Bug 117756 - REGRESSION (r161429?): Frequent crashes on media/track/media-element-enqueue-event-crash.html
Summary: REGRESSION (r161429?): Frequent crashes on media/track/media-element-enqueue-...
Status: RESOLVED FIXED
Alias: None
Product: WebKit
Classification: Unclassified
Component: JavaScriptCore (show other bugs)
Version: 528+ (Nightly build)
Hardware: Unspecified Unspecified
: P1 Normal
Assignee: WebKit Commit Bot
URL:
Keywords: InRadar, Regression
Depends on:
Blocks: 50856
  Show dependency treegraph
 
Reported: 2013-06-18 14:24 PDT by WebKit Commit Bot
Modified: 2017-03-07 21:18 PST (History)
10 users (show)

See Also:


Attachments
Archive of layout-test-results from webkit-cq-02 (499.05 KB, application/zip)
2013-06-18 14:24 PDT, WebKit Commit Bot
no flags Details
Patch (2.18 KB, patch)
2014-05-07 17:06 PDT, Geoffrey Garen
mhahnenberg: review+
Details | Formatted Diff | Diff
Archive of layout-test-results from webkit-cq-02 (900.05 KB, application/zip)
2017-03-07 21:18 PST, WebKit Commit Bot
no flags Details

Note You need to log in before you can comment on or make changes to this bug.
Description WebKit Commit Bot 2013-06-18 14:24:06 PDT
This is an automatically generated bug from the commit-queue.
media/track/media-element-enqueue-event-crash.html has been flaky on the commit-queue.

media/track/media-element-enqueue-event-crash.html was authored by eric.carlson@apple.com.
http://trac.webkit.org/browser/trunk/LayoutTests/media/track/media-element-enqueue-event-crash.html

The commit-queue just saw media/track/media-element-enqueue-event-crash.html flake (DumpRenderTree crashed) while processing attachment 204936 [details] on bug 117747.
Bot: webkit-cq-02  Port: <class 'webkitpy.common.config.ports.MacPort'>  Platform: Mac OS X 10.8.3

The bots will update this with information from each new failure.

If you believe this bug to be fixed or invalid, feel free to close.  The bots will re-open if the flake re-occurs.

If you would like to track this test fix with another bug, please close this bug as a duplicate.  The bots will follow the duplicate chain when making future comments.
Comment 1 WebKit Commit Bot 2013-06-18 14:24:10 PDT
Created attachment 204942 [details]
Archive of layout-test-results from webkit-cq-02
Comment 2 Alexey Proskuryakov 2014-01-07 16:57:49 PST
I just had this test hit an assertion when running tests locally. Not sure if this is the same issue as originally seen by commit queue.

        ASSERT(node == m_head);

Thread 0 Crashed:: Dispatch queue: com.apple.main-thread
0   com.apple.JavaScriptCore      	0x0000000102df1b2a WTFCrash + 42 (Assertions.cpp:341)
1   com.apple.JavaScriptCore      	0x0000000102c2d096 WTF::DoublyLinkedList<JSC::MarkedBlock>::remove(JSC::MarkedBlock*) + 198 (DoublyLinkedList.h:169)
2   com.apple.JavaScriptCore      	0x0000000102c2cb4a JSC::MarkedAllocator::removeBlock(JSC::MarkedBlock*) + 154 (MarkedAllocator.cpp:153)
3   com.apple.JavaScriptCore      	0x0000000102c30afd JSC::MarkedSpace::freeBlock(JSC::MarkedBlock*) + 45 (MarkedSpace.cpp:234)
4   com.apple.JavaScriptCore      	0x0000000102c30bf7 JSC::MarkedSpace::freeOrShrinkBlock(JSC::MarkedBlock*) + 71 (MarkedSpace.cpp:250)
5   com.apple.JavaScriptCore      	0x0000000102a9b264 JSC::IncrementalSweeper::sweepNextBlock() + 180 (IncrementalSweeper.cpp:130)
6   com.apple.JavaScriptCore      	0x0000000102a9b12a JSC::IncrementalSweeper::doSweep(double) + 106 (IncrementalSweeper.cpp:108)
7   com.apple.JavaScriptCore      	0x0000000102a9b0b2 JSC::IncrementalSweeper::doWork() + 34 (IncrementalSweeper.cpp:100)
8   com.apple.JavaScriptCore      	0x0000000102a97222 JSC::HeapTimer::timerDidFire(__CFRunLoopTimer*, void*) + 338 (HeapTimer.cpp:98)
9   com.apple.CoreFoundation      	0x00007fff8bbd3724 __CFRUNLOOP_IS_CALLING_OUT_TO_A_TIMER_CALLBACK_FUNCTION__ + 20
Comment 3 Alexey Proskuryakov 2014-01-08 10:22:32 PST
This test started to crash super frequently on Mac bots (debug and release) yesterday.

