Bug 223750

Summary: [ Debug wk2 ] ASSERTION FAILED: willBeComposited == needsToBeComposited(layer, queryData)
Product: WebKit Reporter: Robert Jenner <jenner>
Component: New BugsAssignee: Nobody <webkit-unassigned>
Status: RESOLVED CONFIGURATION CHANGED    
Severity: Normal CC: ap, ayumi_kojima, bfulgham, ehutchison, simon.fraser, webkit-bot-watchers-bugzilla, webkit-bug-importer
Priority: P2 Keywords: InRadar
Version: WebKit Nightly Build   
Hardware: Unspecified   
OS: Unspecified   
See Also: https://bugs.webkit.org/show_bug.cgi?id=229505
https://bugs.webkit.org/show_bug.cgi?id=229722
Attachments:
Description Flags
Test list
none
Reproduced crash log
none
TestList2
none
CrashLog from r268268 none

Description Robert Jenner 2021-03-25 09:47:33 PDT
security/contentSecurityPolicy/plugins-types-allows-youtube-plugin-replacement.html 

is a flakey crash in Debug wk2 macOS Catalina and BigSur, and on iOS Simulator.

HISTORY URL:
https://results.webkit.org/?suite=layout-tests&test=security%2FcontentSecurityPolicy%2Fplugins-types-allows-youtube-plugin-replacement.html

CRASHLOG TEXT:
No crash log found for com.apple.WebKit.WebContent.Development:50874.

stdout:

