Bug 105504 – [EFL] Unexpected Accessibility crashes.

• Status: RESOLVED
• Resolution: DUPLICATE
• Component: WebKit EFL

[Krzysztof Czech]

Due to the unexpected crashes regarding the Accessibility, that appear on building bots, I created a bug to track them.

[Krzysztof Czech]

crash log for WebProcess (pid <unknown>):
STDOUT: <empty>
STDERR: 1   0x7f1f6a3eb318
STDERR: 2   0x7f1f6ac5e4a0
STDERR: 3   0x7f1f69318979
WebCore::AccessibilityRenderObject::remoteSVGRootElement() const
STDERR: 4   0x7f1f69318a79
WebCore::AccessibilityRenderObject::detachRemoteSVGRoot()
STDERR: 5   0x7f1f69318aa1 WebCore::AccessibilityRenderObject::detach()
STDERR: 6   0x7f1f692f621a WebCore::AXObjectCache::~AXObjectCache()
STDERR: 7   0x7f1f69478bb5 WebCore::Document::clearAXObjectCache()
STDERR: 8   0x7f1f69486940 WebCore::Document::detach()
STDERR: 9   0x7f1f698f121c
WebCore::Frame::setView(WTF::PassRefPtr<WebCore::FrameView>)
STDERR: 10  0x7f1f698f355b WebCore::Frame::createView(WebCore::IntSize
const&, WebCore::Color const&, bool, WebCore::IntSize const&,
WebCore::IntRect const&, bool, WebCore::ScrollbarMode, bool,
WebCore::ScrollbarMode, bool)
STDERR: 11  0x7f1f6b491e3d
WebKit::WebFrameLoaderClient::transitionToCommittedForNewPage()
STDERR: 12  0x7f1f69826776
WebCore::FrameLoader::transitionToCommitted(WTF::PassRefPtr<WebCore::CachedPage>)
STDERR: 13  0x7f1f69828da7 WebCore::FrameLoader::commitProvisionalLoad()
STDERR: 14  0x7f1f69809219 WebCore::DocumentLoader::finishedLoading()
STDERR: 15  0x7f1f6980dad2 WebCore::DocumentLoader::maybeLoadEmpty()
STDERR: 16  0x7f1f6980dcb8 WebCore::DocumentLoader::startLoadingMainResource()
STDERR: 17  0x7f1f69829720
WebCore::FrameLoader::continueLoadAfterNavigationPolicy(WebCore::ResourceRequest
const&, WTF::PassRefPtr<WebCore::FormState>, bool)
STDERR: 18  0x7f1f6982975d
WebCore::FrameLoader::callContinueLoadAfterNavigationPolicy(void*,
WebCore::ResourceRequest const&, WTF::PassRefPtr<WebCore::FormState>,
bool)
STDERR: 19  0x7f1f69841428 WebCore::PolicyCallback::call(bool)
STDERR: 20  0x7f1f698461d2
WebCore::PolicyChecker::continueAfterNavigationPolicy(WebCore::PolicyAction)
STDERR: 21  0x7f1f6b499a24
WebKit::WebFrameLoaderClient::dispatchDecidePolicyForNavigationAction(void
(WebCore::PolicyChecker::*)(WebCore::PolicyAction),
WebCore::NavigationAction const&, WebCore::ResourceRequest const&,
WTF::PassRefPtr<WebCore::FormState>)
STDERR: 22  0x7f1f698481d0
WebCore::PolicyChecker::checkNavigationPolicy(WebCore::ResourceRequest
const&, WebCore::DocumentLoader*, WTF::PassRefPtr<WebCore::FormState>,
void (*)(void*, WebCore::ResourceRequest const&,
WTF::PassRefPtr<WebCore::FormState>, bool), void*)
STDERR: 23  0x7f1f69829c29
WebCore::FrameLoader::loadWithDocumentLoader(WebCore::DocumentLoader*,
WebCore::FrameLoadType, WTF::PassRefPtr<WebCore::FormState>)
STDERR: 24  0x7f1f6982a555 WebCore::FrameLoader::load(WebCore::DocumentLoader*)
STDERR: 25  0x7f1f6982df0b
WebCore::FrameLoader::load(WebCore::FrameLoadRequest const&)
STDERR: 26  0x7f1f6b4b6cb6
WebKit::WebPage::loadURLRequest(WebCore::ResourceRequest const&,
WebKit::SandboxExtension::Handle const&)
STDERR: 27  0x7f1f6b4b717b WebKit::WebPage::loadURL(WTF::String
const&, WebKit::SandboxExtension::Handle const&)
STDERR: 28  0x7f1f6b52f120
WebKit::WebPage::didReceiveWebPageMessage(CoreIPC::Connection*,
CoreIPC::MessageID, CoreIPC::MessageDecoder&)
STDERR: 29  0x7f1f6b3569c8
CoreIPC::MessageReceiverMap::dispatchMessage(CoreIPC::Connection*,
CoreIPC::MessageID, CoreIPC::MessageDecoder&)
STDERR: 30  0x7f1f6b43b79c
WebKit::WebProcess::didReceiveMessage(CoreIPC::Connection*,
CoreIPC::MessageID, CoreIPC::MessageDecoder&)
STDERR: 31  0x7f1f6b353166
CoreIPC::Connection::dispatchMessage(CoreIPC::Connection::Message<CoreIPC::MessageDecoder>&)

