Bug 58657

Summary:	REGRESSION (r83928 or before): Some tests failing assertions in MarkStack::internalAppend / MarkStack::drain
Product:	WebKit	Reporter:	Adam Roben (:aroben) <aroben>
Component:	JavaScriptCore	Assignee:	Nobody <webkit-unassigned>
Status:	RESOLVED CONFIGURATION CHANGED
Severity:	Normal	CC:	beidson, bfulgham, ggaren, gyuyoung.kim, jberlin, oliver
Priority:	P2	Keywords:	InRadar, LayoutTestFailure, MakingBotsRed, PlatformOnly
Version:	528+ (Nightly build)
Hardware:	PC
OS:	Windows XP

Description Adam Roben (:aroben) 2011-04-15 06:47:31 PDT

The XP bots have seen assertion failures in MarkStack::internalAppend twice recently. The first time was in r83928:

http://build.webkit.org/results/Windows%20XP%20Debug%20%28Tests%29/r83928%20(27641)/dom/html/level1/core/hc_attrinsertbefore6-crash-log.txt

And then it happened again in r83943:
http://build.webkit.org/results/Windows%20XP%20Debug%20%28Tests%29/r83943%20(27650)/jquery/traversing-crash-log.txt

Comment 1 Adam Roben (:aroben) 2011-04-15 06:48:29 PDT

<rdar://problem/9290323>

Comment 2 Adam Roben (:aroben) 2011-04-18 07:25:44 PDT

I assume that these assertion failures are leading to crashes in MarkStack::drain Release builds:

http://build.webkit.org/results/Windows%207%20Release%20%28Tests%29/r84123%20(11782)/inspector/extensions/extensions-resources-crash-log.txt
http://build.webkit.org/results/Windows%207%20Release%20%28Tests%29/r84120%20(11780)/inspector/extensions/extensions-resources-crash-log.txt
http://build.webkit.org/results/Windows%207%20Release%20%28Tests%29/r84118%20(11778)/inspector/extensions/extensions-resources-crash-log.txt
http://build.webkit.org/results/Windows%207%20Release%20%28Tests%29/r84117%20(11777)/inspector/extensions/extensions-resources-crash-log.txt
http://build.webkit.org/results/Windows%207%20Release%20%28Tests%29/r84111%20(11772)/inspector/extensions/extensions-resources-crash-log.txt
http://build.webkit.org/results/Windows%207%20Release%20%28Tests%29/r84107%20(11770)/inspector/extensions/extensions-resources-crash-log.txt
http://build.webkit.org/results/Windows%207%20Release%20%28Tests%29/r84098%20(11764)/inspector/extensions/extensions-resources-crash-log.txt

Comment 3 Adam Roben (:aroben) 2011-04-20 07:52:03 PDT

Looks like ietestcenter/Javascript/10.4.2-1-1.html has been hitting this assertion on every single test run since r84264.

http://build.webkit.org/builders/Windows%20XP%20Debug%20%28Tests%29/builds/27814

Comment 4 Brady Eidson 2011-04-22 09:18:36 PDT

Saw this in my local build of r84631 in Safari.

Comment 5 Jessie Berlin 2011-05-01 07:55:51 PDT

A couple more instances on XP, one under markChildren under drain and one under internalAppend:
http://build.webkit.org/results/Windows%20XP%20Debug%20(Tests)/r85407%20(28237)/inspector/styles/styles-cancel-editing-crash-log.txt
http://build.webkit.org/results/Windows%20XP%20Debug%20(Tests)/r85411%20(28241)/editing/execCommand/insertImage-crash-log.txt

Comment 6 Jessie Berlin 2011-05-02 08:48:27 PDT

I am seeing crashes on the Windows XP bots again:
http://build.webkit.org/results/Windows%20XP%20Debug%20(Tests)/r85475%20(28275)/results.html
http://build.webkit.org/results/Windows%20XP%20Debug%20(Tests)/r85472%20(28274)/results.html
http://build.webkit.org/results/Windows%20XP%20Debug%20(Tests)/r85471%20(28273)/results.html

I am going to skip the inspector/styles/styles-cancel-editing.html on Windows XP only, since this does not seem to be affecting Windows 7 (or at least the Win 7 bots appear unaffected).

Comment 7 Geoffrey Garen 2011-05-05 16:27:32 PDT

Looks like ietestcenter/Javascript/10.4.2-1-1.html stopped hitting this assertion after r84584.

http://build.webkit.org/builders/Windows%20XP%20Debug%20%28Tests%29/builds/27929