Bug 195431

Summary: REGRESSION: [macOS WK1] Flaky legacy-animation-engine test crashes in WebCore::CanvasBase::notifyObserversCanvasDestroyed()
Product: WebKit Reporter: WebKit Commit Bot <commit-queue>
Component: Tools / TestsAssignee: WebKit Commit Bot <commit-queue>
Status: RESOLVED CONFIGURATION CHANGED    
Severity: Normal CC: dino, graouts, graouts, lforschler, ryanhaddad, webkit-bot-watchers-bugzilla, webkit-bug-importer
Priority: P2 Keywords: InRadar
Version: WebKit Nightly Build   
Hardware: Unspecified   
OS: Unspecified   
Bug Depends on:    
Bug Blocks: 50856    
Attachments:
Description Flags
Archive of layout-test-results from webkit-cq-02 none

Description WebKit Commit Bot 2019-03-07 13:42:32 PST 
This is an automatically generated bug from the commit-queue.
legacy-animation-engine/fast/layers/no-clipping-overflow-hidden-hardware-acceleration.html has been flaky on the commit-queue.

legacy-animation-engine/fast/layers/no-clipping-overflow-hidden-hardware-acceleration.html was authored by dino@apple.com and graouts@apple.com.
https://trac.webkit.org/browser/trunk/LayoutTests/legacy-animation-engine/fast/layers/no-clipping-overflow-hidden-hardware-acceleration.html

The commit-queue just saw legacy-animation-engine/fast/layers/no-clipping-overflow-hidden-hardware-acceleration.html flake (DumpRenderTree crashed) while processing attachment 363912 [details] on bug 195214.
Bot: webkit-cq-02  Port: <class 'webkitpy.common.config.ports.MacPort'>  Platform: Mac OS X 10.13.6

The bots will update this with information from each new failure.

If you believe this bug to be fixed or invalid, feel free to close.  The bots will re-open if the flake re-occurs.

If you would like to track this test fix with another bug, please close this bug as a duplicate.  The bots will follow the duplicate chain when making future comments.
Comment 1 WebKit Commit Bot 2019-03-07 13:42:34 PST 
Created attachment 363919 [details]
Archive of layout-test-results from webkit-cq-02
Comment 2 Ryan Haddad 2019-03-12 12:07:52 PDT 
Application Specific Information:
CRASHING TEST: legacy-animation-engine/fast/layers/no-clipping-overflow-hidden-hardware-acceleration.html

Thread 0 Crashed:: Dispatch queue: com.apple.main-thread
0   com.apple.WebCore             	0x000000010a2f1f6a WebCore::CanvasBase::notifyObserversCanvasDestroyed() + 106 (CanvasBase.cpp:87)
1   com.apple.WebCore             	0x000000010a31b97e WebCore::HTMLCanvasElement::~HTMLCanvasElement() + 46 (memory:2595)
2   com.apple.WebCore             	0x000000010a31baff WebCore::HTMLCanvasElement::~HTMLCanvasElement() + 15
3   com.apple.JavaScriptCore      	0x00000001067eebcd void JSC::MarkedBlock::Handle::specializedSweep<true, (JSC::MarkedBlock::Handle::EmptyMode)1, (JSC::MarkedBlock::Handle::SweepMode)1, (JSC::MarkedBlock::Handle::SweepDestructionMode)1, (JSC::MarkedBlock::Handle::ScribbleMode)0, (JSC::MarkedBlock::Handle::NewlyAllocatedMode)1, (JSC::MarkedBlock::Handle::MarksMode)1, JSC::JSDestructibleObjectDestroyFunc>(JSC::FreeList*, JSC::MarkedBlock::Handle::EmptyMode, JSC::MarkedBlock::Handle::SweepMode, JSC::MarkedBlock::Handle::SweepDestructionMode, JSC::MarkedBlock::Handle::ScribbleMode, JSC::MarkedBlock::Handle::NewlyAllocatedMode, JSC::MarkedBlock::Handle::MarksMode, JSC::JSDestructibleObjectDestroyFunc const&) + 173 (JSDestructibleObjectHeapCellType.cpp:37)
4   com.apple.JavaScriptCore      	0x00000001067ed5c0 void JSC::MarkedBlock::Handle::finishSweepKnowingHeapCellType<JSC::JSDestructibleObjectDestroyFunc>(JSC::FreeList*, JSC::JSDestructibleObjectDestroyFunc const&)::'lambda'()::operator()() const + 384
5   com.apple.JavaScriptCore      	0x00000001067ecf63 void JSC::MarkedBlock::Handle::finishSweepKnowingHeapCellType<JSC::JSDestructibleObjectDestroyFunc>(JSC::FreeList*, JSC::JSDestructibleObjectDestroyFunc const&) + 307 (MarkedBlockInlines.h:435)
6   com.apple.JavaScriptCore      	0x00000001067ece2a JSC::JSDestructibleObjectHeapCellType::finishSweep(JSC::MarkedBlock::Handle&, JSC::FreeList*) + 26 (JSDestructibleObjectHeapCellType.cpp:53)
7   com.apple.JavaScriptCore      	0x0000000106452a94 JSC::MarkedBlock::Handle::sweep(JSC::FreeList*) + 308
Comment 3 Ryan Haddad 2019-03-13 17:16:11 PDT 
*** Bug 195545 has been marked as a duplicate of this bug. ***
Comment 4 Ryan Haddad 2019-03-13 17:16:35 PDT 
*** Bug 195621 has been marked as a duplicate of this bug. ***
Comment 5 Ryan Haddad 2019-03-13 17:16:47 PDT 
*** Bug 195617 has been marked as a duplicate of this bug. ***
Comment 6 Ryan Haddad 2019-03-13 17:16:51 PDT 
*** Bug 195596 has been marked as a duplicate of this bug. ***
Comment 7 Ryan Haddad 2019-03-13 17:16:55 PDT 
*** Bug 195699 has been marked as a duplicate of this bug. ***
Comment 8 Radar WebKit Bug Importer 2019-03-13 17:21:04 PDT 
<rdar://problem/48870803>
Comment 9 Radar WebKit Bug Importer 2019-03-13 17:22:06 PDT 
<rdar://problem/48870842>
Comment 10 Antoine Quint 2019-03-14 09:31:03 PDT 
Do we have an identified regression point?
Comment 11 Ryan Haddad 2019-03-14 09:34:05 PDT 
(In reply to Antoine Quint from comment #10)
> Do we have an identified regression point?
No, I have not yet identified one.
Comment 12 Antoine Quint 2020-03-09 12:57:48 PDT 
This test is gone as of r258150, see bug 208815.