Bug 312903 – REGRESSION(302256@main): [Tahoe] TestWebKitAPI.WebKitLegacy.IsNavigationActionTrusted is a flaky CRASH

• Component: WebKit API
• Status: NEW

[Karl Rackler]

Description:
TestWebKitAPI.WebKitLegacy.IsNavigationActionTrusted is a flaky CRASH on mac Tahoe Debug

Regression = https://commits.webkit.org/compare/302255@main...302256@main

This issue can be bisected to 302256@main using the command:
run-api-tests --no-build TestWebKitAPI.WebKitLegacy.IsNavigationActionTrusted

------------- BISECTION AUDIT TRAIL -------------
301908@main, 9b69b5c0d700 --> Passed
302098@main, 52a11367f75d --> Passed
302187@main, 3fe300f248f3 --> Passed
302212@main, 0a3e9f018b73 --> Passed
302236@main, 9c4db04c6d43 --> Passed
302245@main, 499bd04b16d5 --> Passed
302251@main, b82e1a6452a2 --> Passed
302253@main, b6c95d8926c1 --> Passed
302255@main, ec36c242bdff --> Passed
302256@main, ec36c242bdff --> CRASH
302559@main, a9b314dc9b8b --> CRASH
303173@main, 4563dd18bbd7 --> CRASH
303184@main, 837ec25d19ea --> CRASH
304514@main, 06dac8476dd8 --> CRASH
304606@main, f8b2fc6d3b89 --> CRASH
306270@main, e74549085e7d --> CRASH
306855@main, 5ba368beb476 --> CRASH
307688@main, 0758ca716825 --> CRASH
308955@main, 76c33ceda510 --> CRASH
310268@main, 80ff50d0abd0 --> CRASH
311638@main, 0da44e0e68a6 --> CRASH
------------- BISECTION AUDIT TRAIL END -------------

History:
https://results.webkit.org/?version_name=Tahoe&suite=api-tests&test=TestWebKitAPI.WebKitLegacy.IsNavigationActionTrusted