[Mateusz Leszko]

What is buildbot configuration? I can't reproduce crash.


I've run some tests:
1. 64bit Ubuntu 12.04.1 LTS; Debug with TILED_BACKING_STORE=ON

LOG:
"~/WebKit/WebKit$ Tools/Scripts/run-webkit-tests --efl -v --debug -2 LayoutTests/fast/dom/Range/range-extract-contents.html
Using port 'efl-wk2'
Test configuration: <, x86, debug>
Placing test results in /home/m.leszko/WebKit/WebKit/WebKitBuild/Debug/layout-test-results
Baseline search path: efl-wk2 -> wk2 -> efl -> generic
Using Debug build
Pixel tests disabled
Regular timeout: 80000, slow test timeout: 400000
Command line: /home/m.leszko/WebKit/WebKit/Tools/efl/run-with-jhbuild /home/m.leszko/WebKit/WebKit/WebKitBuild/Debug/bin/WebKitTestRunner -

Found 1 test; running 1, skipping 0.
Running 1 WebKitTestRunner.     

[1/1] fast/dom/Range/range-extract-contents.html passed

The test ran as expected."

I've run it 10 times, and always have no crash.
What is configuration of buildbot?

I've also run it on different mashines and diferent configurations.
1 64bit Ubuntu 12.04.1 LTS; Debug with TILED_BACKING_STORE=OFF
2 64bit Ubuntu 12.04.1 LTS; Release with TILED_BACKING_STORE=OFF
3 32bit Ubuntu 12.04.1 LTS; Release
4 32bit Ubuntu 12.04.1 LTS; Debug
5 32bit Ubuntu 11.10; Release with TILED_BACKING_STORE=OFF
6 32bit Ubuntu 11.10; Debug with TILED_BACKING_STORE=OFF 


Found only 2 crashes not connected in Results:
3.

CRI<22371>:ewebkit2 /home/m.leszko/webkit.org/WebKit/Source/WebKit2/UIProcess/API/efl/ewk_main.cpp:83 ewk_init() could not init ecore_x.

6.