stderr:
ASSERTION FAILED: willBeComposited == needsToBeComposited(layer, queryData)
./rendering/RenderLayerCompositor.cpp(1131) : void WebCore::RenderLayerCompositor::computeCompositingRequirements(WebCore::RenderLayer *, WebCore::RenderLayer &, WebCore::LayerOverlapMap &, WebCore::RenderLayerCompositor::CompositingState &, WebCore::RenderLayerCompositor::BackingSharingState &, bool &)
1   0x4f8bab489 WTFCrash
2   0x4d8d9e8cb WTFCrashWithInfo(int, char const*, char const*, int)
3   0x4dd7e7c1c WebCore::RenderLayerCompositor::computeCompositingRequirements(WebCore::RenderLayer*, WebCore::RenderLayer&, WebCore::LayerOverlapMap&, WebCore::RenderLayerCompositor::CompositingState&, WebCore::RenderLayerCompositor::BackingSharingState&, bool&)
4   0x4dd7e7827 WebCore::RenderLayerCompositor::computeCompositingRequirements(WebCore::RenderLayer*, WebCore::RenderLayer&, WebCore::LayerOverlapMap&, WebCore::RenderLayerCompositor::CompositingState&, WebCore::RenderLayerCompositor::BackingSharingState&, bool&)
5   0x4dd7e78da WebCore::RenderLayerCompositor::computeCompositingRequirements(WebCore::RenderLayer*, WebCore::RenderLayer&, WebCore::LayerOverlapMap&, WebCore::RenderLayerCompositor::CompositingState&, WebCore::RenderLayerCompositor::BackingSharingState&, bool&)
6   0x4dd7e57fe WebCore::RenderLayerCompositor::updateCompositingLayers(WebCore::CompositingUpdateType, WebCore::RenderLayer*)
7   0x4dd7e4b8b WebCore::RenderLayerCompositor::didRecalcStyleWithNoPendingLayout()
8   0x4dccef837 WebCore::FrameView::updateCompositingLayersAfterStyleChange()
9   0x4dbda52d2 WebCore::Document::resolveStyle(WebCore::Document::ResolveStyleType)
10  0x4dbda5de0 WebCore::Document::updateStyleIfNeeded()
11  0x4dccdf377 WebCore::FrameView::updateLayoutAndStyleIfNeededRecursive()
12  0x4dcd6410e WebCore::Page::layoutIfNeeded()
13  0x4dcd6487c WebCore::Page::updateRendering()
14  0x4ca12ef46 WebKit::WebPage::updateRendering()
15  0x4c99e3bf0 WebKit::TiledCoreAnimationDrawingArea::updateRendering(WebKit::TiledCoreAnimationDrawingArea::UpdateRenderingType)
16  0x4c99e8c7d WebKit::TiledCoreAnimationDrawingArea::updateRenderingRunLoopCallback()
17  0x4c99ed668 WebKit::TiledCoreAnimationDrawingArea::TiledCoreAnimationDrawingArea(WebKit::WebPage&, WebKit::WebPageCreationParameters const&)::$_0::operator()() const
18  0x4c99ed5fe WTF::Detail::CallableWrapper<WebKit::TiledCoreAnimationDrawingArea::TiledCoreAnimationDrawingArea(WebKit::WebPage&, WebKit::WebPageCreationParameters const&)::$_0, void>::call()
19  0x4d8db3d82 WTF::Function<void ()>::operator()() const
20  0x4dd015140 WebCore::RunLoopObserver::runLoopObserverFired()
21  0x4dd0150a0 WebCore::RunLoopObserver::runLoopObserverFired(__CFRunLoopObserver*, unsigned long, void*)
22  0x7fff20412dad __CFRUNLOOP_IS_CALLING_OUT_TO_AN_OBSERVER_CALLBACK_FUNCTION__
23  0x7fff20412c3d __CFRunLoopDoObservers
24  0x7fff20411746 CFRunLoopRunSpecific
25  0x7fff2119efa1 -[NSRunLoop(NSRunLoop) runMode:beforeDate:]
26  0x7fff2122d384 -[NSRunLoop(NSRunLoop) run]
27  0x7fff200683dd _xpc_objc_main
28  0x7fff20067e65 _xpc_copy_xpcservice_dictionary
29  0x4c8df4a11 WebKit::XPCServiceMain(int, char const**)
30  0x4ca47402b WKXPCServiceMain
31  0x104997ea2 main
ASSERTION FAILED: !m_useCount
/Volumes/Data/worker/bigsur-debug/build/Source/WebKit/Shared/Cocoa/SandboxExtensionCocoa.mm(447) : WebKit::SandboxExtension::~SandboxExtension()
LEAK: 4 WebPageProxy
Comment 1 Radar WebKit Bug Importer 2021-03-25 09:48:17 PDT
<rdar://problem/75840376>
Comment 2 Robert Jenner 2021-03-25 11:01:51 PDT
This test appears to have been flakey crashing for a while. However, it did start to crash with more frequency around r274268. 

I could not reproduce the failure at Big Sur Debug ToT, so I'm currently working on other methods for reproduction.
Comment 3 Robert Jenner 2021-03-25 12:04:24 PDT
I cannot reproduce the crash with this test. I tried it up to 10000 iterations, and tried testing it using a test list, and I could not get it to reproduce.
Comment 4 Alexey Proskuryakov 2021-03-25 12:06:47 PDT
Does this reproduce when running with many parallel workers? This tends to make timing issues more reproducible.
Comment 5 Robert Jenner 2021-03-25 12:22:20 PDT
Updated test expectations to Pass Crash:
https://trac.webkit.org/changeset/275051/webkit
Comment 6 Robert Jenner 2021-03-25 14:29:19 PDT
(In reply to Alexey Proskuryakov from comment #4)
> Does this reproduce when running with many parallel workers? This tends to
> make timing issues more reproducible.

I'm still working a little more on reproduction. So far I have run the test standalone as a -f process, a --child-process=1, and a --child-process=50 and I haven't reproduced the crash. 

I'm working with a test list currently, and am trying the same process with a test list.
Comment 7 Robert Jenner 2021-03-25 17:02:44 PDT
I was able to reproduce the crash, but under very specific circumstances.

