|Summary:||REGRESSION (r263328): Crash in bool WTF::WeakHashSet<WebKit::AudioSessionRoutingArbitratorProxy, WTF::EmptyCounter>::contains<WebKit::AudioSessionRoutingArbitratorProxy> const|
|Product:||WebKit||Reporter:||Jer Noble <jer.noble>|
|Component:||New Bugs||Assignee:||Jer Noble <jer.noble>|
|Severity:||Normal||CC:||eric.carlson, ews-watchlist, glenn, peng.liu6, philipj, sergio, slewis, webkit-bug-importer|
|Version:||WebKit Nightly Build|
Description Jer Noble 2020-06-23 12:29:30 PDT
Comment 1 Jer Noble 2020-06-23 12:30:04 PDT
Comment 2 Jer Noble 2020-06-23 12:31:57 PDT
Created attachment 402582 [details] Patch
Comment 3 Jer Noble 2020-06-23 13:53:42 PDT
Created attachment 402588 [details] Patch
Comment 4 Jer Noble 2020-06-23 15:20:49 PDT
No crashes when running tests locally.
Comment 5 Jer Noble 2020-06-23 23:17:09 PDT
Whelp, I updated sources, re-built, and re-ran tests and crashes aplenty. The crash log shows an assertion in the UniqueRef operator->() called from WebProcessProxy::shutDown(). So the underlying cause /must/ be that WebProcessProxy was dealloc'd (and it's UniqueRef member's destructor called) sometime before shutDown().
Comment 6 Jer Noble 2020-06-23 23:19:46 PDT
Oh! I bet WebProcessPool::disconnectProcess(WebProcessProxy*) has the side-effect of destroying the WebProcessProxy! And the next line is the UniqueRef operator->() which is showing a crash result. That means the underlying problem has nothing to do with the ASSERT in the patch above, but instead that any call after disconnectProcess(this) is a potential unsafe access of freed memory.
Comment 7 Jer Noble 2020-06-23 23:34:39 PDT
Created attachment 402624 [details] Patch
Comment 8 Jer Noble 2020-06-23 23:55:26 PDT
The above fix definitely eliminated all the crashes seen previously when running run-webkit-tests against a release build.
Comment 9 EWS 2020-06-24 08:24:50 PDT
Committed r263456: <https://trac.webkit.org/changeset/263456> All reviewed patches have been landed. Closing bug and clearing flags on attachment 402624 [details].