) const + 324 (SlotVisitor.cpp:397)
3   com.apple.JavaScriptCore      	0x00000001038ead02 JSC::SlotVisitor::drain(WTF::MonotonicTime) + 210 (SlotVisitorInlines.h:190)
4   com.apple.JavaScriptCore      	0x00000001038eb949 JSC::SlotVisitor::drainInParallel(WTF::MonotonicTime) + 57 (SlotVisitor.cpp:703)
5   com.apple.JavaScriptCore      	0x00000001038c470b JSC::Heap::runFixpointPhase(JSC::GCConductor) + 2027 (SlotVisitor.h:283)
6   com.apple.JavaScriptCore      	0x00000001038c3408 JSC::Heap::runCurrentPhase(JSC::GCConductor, JSC::CurrentThreadState*) + 200 (Heap.cpp:1175)
7   com.apple.JavaScriptCore      	0x00000001038cc5fb WTF::ScopedLambdaFunctor<void (JSC::CurrentThreadState&), JSC::Heap::collectInMutatorThread()::$_0>::implFunction(void*, JSC::CurrentThreadState&) + 27 (Heap.cpp:1791)
8   com.apple.JavaScriptCore      	0x00000001038deba5 JSC::callWithCurrentThreadState(WTF::ScopedLambda<void (JSC::CurrentThreadState&)> const&) + 117 (MachineStackMarker.cpp:226)
9   com.apple.JavaScriptCore      	0x00000001038c6ccd JSC::Heap::collectInMutatorThread() + 93 (CollectingScope.h:43)
10  com.apple.JavaScriptCore      	0x00000001038c6b95 JSC::Heap::stopIfNecessarySlow(unsigned int) + 53 (Heap.cpp:1771)
11  com.apple.JavaScriptCore      	0x00000001038c6a8f JSC::Heap::stopIfNecessarySlow() + 47 (Heap.cpp:1745)
12  com.apple.JavaScriptCore      	0x00000001038c06a4 JSC::Heap::collectIfNecessaryOrDefer(JSC::GCDeferralContext*) + 132 (Heap.cpp:2566)
13  com.apple.JavaScriptCore      	0x00000001038ddff9 JSC::LocalAllocator::allocateSlowCase(JSC::GCDeferralContext*, JSC::AllocationFailureMode) + 281 (LocalAllocator.cpp:128)
14  com.apple.JavaScriptCore      	0x00000001035e9d6d JSC::JSString::createHasOtherOwner(JSC::VM&, WTF::Ref<WTF::StringImpl, WTF::DumbPtrTraits<WTF::StringImpl> >&&) + 269 (LocalAllocatorInlines.h:37)

[Keith Miller]

hmm, looks like a GC bug. Do we know roughly when this started?

[Alexey Proskuryakov]

This started yesterday. Seems somewhat frequent actually, and impacts other worker tests too, see e.g. <https://build.webkit.org/results/Apple%20Sierra%20Debug%20WK1%20(Tests)/r239187%20(10710)/results.html>

[Radar WebKit Bug Importer]

<rdar://problem/46736880>

[Alexey Proskuryakov]

Maybe we should roll back https://trac.webkit.org/r239153 to see if that was the culprit? Timing wise, it seems likely.

[Keith Miller]

(In reply to Alexey Proskuryakov from comment #6)
> Maybe we should roll back https://trac.webkit.org/r239153 to see if that was
> the culprit? Timing wise, it seems likely.

Seems reasonable, we can always reland later.

[Ryan Haddad]

Rolling out in https://bugs.webkit.org/show_bug.cgi?id=192715.

Duping this to the original Bugzilla for the change.

*** This bug has been marked as a duplicate of bug 190047 ***