Bug 261555

Summary:	jquery/attributes.html is flaky fail with StreamClientConnection ASSERTION FAILED: !m_connection->isValid()
Product:	WebKit	Reporter:	Kimmo Kinnunen <kkinnunen>
Component:	WebKit2	Assignee:	Kimmo Kinnunen <kkinnunen>
Status:	RESOLVED FIXED
Severity:	Normal	CC:	ap, bfulgham, brandonstewart, kkinnunen, webkit-bug-importer, wilander
Priority:	P2	Keywords:	InRadar
Version:	WebKit Local Build
Hardware:	Unspecified
OS:	Unspecified

Kimmo Kinnunen

Reported 2023-09-14 07:53:27 PDT

jquery/attributes.html is flaky fail with StreamClientConnection ASSERTION FAILED: !m_connection->isValid() Due to IPC JS tests testing stream, the destructor is not aware that the object will be really destructed in the scavenger thread. No crash log found for com.apple.WebKit.WebContent.Development:20910. stdout: stderr: ASSERTION FAILED: !m_connection->isValid() /Volumes/Data/worker/macOS-AppleSilicon-Ventura-Debug-Build-EWS/build/Source/WebKit/Platform/IPC/StreamClientConnection.cpp(90) : IPC::StreamClientConnection::~StreamClientConnection() 1 0x1377d0df8 WTFCrash 2 0x1185ef6c0 std::__1::span<unsigned char const, 18446744073709551615ul>::span[abi:v15006]<unsigned char const*>(unsigned char const*, unsigned long) 3 0x11b4c9558 IPC::StreamClientConnection::~StreamClientConnection() 4 0x11b4c963c IPC::StreamClientConnection::~StreamClientConnection() 5 0x119f215bc WTF::ThreadSafeRefCounted<IPC::StreamClientConnection, (WTF::DestructionThread)0>::deref() const::'lambda'()::operator()() const 6 0x119f21578 WTF::ThreadSafeRefCounted<IPC::StreamClientConnection, (WTF::DestructionThread)0>::deref() const 7 0x11ac2456c WTF::DefaultRefDerefTraits<IPC::StreamClientConnection>::derefIfNotNull(IPC::StreamClientConnection*) 8 0x11ac24530 WTF::RefPtr<IPC::StreamClientConnection, WTF::RawPtrTraits<IPC::StreamClientConnection>, WTF::DefaultRefDerefTraits<IPC::StreamClientConnection>>::~RefPtr() 9 0x119f20b94 WTF::RefPtr<IPC::StreamClientConnection, WTF::RawPtrTraits<IPC::StreamClientConnection>, WTF::DefaultRefDerefTraits<IPC::StreamClientConnection>>::~RefPtr() 10 0x11ac251d4 WebKit::IPCTestingAPI::JSIPCStreamClientConnection::~JSIPCStreamClientConnection() 11 0x11ac25174 WebKit::IPCTestingAPI::JSIPCStreamClientConnection::~JSIPCStreamClientConnection() 12 0x11ac25140 std::__1::default_delete<WebKit::IPCTestingAPI::JSIPCStreamClientConnection>::operator()[abi:v15006](WebKit::IPCTestingAPI::JSIPCStreamClientConnection*) const 13 0x11abda1e4 WTF::RefCounted<WebKit::IPCTestingAPI::JSIPCStreamClientConnection, std::__1::default_delete<WebKit::IPCTestingAPI::JSIPCStreamClientConnection>>::deref() const 14 0x11abda0e8 WebKit::IPCTestingAPI::JSIPCStreamClientConnection::finalize(OpaqueJSValue*) 15 0x138124718 JSC::JSCallbackObject<JSC::JSNonFinalObject>::~JSCallbackObject() 16 0x1381245f4 JSC::JSCallbackObject<JSC::JSNonFinalObject>::~JSCallbackObject() 17 0x13811b08c JSC::JSCallbackObject<JSC::JSNonFinalObject>::destroy(JSC::JSCell*) 18 0x138e3d3b0 JSC::IsoHeapCellType::operator()(JSC::VM&, JSC::JSCell*) const 19 0x138e3f52c void JSC::MarkedBlock::Handle::specializedSweep<false, (JSC::MarkedBlock::Handle::EmptyMode)0, (JSC::MarkedBlock::Handle::SweepMode)0, (JSC::MarkedBlock::Handle::SweepDestructionMode)0, (JSC::MarkedBlock::Handle::ScribbleMode)0, (JSC::MarkedBlock::Handle::NewlyAllocatedMode)0, (JSC::MarkedBlock::Handle::MarksMode)0, JSC::IsoHeapCellType>(JSC::FreeList*, JSC::MarkedBlock::Handle::EmptyMode, JSC::MarkedBlock::Handle::SweepMode, JSC::MarkedBlock::Handle::SweepDestructionMode, JSC::MarkedBlock::Handle::ScribbleMode, JSC::MarkedBlock::Handle::NewlyAllocatedMode, JSC::MarkedBlock::Handle::MarksMode, JSC::IsoHeapCellType const&)::'lambda'(void*)::operator()(void*) const 20 0x138e3f5ac void JSC::MarkedBlock::Handle::specializedSweep<false, (JSC::MarkedBlock::Handle::EmptyMode)0, (JSC::MarkedBlock::Handle::SweepMode)0, (JSC::MarkedBlock::Handle::SweepDestructionMode)0, (JSC::MarkedBlock::Handle::ScribbleMode)0, (JSC::MarkedBlock::Handle::NewlyAllocatedMode)0, (JSC::MarkedBlock::Handle::MarksMode)0, JSC::IsoHeapCellType>(JSC::FreeList*, JSC::MarkedBlock::Handle::EmptyMode, JSC::MarkedBlock::Handle::SweepMode, JSC::MarkedBlock::Handle::SweepDestructionMode, JSC::MarkedBlock::Handle::ScribbleMode, JSC::MarkedBlock::Handle::NewlyAllocatedMode, JSC::MarkedBlock::Handle::MarksMode, JSC::IsoHeapCellType const&)::'lambda'(unsigned long)::operator()(unsigned long) const 21 0x138e38778 void JSC::MarkedBlock::Handle::specializedSweep<false, (JSC::MarkedBlock::Handle::EmptyMode)0, (JSC::MarkedBlock::Handle::SweepMode)0, (JSC::MarkedBlock::Handle::SweepDestructionMode)0, (JSC::MarkedBlock::Handle::ScribbleMode)0, (JSC::MarkedBlock::Handle::NewlyAllocatedMode)0, (JSC::MarkedBlock::Handle::MarksMode)0, JSC::IsoHeapCellType>(JSC::FreeList*, JSC::MarkedBlock::Handle::EmptyMode, JSC::MarkedBlock::Handle::SweepMode, JSC::MarkedBlock::Handle::SweepDestructionMode, JSC::MarkedBlock::Handle::ScribbleMode, JSC::MarkedBlock::Handle::NewlyAllocatedMode, JSC::MarkedBlock::Handle::MarksMode, JSC::IsoHeapCellType const&) 22 0x138e2d818 void JSC::MarkedBlock::Handle::finishSweepKnowingHeapCellType<JSC::IsoHeapCellType>(JSC::FreeList*, JSC::IsoHeapCellType const&) 23 0x138e2d6c8 JSC::IsoHeapCellType::finishSweep(JSC::MarkedBlock::Handle&, JSC::FreeList*) const 24 0x138e721dc JSC::Subspace::finishSweep(JSC::MarkedBlock::Handle&, JSC::FreeList*) 25 0x138e4b1b0 JSC::MarkedBlock::Handle::sweep(JSC::FreeList*) 26 0x138e3129c JSC::LocalAllocator::tryAllocateIn(JSC::MarkedBlock::Handle*, unsigned long) 27 0x138e30f60 JSC::LocalAllocator::tryAllocateWithoutCollecting(unsigned long) 28 0x138e30aa0 JSC::LocalAllocator::allocateSlowCase(JSC::Heap&, unsigned long, JSC::GCDeferralContext*, JSC::AllocationFailureMode) 29 0x137e42d40 JSC::LocalAllocator::allocate(JSC::Heap&, unsigned long, JSC::GCDeferralContext*, JSC::AllocationFailureMode)::'lambda'()::operator()() const 30 0x137e5d448 JSC::HeapCell* JSC::FreeList::allocateWithCellSize<JSC::LocalAllocator::allocate(JSC::Heap&, unsigned long, JSC::GCDeferralContext*, JSC::AllocationFailureMode)::'lambda'()>(JSC::LocalAllocator::allocate(JSC::Heap&, unsigned long, JSC::GCDeferralContext*, JSC::AllocationFailureMode)::'lambda'() const&, unsigned long) 31 0x137e6ffd4 JSC::LocalAllocator::allocate(JSC::Heap&, unsigned long, JSC::GCDeferralContext*, JSC::AllocationFailureMode) com.apple.WebKit.WebContent.Development terminated (pid 20910) for reason: crash LEAK: 2 WebPageProxy

