Bug 113019 – REGRESSION (r146540?): Crashes in storage/indexeddb/factory-basics-workers.html, storage/indexeddb/transaction-error.html

• Status: RESOLVED
• Resolution: FIXED
• Component: WebKitGTK

[Zan Dobersek]

The following two tests started crashing on the GTK debug builds:
storage/indexeddb/factory-basics-workers.html
storage/indexeddb/transaction-error.html

Crashes started occurring in the following commit range, with r146540 being the most likely cause of regression:
http://trac.webkit.org/log/?verbose=on&rev=146545&stop_rev=146535
http://trac.webkit.org/changeset/146540

http://test-results.appspot.com/dashboards/flakiness_dashboard.html#group=%40ToT%20-%20webkit.org&tests=storage%2Findexeddb%2Ffactory-basics-workers.html%2Cstorage%2Findexeddb%2Ftransaction-error.html

Here's the crash log:
Crash log for DumpRenderTree (pid 21395):

..
[Thread debugging using libthread_db enabled]
Using host libthread_db library "/lib/x86_64-linux-gnu/libthread_db.so.1".
Core was generated by `/home/slave/webkitgtk/gtk-linux-64-debug-wk1/build/WebKitBuild/Debug/Programs/D'.
Program terminated with signal 11, Segmentation fault.
#0  0x00002b2956b1d2de in WebCore::IDBTransaction::~IDBTransaction (this=0x2a43fe0, __in_chrg=<optimized out>) at ../../Source/WebCore/Modules/indexeddb/IDBTransaction.cpp:119
119	    ASSERT(m_state == Finished);

...