To reproduce the crash, first I checked out revision r275036 locally. I chose that revision specifically because it crashed in the history on that revision. 

After that, I reproduced the crash at r275036 with a test list. It would not crash when being run standalone. I used the following to reproduce the crash:

run-webkit-test --test-list <Path to Test list> --debug --child-process=50 


The test list used is attached below. I will note as well, that the test has been flakey crashing for a while, but it did seem to get worse starting at r274268 https://trac.webkit.org/changeset/274268/webkit I'm uncertain if changes there caused this though.
Comment 8 Robert Jenner 2021-03-25 17:03:26 PDT
Created attachment 424301 [details]
Test list

Attaching test list used to reproduce flakey crash.
Comment 9 Robert Jenner 2021-03-25 17:04:54 PDT
Created attachment 424302 [details]
Reproduced crash log

Also attaching the crash log from when I was able to reproduce the crash.
Comment 10 Robert Jenner 2021-03-31 18:54:51 PDT
Added Failure back to the test expectations after removing them from the prior update here:
https://trac.webkit.org/changeset/275336/webkit
Comment 11 Ryan Haddad 2021-06-17 16:47:18 PDT
security/contentSecurityPolicy/plugins-types-blocks-quicktime-plugin-replacement-without-mime-type.html appears to be hitting this assertion quite frequently on macOS-AppleSilicon-Big-Sur-Debug-WK2-Tests-EWS

https://ews-build.s3-us-west-2.amazonaws.com/macOS-AppleSilicon-Big-Sur-Debug-WK2-Tests-EWS/r431708-6673/results.html
Comment 12 Ryan Haddad 2021-06-21 13:05:07 PDT
Here are some examples from today:

https://ews-build.webkit.org/#/builders/60/builds/6805
https://ews-build.webkit.org/#/builders/60/builds/6801
https://ews-build.webkit.org/#/builders/60/builds/6799
https://ews-build.webkit.org/#/builders/60/builds/6677

We should try to reproduce this crash using a test list to see if we can narrow it down to a particular test.
Comment 13 Eric Hutchison 2021-08-13 14:17:40 PDT
Created attachment 435511 [details]
TestList2
Comment 14 Eric Hutchison 2021-08-13 14:22:24 PDT
Reproduced test results on BigSur r281020: run-webkit-tests -f --force --debug --iterations 1000 --exit-after-n-crashes-or-timeouts 1 --exit-after-n-failures 1 security/contentSecurityPolicy/plugins-types-allows-youtube-plugin-replacement.html.

Also reproduced on Monterey r281020 using test list: run-webkit-tests --force --debug --child-processes 1 --clobber-old-results --test-list= (TestList2 attached).

Both reproductions run multiple times to ensure consistent results.
Comment 15 Eric Hutchison 2021-08-13 15:14:37 PDT
Created attachment 435519 [details]
CrashLog from r268268
Comment 16 Alexey Proskuryakov 2021-08-13 16:46:14 PDT
The attached crash log (CrashLog from r268268) doesn't make sense in the context of this bug. It's not an assertion failure, it's just saying that WebKitTestRunner cannot be run on your machine.
Comment 17 Eric Hutchison 2021-08-13 18:36:25 PDT
Thank you for the feedback!
(In reply to Alexey Proskuryakov from comment #16)
> The attached crash log (CrashLog from r268268) doesn't make sense in the
> context of this bug. It's not an assertion failure, it's just saying that
> WebKitTestRunner cannot be run on your machine.
Comment 18 ayumi_kojima 2021-08-17 08:45:21 PDT
The crash has been showing up on macOS-AppleSilicon-Big-Sur-Debug-WK2-Tests-EWS as a flaky test. Marked expectation so that it won't show up while investigating on EWS:  https://trac.webkit.org/changeset/281138/webkit.
Comment 19 ayumi_kojima 2021-08-31 11:36:59 PDT
Updated expectations to skip the test on all platforms in bug 229505