Attachments
Add attachment proposed patch, testcase, etc.

Radar WebKit Bug Importer

Comment 1 2023-09-14 07:53:41 PDT

<rdar://problem/115494068>

Kimmo Kinnunen

Comment 2 2023-09-14 07:54:23 PDT

https://ews-build.webkit.org/#/builders/17/builds/14751

Alexey Proskuryakov

Comment 3 2023-09-14 18:37:11 PDT

This comes from a preceding test, likely one of the below. Tearing down the document should also tear down IPCTestingAPI, without waiting for GC. 02:29:30.715 11708 worker/4 ipc/restrictedendpoints/allow-access-attachmentElement.html passed 02:29:31.370 11708 worker/4 ipc/restrictedendpoints/allow-access-modelElement.html passed 02:29:32.006 11708 worker/4 ipc/restrictedendpoints/allow-access-testOnlyIPC.html passed 02:29:34.587 11708 worker/4 ipc/restrictedendpoints/allow-access-webGPU.html passed

Kimmo Kinnunen

Comment 4 2023-09-15 00:25:41 PDT

Pull request: https://github.com/WebKit/WebKit/pull/17805

EWS

Comment 5 2023-09-18 10:30:58 PDT

Committed 268086@main (c0a9a955b480): <https://commits.webkit.org/268086@main> Reviewed commits have been landed. Closing PR #17805 and removing active labels.

Note You need to log in before you can comment on or make changes to this bug.