Bug 284391

Summary:	Thread safety assertion failure in InternalObserverMap::visitAdditionalChildren
Product:	WebKit	Reporter:	Marta Darbinyan <darbinyan>
Component:	New Bugs	Assignee:	Ryosuke Niwa <rniwa>
Status:	RESOLVED FIXED
Severity:	Normal	CC:	cdumez, mark.lam, me, rniwa, webkit-bot-watchers-bugzilla, webkit-bug-importer, ysuzuki
Priority:	P2	Keywords:	InRadar
Version:	WebKit Nightly Build
Hardware:	Unspecified
OS:	Unspecified
See Also:	https://bugs.webkit.org/show_bug.cgi?id=284500

Marta Darbinyan

Reported 2024-12-10 11:06:02 PST

imported/w3c/web-platform-tests/dom/observable/tentative/observable-map.any.worker.html is a flaky crash in Sequoia and Sonoma Debug queues. The test is also false-positive failure in EWS. Possible regression range: https://commits.webkit.org/compare/287567@main...287577@main stderr: ASSERTION FAILED: Unsafe to ref/deref from different threads m_isOwnedByMainThread == isMainThread() /Volumes/Data/worker/macOS-Sequoia-Debug-Build-EWS/build/WebKitBuild/Debug/usr/local/include/wtf/RefCounted.h(124) : void WTF::RefCountedBase::applyRefDerefThreadingCheck() const 1 0x300141d5c WTF::RefCountedBase::applyRefDerefThreadingCheck() const 2 0x3001440a8 WTF::RefCountedBase::ref() const 3 0x3049fe8e4 WTF::DefaultRefDerefTraits<WebCore::MapperCallback>::ref(WebCore::MapperCallback&) 4 0x3049fe8b0 WTF::Ref<WebCore::MapperCallback, WTF::RawPtrTraits<WebCore::MapperCallback>, WTF::DefaultRefDerefTraits<WebCore::MapperCallback>>::Ref(WTF::Ref<WebCore::MapperCallback, WTF::RawPtrTraits<WebCore::MapperCallback>, WTF::DefaultRefDerefTraits<WebCore::MapperCallback>> const&) 5 0x3049f5690 WTF::Ref<WebCore::MapperCallback, WTF::RawPtrTraits<WebCore::MapperCallback>, WTF::DefaultRefDerefTraits<WebCore::MapperCallback>>::Ref(WTF::Ref<WebCore::MapperCallback, WTF::RawPtrTraits<WebCore::MapperCallback>, WTF::DefaultRefDerefTraits<WebCore::MapperCallback>> const&) 6 0x3049f9f70 WebCore::InternalObserverMap::protectedMapper() const 7 0x3049f9e9c WebCore::InternalObserverMap::visitAdditionalChildren(JSC::AbstractSlotVisitor&) const 8 0x303bd1030 void WebCore::JSSubscriber::visitAdditionalChildren<JSC::SlotVisitor>(JSC::SlotVisitor&) 9 0x30221e0e4 void WebCore::JSSubscriber::visitChildrenImpl<JSC::SlotVisitor>(JSC::JSCell*, JSC::SlotVisitor&) 10 0x30221d1e8 WebCore::JSSubscriber::visitChildren(JSC::JSCell*, JSC::SlotVisitor&) 11 0x12da3b478 JSC::MethodTable::visitChildren(JSC::JSCell*, JSC::SlotVisitor&) const 12 0x12da35058 JSC::SlotVisitor::visitChildren(JSC::JSCell const*) 13 0x12da3c1d0 JSC::SlotVisitor::drain(WTF::MonotonicTime)::$_0::operator()(JSC::MarkStackArray&) const 14 0x12da354d8 WTF::IterationStatus JSC::SlotVisitor::forEachMarkStack<JSC::SlotVisitor::drain(WTF::MonotonicTime)::$_0>(JSC::SlotVisitor::drain(WTF::MonotonicTime)::$_0 const&) 15 0x12da3545c JSC::SlotVisitor::drain(WTF::MonotonicTime) 16 0x12da360c8 JSC::SlotVisitor::drainFromShared(JSC::SlotVisitor::SharedDrainMode, WTF::MonotonicTime) 17 0x12d9a3958 JSC::Heap::runBeginPhase(JSC::GCConductor)::$_1::operator()() const 18 0x12d9a3844 WTF::SharedTaskFunctor<void (), JSC::Heap::runBeginPhase(JSC::GCConductor)::$_1>::run() 19 0x12c2ab13c WTF::ParallelHelperClient::runTask(WTF::RefPtr<WTF::SharedTask<void ()>, WTF::RawPtrTraits<WTF::SharedTask<void ()>>, WTF::DefaultRefDerefTraits<WTF::SharedTask<void ()>>> const&) 20 0x12c2ac11c WTF::ParallelHelperPool::Thread::work() 21 0x12c1ee3f4 WTF::AutomaticThread::start(WTF::AbstractLocker const&)::$_0::operator()() const 22 0x12c1edfa4 WTF::Detail::CallableWrapper<WTF::AutomaticThread::start(WTF::AbstractLocker const&)::$_0, void>::call() 23 0x12c20b1a4 WTF::Function<void ()>::operator()() const 24 0x12c35b410 WTF::Thread::entryPoint(WTF::Thread::NewThreadContext*) 25 0x12c367b5c WTF::wtfThreadEntryPoint(void*) 26 0x18297b2e4 _pthread_start 27 0x1829760fc thread_start com.apple.WebKit.WebContent.Development terminated (pid 36712) for reason: crash LEAK: 1 WebPageProxy Test results: https://ews-build.s3-us-west-2.amazonaws.com/iOS-17-Simulator-WK2-Tests-EWS/0f4dda71-52720/results.html# History: https://results.webkit.org/?suite=layout-tests&test=imported%2Fw3c%2Fweb-platform-tests%2Fdom%2Fobservable%2Ftentative%2Fobservable-map.any.worker.html

Attachments
Add attachment proposed patch, testcase, etc.

Radar WebKit Bug Importer

Comment 1 2024-12-10 11:06:31 PST

<rdar://problem/141232149>

EWS

Comment 2 2024-12-10 11:33:06 PST

Test gardening commit 287620@main (8a79978815fe): <https://commits.webkit.org/287620@main> Reviewed commits have been landed. Closing PR #37727 and removing active labels.

Ryosuke Niwa

Comment 3 2024-12-11 17:02:32 PST

This looks like a real memory corruption issue.

Ryosuke Niwa

Comment 4 2024-12-11 17:16:59 PST

Pull request: https://github.com/WebKit/WebKit/pull/37809

EWS

Comment 5 2024-12-11 21:25:28 PST

Committed 287723@main (a1ec56656162): <https://commits.webkit.org/287723@main> Reviewed commits have been landed. Closing PR #37809 and removing active labels.

Note You need to log in before you can comment on or make changes to this bug.