Bug 219745

Summary: REGRESSION (r270574): [iOS] ASSERTION FAILED: !m_messageReceiverMapCount under WebKit::SpeechRecognitionRemoteRealtimeMediaSourceManager::~SpeechRecognitionRemoteRealtimeMediaSourceManager
Product: WebKit Reporter: Ryan Haddad <ryanhaddad>
Component: New BugsAssignee: Sihui Liu <sihui_liu>
Status: RESOLVED FIXED    
Severity: Normal CC: darin, sihui_liu, webkit-bot-watchers-bugzilla, webkit-bug-importer, youennf
Priority: P2 Keywords: InRadar
Version: WebKit Nightly Build   
Hardware: Unspecified   
OS: Unspecified   
See Also: https://bugs.webkit.org/show_bug.cgi?id=219371
Attachments:
Description Flags
crash log
none
Patch
ews-feeder: commit-queue-
Patch none

Description Ryan Haddad 2020-12-10 09:46:33 PST 
fast/table/crash-splitColumn-3.html has become a flaky crash on iOS debug bots with the following assertion failure:

ASSERTION FAILED: !m_messageReceiverMapCount
/Volumes/Data/slave/ios-simulator-14-debug/build/Source/WebKit/Platform/IPC/MessageReceiver.h(40) : virtual IPC::MessageReceiver::~MessageReceiver()
1   0x104c64129 WTFCrash
2   0x10c7ae09b WTFCrashWithInfo(int, char const*, char const*, int)
3   0x10c7e99c8 IPC::MessageReceiver::~MessageReceiver()
4   0x10ceb88e3 WebKit::SpeechRecognitionRemoteRealtimeMediaSourceManager::~SpeechRecognitionRemoteRealtimeMediaSourceManager()
5   0x10ceb87f5 WebKit::SpeechRecognitionRemoteRealtimeMediaSourceManager::~SpeechRecognitionRemoteRealtimeMediaSourceManager()
6   0x10dba7d5b std::__1::default_delete<WebKit::SpeechRecognitionRemoteRealtimeMediaSourceManager>::operator()(WebKit::SpeechRecognitionRemoteRealtimeMediaSourceManager*) const
7   0x10dba7cdf std::__1::unique_ptr<WebKit::SpeechRecognitionRemoteRealtimeMediaSourceManager, std::__1::default_delete<WebKit::SpeechRecognitionRemoteRealtimeMediaSourceManager> >::reset(WebKit::SpeechRecognitionRemoteRealtimeMediaSourceManager*)
8   0x10dba7c79 std::__1::unique_ptr<WebKit::SpeechRecognitionRemoteRealtimeMediaSourceManager, std::__1::default_delete<WebKit::SpeechRecognitionRemoteRealtimeMediaSourceManager> >::~unique_ptr()
9   0x10db448f5 std::__1::unique_ptr<WebKit::SpeechRecognitionRemoteRealtimeMediaSourceManager, std::__1::default_delete<WebKit::SpeechRecognitionRemoteRealtimeMediaSourceManager> >::~unique_ptr()
10  0x10db441ee WebKit::WebProcessProxy::~WebProcessProxy()
11  0x10db44bb5 WebKit::WebProcessProxy::~WebProcessProxy()
12  0x10db44c3c WebKit::WebProcessProxy::~WebProcessProxy()
13  0x10d6c7f64 WTF::ThreadSafeRefCounted<WebKit::WebProcessProxy, (WTF::DestructionThread)0>::deref() const::'lambda'()::operator()() const
14  0x10d6c7efd WTF::ThreadSafeRefCounted<WebKit::WebProcessProxy, (WTF::DestructionThread)0>::deref() const
15  0x10d6c7eae WebKit::WebProcessProxy::deref()
16  0x10d6c7e7f WTF::Ref<WebKit::WebProcessProxy, WTF::RawPtrTraits<WebKit::WebProcessProxy> >::~Ref()
17  0x10d69b0d5 WTF::Ref<WebKit::WebProcessProxy, WTF::RawPtrTraits<WebKit::WebProcessProxy> >::~Ref()
18  0x10d9f671f WebKit::WebPageProxy::~WebPageProxy()
19  0x10d9f7b85 WebKit::WebPageProxy::~WebPageProxy()
20  0x10d23f184 -[WKObject dealloc]
21  0x102ea2834 objc_object::sidetable_release(bool, bool)
22  0x10d1e01bd API::Object::deref() const
23  0x10d597cf1 WTF::DefaultRefDerefTraits<WebKit::WebPageProxy>::derefIfNotNull(WebKit::WebPageProxy*)
24  0x10d597cb9 WTF::RefPtr<WebKit::WebPageProxy, WTF::RawPtrTraits<WebKit::WebPageProxy>, WTF::DefaultRefDerefTraits<WebKit::WebPageProxy> >::~RefPtr()
25  0x10d593ea5 WTF::RefPtr<WebKit::WebPageProxy, WTF::RawPtrTraits<WebKit::WebPageProxy>, WTF::DefaultRefDerefTraits<WebKit::WebPageProxy> >::~RefPtr()
26  0x10d6961fb -[WKWebView .cxx_destruct]
27  0x102e8a0f0 object_cxxDestructFromClass(objc_object*, objc_class*)
28  0x102e9bf11 objc_destructInstance
29  0x102ea1fb8 -[NSObject dealloc]
30  0x140ee59d5 -[UIResponder dealloc]
31  0x1413e38df -[UIView dealloc]

https://results.webkit.org/?suite=layout-tests&test=fast%2Ftable%2Fcrash-splitColumn-3.html
Comment 1 Ryan Haddad 2020-12-10 09:46:47 PST 
Created attachment 415888 [details]
crash log
Comment 2 Ryan Haddad 2020-12-10 09:47:17 PST 
This appears to have started with https://trac.webkit.org/changeset/270574/webkit
Comment 3 Radar WebKit Bug Importer 2020-12-10 09:47:42 PST 
<rdar://problem/72184764>
Comment 4 Sihui Liu 2020-12-10 10:07:17 PST 
Created attachment 415891 [details]
Patch
Comment 5 Sihui Liu 2020-12-10 10:34:27 PST 
Created attachment 415898 [details]
Patch
Comment 6 EWS 2020-12-10 12:47:14 PST 
Committed r270646: <https://trac.webkit.org/changeset/270646>

All reviewed patches have been landed. Closing bug and clearing flags on attachment 415898 [details].