Thread 1 (Thread 0x2b2964181e00 (LWP 21395)):
#0  0x00002b2956b1d2de in WebCore::IDBTransaction::~IDBTransaction (this=0x2a43fe0, __in_chrg=<optimized out>) at ../../Source/WebCore/Modules/indexeddb/IDBTransaction.cpp:119
#1  0x00002b2956b1d470 in WebCore::IDBTransaction::~IDBTransaction (this=0x2a43fe0, __in_chrg=<optimized out>) at ../../Source/WebCore/Modules/indexeddb/IDBTransaction.cpp:121
#2  0x00002b295588b9be in WTF::RefCounted<WebCore::IDBTransaction>::deref (this=0x2a43ff0) at ../../Source/WTF/wtf/RefCounted.h:202
#3  0x00002b295675c662 in WebCore::JSIDBTransaction::releaseImpl (this=0x2b29acda9270) at DerivedSources/WebCore/JSIDBTransaction.h:61
#4  0x00002b295675c30c in WebCore::JSIDBTransactionOwner::finalize (this=0x24118d0, handle=..., context=0x23e8470) at DerivedSources/WebCore/JSIDBTransaction.cpp:440
#5  0x00002b2954a53d08 in JSC::WeakBlock::finalize (this=0x2b29ad6e3000, weakImpl=0x2b29ad6e3c00) at ../../Source/JavaScriptCore/heap/WeakSetInlines.h:52
#6  0x00002b2954a53693 in JSC::WeakBlock::sweep (this=0x2b29ad6e3000) at ../../Source/JavaScriptCore/heap/WeakBlock.cpp:76
#7  0x00002b2954a53ff2 in JSC::WeakSet::sweep (this=0x2b29acda0448) at ../../Source/JavaScriptCore/heap/WeakSet.cpp:47
#8  0x00002b2954a4bfb9 in JSC::MarkedBlock::sweep (this=0x2b29acda0000, sweepMode=JSC::MarkedBlock::SweepOnly) at ../../Source/JavaScriptCore/heap/MarkedBlock.cpp:110
#9  0x00002b2954a4ea17 in JSC::Sweep::operator() (this=0x7fff09761d2f, block=0x2b29acda0000) at ../../Source/JavaScriptCore/heap/MarkedSpace.h:51
#10 0x00002b2954a4fd89 in JSC::MarkedAllocator::forEachBlock<JSC::Sweep> (this=0x23da178, functor=...) at ../../Source/JavaScriptCore/heap/MarkedAllocator.h:120
#11 0x00002b2954a4f8a5 in JSC::MarkedSpace::forEachBlock<JSC::Sweep> (this=0x23da088, functor=...) at ../../Source/JavaScriptCore/heap/MarkedSpace.h:222
#12 0x00002b2954a4f0d7 in JSC::MarkedSpace::forEachBlock<JSC::Sweep> (this=0x23da088) at ../../Source/JavaScriptCore/heap/MarkedSpace.h:242
#13 0x00002b2954a4dd29 in JSC::MarkedSpace::sweep (this=0x23da088) at ../../Source/JavaScriptCore/heap/MarkedSpace.cpp:119
#14 0x00002b2954a3aa48 in JSC::Heap::collect (this=0x23d9f08, sweepToggle=JSC::Heap::DoSweep) at ../../Source/JavaScriptCore/heap/Heap.cpp:761
#15 0x00002b2954a3a71d in JSC::Heap::collectAllGarbage (this=0x23d9f08) at ../../Source/JavaScriptCore/heap/Heap.cpp:691
#16 0x00002b29558258e0 in WebCore::collect () at ../../Source/WebCore/bindings/js/GCController.cpp:42
#17 0x00002b29558259d6 in WebCore::GCController::gcTimerFired (this=0x2700ce0) at ../../Source/WebCore/bindings/js/GCController.cpp:77
#18 0x00002b2955825c67 in WebCore::Timer<WebCore::GCController>::fired (this=0x2700ce0) at ../../Source/WebCore/platform/Timer.h:113
#19 0x00002b2956aa82fa in WebCore::ThreadTimers::sharedTimerFiredInternal (this=0x23b37a0) at ../../Source/WebCore/platform/ThreadTimers.cpp:129
#20 0x00002b2956aa81e7 in WebCore::ThreadTimers::sharedTimerFired () at ../../Source/WebCore/platform/ThreadTimers.cpp:105
#21 0x00002b2956cdbfee in WebCore::timeout_cb () at ../../Source/WebCore/platform/gtk/SharedTimerGtk.cpp:49
#22 0x00002b295ad215ac in g_timeout_dispatch () from /home/slave/webkitgtk/gtk-linux-64-debug-wk1/build/WebKitBuild/Dependencies/Root/lib64/libglib-2.0.so.0
#23 0x00002b295ad1f903 in g_main_dispatch () from /home/slave/webkitgtk/gtk-linux-64-debug-wk1/build/WebKitBuild/Dependencies/Root/lib64/libglib-2.0.so.0
#24 0x00002b295ad204b3 in g_main_context_dispatch () from /home/slave/webkitgtk/gtk-linux-64-debug-wk1/build/WebKitBuild/Dependencies/Root/lib64/libglib-2.0.so.0
#25 0x00002b295ad206a3 in g_main_context_iterate () from /home/slave/webkitgtk/gtk-linux-64-debug-wk1/build/WebKitBuild/Dependencies/Root/lib64/libglib-2.0.so.0
#26 0x00002b295ad20ad3 in g_main_loop_run () from /home/slave/webkitgtk/gtk-linux-64-debug-wk1/build/WebKitBuild/Dependencies/Root/lib64/libglib-2.0.so.0
#27 0x00002b2959d0ae22 in gtk_main () from /home/slave/webkitgtk/gtk-linux-64-debug-wk1/build/WebKitBuild/Dependencies/Root/lib64/libgtk-3.so.0
#28 0x00000000004a0ce9 in runTest (inputLine=...) at ../../Tools/DumpRenderTree/gtk/DumpRenderTree.cpp:768
#29 0x00000000004a039f in runTestingServerLoop () at ../../Tools/DumpRenderTree/gtk/DumpRenderTree.cpp:551
#30 0x00000000004a36cd in main (argc=2, argv=0x7fff09762a68) at ../../Tools/DumpRenderTree/gtk/DumpRenderTree.cpp:1510

[Joshua Bell]

Created attachment 194560 [details]
Patch

[Joshua Bell]

tony@ - r? cq?

[WebKit Review Bot]

Comment on attachment 194560 [details]
Patch

Clearing flags on attachment: 194560

Committed r146629: <http://trac.webkit.org/changeset/146629>

[WebKit Review Bot]

All reviewed patches have been landed.  Closing bug.