ERR<25805>:evas-gl_x11 evas_x_main.c:404 eng_window_new() OpenGL Driver blacklisted:
ERR<25805>:evas-gl_x11 evas_x_main.c:405 eng_window_new() Vendor: Mesa Project
ERR<25805>:evas-gl_x11 evas_x_main.c:406 eng_window_new() Renderer: Software Rasterizer
ERR<25805>:evas-gl_x11 evas_x_main.c:407 eng_window_new() Version: 2.1 Mesa 7.11
ERR<25805>:ecore_evas ecore_evas_x.c:254 _ecore_evas_x_gl_window_new() evas_engine_info_set() for engine 'opengl_x11' failed.
ERR<25805>:ecore_evas ecore_evas_x.c:3571 ecore_evas_gl_x11_options_new() evas_engine_info_set() init engine 'opengl_x11' failed.
ASSERTION FAILED: m_ptr
/home/mleszko/workspace/WebKit_efl/Source/WTF/wtf/OwnPtr.h(72) : WTF::OwnPtr<T>::ValueType* WTF::OwnPtr<T>::operator->() const [with T = WTR::TestInvocation, WTF::OwnPtr<T>::PtrType = WTR::TestInvocation*, WTF::OwnPtr<T>::ValueType = WTR::TestInvocation]
1   0x8066880 WTF::OwnPtr<WTR::TestInvocation>::operator->() const
2   0x80630dc WTR::TestController::run()
3   0x8060e8b WTR::TestController::TestController(int, char const**)
4   0x8076347 main
5   0xb000c113 __libc_start_main
6   0x805fa81

[Dominik Röttsches (drott)]

(In reply to comment #2)
> What is buildbot configuration? I can't reproduce crash.

The buildbot configuration is 64bit Ubuntu 12.04 Debug with tiled backing store on.

I am not sure it can be reproduced when running only the single test, maybe it's influenced by running other threads in parallel, indicating it would be a timing issue?

[Mateusz Leszko]

Running all set of test also doesn't end up with this error. Is it still actual?

[Grzegorz Czajkowski]

(In reply to comment #4)
> Running all set of test also doesn't end up with this error. Is it still actual?

You can verify the bots result at http://build.webkit.org/console?category=EFL

[Mateusz Leszko]

ok, problem seems not solved:
http://build.webkit.org/results/EFL%20Linux%2064-bit%20Debug%20WK2/r138706%20%287640%29/editing/selection/first-letter-selection-crash-stderr.txt

[Mateusz Leszko]

I didn't reproduced crash but found possible place where it can go wrong.
CC'ing Dominic who may know more about it, cause he created related bug.

In crashing function AccessibilityRenderObject::textUnderElement() there is 
'#if PLATFORM(GTK)' statement. Accessibility in Efl is based on Gtk platform, so maybe it is connected.

Maybe someone who reproduced bug can check if this statement works with EFL. I am asking because working on it is like blind walk.

[Dominic Mazzoni]

There's a known issue in AccessibilityRenderObject::remoteSVGRootElement during document destruction being worked on now, so this is almost certainly the same issue.

*** This bug has been marked as a duplicate of bug 104171 ***

[Thiago Marcos P. Santos]

(In reply to comment #8)
> There's a known issue in AccessibilityRenderObject::remoteSVGRootElement during document destruction being worked on now, so this is almost certainly the same issue.
> 
> *** This bug has been marked as a duplicate of bug 104171 ***

Do you mind adding me to this bug? I don't have access to it.

This issue has been difficult to reproduce, but looks like now we see it happening all the time on the EFL bots with the following test case:

css3/calc/table-calcs.html

Backtrace:
https://gist.github.com/4c7969628d8f9986cb6d

[Joanmarie Diggs]

(In reply to comment #9)
> (In reply to comment #8)
> > There's a known issue in AccessibilityRenderObject::remoteSVGRootElement during document destruction being worked on now, so this is almost certainly the same issue.
> > 
> > *** This bug has been marked as a duplicate of bug 104171 ***
> 
> Do you mind adding me to this bug? I don't have access to it.
> 
> This issue has been difficult to reproduce, but looks like now we see it happening all the time on the EFL bots with the following test case:
> 
> css3/calc/table-calcs.html
> 
> Backtrace:
> https://gist.github.com/4c7969628d8f9986cb6d

Something really bad is happening with tables. :(

https://bugs.webkit.org/show_bug.cgi?id=106903

[Dominic Mazzoni]

Feel free to reopen this bug. It looks like 104171 didn't solve the issue for all platforms.