Crash Log:
ASSERTION FAILED: osVersionSupports(os_script_config_storage)
/System/Volumes/Data/otmp/case-sensitive/od.luxon/lw.luxon/sandbox-0/workspace/OpenSource/Source/JavaScriptCore/llint/LLIntData.cpp(129) : void JSC::LLInt::initialize()
1   0x117d72c08 JSC::LLInt::initialize()
2   0x11a26c1bc JSC::initializeWithOptionsCustomization(WTF::ScopedLambda<void ()> const&)::$_0::operator()() const
3   0x11a26c0bc std::__1::__invoke_result_impl<void, JSC::initializeWithOptionsCustomization(WTF::ScopedLambda<void ()> const&)::$_0>::type std::__1::__invoke[abi:sqn210106]<JSC::initializeWithOptionsCustomization(WTF::ScopedLambda<void ()> const&)::$_0>(JSC::initializeWithOptionsCustomization(WTF::ScopedLambda<void ()> const&)::$_0&&)
4   0x11a26c094 void std::__1::__call_once_param<std::__1::tuple<JSC::initializeWithOptionsCustomization(WTF::ScopedLambda<void ()> const&)::$_0&&>>::__execute[abi:sqn210106]<>(std::__1::__tuple_indices<>)
5   0x11a26c064 std::__1::__call_once_param<std::__1::tuple<JSC::initializeWithOptionsCustomization(WTF::ScopedLambda<void ()> const&)::$_0&&>>::operator()[abi:sqn210106]()
6   0x11a26bf54 void std::__1::__call_once_proxy[abi:sqn210106]<std::__1::tuple<JSC::initializeWithOptionsCustomization(WTF::ScopedLambda<void ()> const&)::$_0&&>>(void*)
7   0x1908344e4 std::__1::__call_once(unsigned long volatile&, void*, void (*)(void*))
8   0x11a22fa38 void std::__1::call_once[abi:sqn210106]<JSC::initializeWithOptionsCustomization(WTF::ScopedLambda<void ()> const&)::$_0>(std::__1::once_flag&, JSC::initializeWithOptionsCustomization(WTF::ScopedLambda<void ()> const&)::$_0&&)
9   0x11a22f9c0 JSC::initializeWithOptionsCustomization(WTF::ScopedLambda<void ()> const&)
10  0x11a22f968 void JSC::initialize<JSC::initialize()::$_0>(JSC::initialize()::$_0 const&)
11  0x11a22f920 JSC::initialize()
12  0x1285685ac WebCore::initializeMainThreadWebCore()
13  0x128568590 WebCore::initializeMainThreadIfNeeded()
14  0x107fad964 +[WebView initialize]
15  0x1904ceb9c CALLING_SOME_+initialize_METHOD
16  0x1904ce844 initializeNonMetaClass
17  0x1904ea0ac initializeAndMaybeRelock(objc_class*, objc_object*, locker_mixin<lockdebug::lock_mixin<objc_lock_base_t>>&, bool)
18  0x1904cdf8c lookUpImpOrForward
19  0x1904cdb84 _objc_msgSend_uncached
20  0x190504a54 objc_alloc_init
21  0x1034b17c4 TestWebKitAPI::WebKitLegacy_IsNavigationActionTrusted_Test::TestBody()
22  0x103b8089c void testing::internal::HandleSehExceptionsInMethodIfSupported<testing::Test, void>(testing::Test*, void (testing::Test::*)(), char const*)
23  0x103b37b2c void testing::internal::HandleExceptionsInMethodIfSupported<testing::Test, void>(testing::Test*, void (testing::Test::*)(), char const*)
24  0x103b37a68 testing::Test::Run()
25  0x103b38b88 testing::TestInfo::Run()
26  0x103b39e84 testing::TestSuite::Run()
27  0x103b482a0 testing::internal::UnitTestImpl::RunAllTests()
28  0x103b8595c bool testing::internal::HandleSehExceptionsInMethodIfSupported<testing::internal::UnitTestImpl, bool>(testing::internal::UnitTestImpl*, bool (testing::internal::UnitTestImpl::*)(), char const*)
29  0x103b47be0 bool testing::internal::HandleExceptionsInMethodIfSupported<testing::internal::UnitTestImpl, bool>(testing::internal::UnitTestImpl*, bool (testing::internal::UnitTestImpl::*)(), char const*)
30  0x103b47ad0 testing::UnitTest::Run()
31  0x103afba04 RUN_ALL_TESTS()

Test Run:
https://build.webkit.org/#/builders/1692/builds/3072

[Radar WebKit Bug Importer]

<rdar://problem/175258056>

[Karl Rackler]

Test gardening pull request: https://github.com/WebKit/WebKit/pull/63241

[EWS]

Test gardening commit 311701@main (3819a6d06a09): <https://commits.webkit.org/311701@main>

Reviewed commits have been landed. Closing PR #63241 and removing active labels.

[Karl Rackler]

I had to retry bisection due to an error in the original reproduction setup; disregard the crash assertion above, it was because of that.
I have had to rely on the results database mostly for bisection.

[Jonathan Bedard]

I believe this was 311244@main, which was reverted in 311280@main and then re-landed in 311330@main

[Jonathan Bedard]

Recent run from CI:
https://s3-us-west-2.amazonaws.com/archives.webkit.org/mac-tahoe-x86_64-arm64-debug-run-api-tests/[e-mail]

We don't have a crash log, though. However this test is "crashing", it doesn't actually generate a crash-log. It also looks to be a flakey crash, I'm suspicious of timing issues (possibly about test parallelism?)

[Jonathan Bedard]

Note that the crashlog Karl has here isn't actually from this test. We still haven't been able to extract a real crashlog.