Bug 106869 – [Chromium] REGRESSION(r139690-r139698) fast/mediastream/RTCPeerConnection-events.html crashing on chromium.webkit Lion Debug

• Status: RESOLVED
• Resolution: FIXED
• Component: WebCore Misc.

[Dominic Cooney]

fast/mediastream/RTCPeerConnection-events.html started crashing on the Chromium WebKit Lion Debug integration canary.

Revision range: <http://trac.webkit.org/log/?verbose=on&rev=139698&stop_rev=139690>
Flakiness Dashboard: <http://test-results.appspot.com/dashboards/flakiness_dashboard.html#tests=fast%2Fmediastream%2FRTCPeerConnection-events.html>

Maybe this has to do with r139696 (mentions MediaStream) or r139698 (mentions blobs… does RTC use blobs?)

[Dominic Cooney]

Added expectations in r139716.

[Dominic Cooney]

fast/mediastream/RTCPeerConnection-statsSelector.html test crashed on SnowLeopard Debug

<http://build.chromium.org/p/chromium.webkit/builders/WebKit%20Mac10.6%20(dbg)/builds/1984>

<http://test-results.appspot.com/dashboards/flakiness_dashboard.html#tests=fast%2Fmediastream%2FRTCPeerConnection-statsSelector.html>

Watching to see if this is a flake. If not, it may be related; maybe an earlier test is corrupting memory?

[Dominic Cooney]

From looking at the history for RTC* tests on the flakiness dashboard, it looks like this might be use-after-free or some such. Linux has more informative stack traces than Mac; for example this looks typical:

14:16:05.341 19413 worker/5 fast/mediastream/RTCPeerConnection-datachannel.html crashed, (stderr lines):
14:16:05.341 19413   Received signal 11
14:16:05.341 19413    [0x7f785046b3ec] base::debug::StackTrace::StackTrace()
14:16:05.341 19413    [0x7f785046ab3b] base::debug::(anonymous namespace)::StackDumpSignalHandler()
14:16:05.341 19413    [0x7f78461e18f0] <unknown>
14:16:05.341 19413    [0x7f784cb031d2] WebCore::ContextDestructionObserver::observeContext()
14:16:05.341 19413    [0x7f784cb0310b] WebCore::ContextDestructionObserver::~ContextDestructionObserver()
14:16:05.341 19413    [0x7f784d298327] WebCore::MediaStream::~MediaStream()
14:16:05.341 19413    [0x7f784d295c32] WebCore::LocalMediaStream::~LocalMediaStream()
14:16:05.341 19413    [0x7f784d295d62] WTF::RefCounted<>::deref()
14:16:05.341 19413    [0x7f784de8ab7a] WebCore::V8LocalMediaStream::derefObject()
14:16:05.341 19413    [0x7f784d38487a] WebCore::WrapperTypeInfo::derefObject()
14:16:05.341 19413    [0x7f784d384ee8] WebCore::DOMWrapperMap<>::defaultWeakCallback()
14:16:05.341 19413    [0x7f78523577a4] v8::internal::GlobalHandles::Node::PostGarbageCollectionProcessing()
14:16:05.342 19413    [0x7f785235610d] v8::internal::GlobalHandles::PostGarbageCollectionProcessing()
14:16:05.342 19413    [0x7f7852367fba] v8::internal::Heap::PerformGarbageCollection()
14:16:05.342 19413    [0x7f785236713f] v8::internal::Heap::CollectGarbage()
14:16:05.342 19413    [0x7f78522cf557] v8::internal::Heap::CollectGarbage()
14:16:05.342 19413    [0x7f7852470cdd] v8::internal::JSReceiver::SetProperty()
14:16:05.342 19413    [0x7f785250c186] v8::internal::Runtime::SetObjectProperty()
14:16:05.342 19413    [0x7f785250c96c] v8::internal::Runtime_SetProperty()
14:16:05.342 19413    [0x22450230654e] <unknown>
14:16:05.342 19413     r8: 000000000000007c  r9: 0101010101010101 r10: 0000000000000000 r11: 00007f7845ed3c7e
14:16:05.342 19413    r12: 000034f8c646ce39 r13: 00007f783f21a0b8 r14: 0000000000000004 r15: 00007fff25791628
14:16:05.342 19413     di: 00007f78347cb310  si: 0000000000000000  bp: 00007fff25790e90  bx: 00007f783f21a020
14:16:05.342 19413     dx: 00007f7850210130  ax: cdcdcdcdcdcdcdfd  cx: 0000000000143890  sp: 00007fff25790e80
14:16:05.342 19413     ip: 00007f784cb031d2 efl: 0000000000010282 cgf: 5309000000000033 erf: 0000000000000000
14:16:05.342 19413    trp: 000000000000000d msk: 0000000000000000 cr2: 0000000000000000

[Dominic Cooney]

I cannot reproduce these locally, and the flakiness dashboard indicates no recent crashes, so Occam’s razor leads me to assume this was due to solar flares disrupting the ionosphere causing epigenetic grumpiness in buildbot-inhabiting gnomes of some kind, and _they_ were responsible for the crashes. When you eliminate the probable whatever remains, however improbable, must be true.

[Tommy Widenflycht]

Or, however sad it makes to say it because I have greatly appreciated your prose, it could be that I actually found and fixed the issue. Didn't know if I should close this bug or not but I should at least have wrote a comment in addition to adding a "Depends on" bug. I am blaming Disaster Area's latest stunt ship dive into a local sun.