http://webkit-test-results.appspot.com/dashboards/flakiness_dashboard.html#showAllRuns=true&tests=media%2Ftrack%2Fmedia-element-enqueue-event-crash.html
Comment 4 Eric Carlson 2014-01-08 11:00:08 PST
(In reply to comment #2)
> I just had this test hit an assertion when running tests locally. Not sure if this is the same issue as originally seen by commit queue.
> 
>         ASSERT(node == m_head);
> 
This is not the same crash originally seen by the commit queue. This is asserting because a list node without a previous element is not the list head:

    template<typename T> inline void DoublyLinkedList<T>::remove(T* node)
    {
        if (node->prev()) {
            ASSERT(node != m_head);
            node->prev()->setNext(node->next());
        } else {
-->         ASSERT(node == m_head);
            m_head = node->next();
        }
Comment 5 Eric Carlson 2014-01-08 11:08:11 PST
I don't know much about about how the GC works but r161429 looks like it could be related - it changed the way sweeping behaves and was committed at 2014-01-07 09:36:02 PST, .
Comment 6 Alexey Proskuryakov 2014-01-08 12:00:34 PST
Indeed, the crashes started right after r161429. 

Let's track the new JSC crash here, old flakiness seems to be gone (there is one earlier crash recorded by flakiness dashboard, but in a revision that was all broken).
Comment 7 Radar WebKit Bug Importer 2014-01-08 12:02:20 PST
<rdar://problem/15774608>
Comment 8 Alexey Proskuryakov 2014-01-09 10:28:00 PST
In release mode, the crashes are in a different place each time. Debug assertions all seem to be in DoublyLinkedList as posted above.

Skipped in <http://trac.webkit.org/r161560>.
Comment 9 Sergio Villar Senin 2014-04-04 03:02:52 PDT
This is also asserting in WebKitGTK debug bots

STDERR: ASSERTION FAILED: !m_deletionHasBegun || !m_referencingNodeCount
STDERR: ../../Source/WebCore/dom/Document.h(280) : void WebCore::Document::decrementReferencingNodeCount()
STDERR: 1   0x7f5d1fc16e2d /home/slave/webkitgtk/gtk-linux-64-debug/build/WebKitBuild/Debug/lib/libjavascriptcoregtk-3.0.so.0(WTFCrash+0x1e) [0x7f5d1fc16e2d]
STDERR: 2   0x7f5d1a1451b6 /home/slave/webkitgtk/gtk-linux-64-debug/build/WebKitBuild/Debug/lib/libwebkit2gtk-3.0.so.25(_ZN7WebCore8Document29decrementReferencingNodeCountEv+0x4a) [0x7f5d1a1451b6]
STDERR: 3   0x7f5d1a1d3109 /home/slave/webkitgtk/gtk-linux-64-debug/build/WebKitBuild/Debug/lib/libwebkit2gtk-3.0.so.25(_ZN7WebCore4NodeD1Ev+0x179) [0x7f5d1a1d3109]
STDERR: 4   0x7f5d1a0ff0e0 /home/slave/webkitgtk/gtk-linux-64-debug/build/WebKitBuild/Debug/lib/libwebkit2gtk-3.0.so.25(_ZN7WebCore13CharacterDataD1Ev+0x3a) [0x7f5d1a0ff0e0]
STDERR: 5   0x7f5d1a221b57 /home/slave/webkitgtk/gtk-linux-64-debug/build/WebKitBuild/Debug/lib/libwebkit2gtk-3.0.so.25(_ZN7WebCore4TextD1Ev+0x5f) [0x7f5d1a221b57]
STDERR: 6   0x7f5d1a221b86 /home/slave/webkitgtk/gtk-linux-64-debug/build/WebKitBuild/Debug/lib/libwebkit2gtk-3.0.so.25(_ZN7WebCore4TextD0Ev+0x18) [0x7f5d1a221b86]
STDERR: 7   0x7f5d1a11a737 /home/slave/webkitgtk/gtk-linux-64-debug/build/WebKitBuild/Debug/lib/libwebkit2gtk-3.0.so.25(_ZN7WebCore33removeDetachedChildrenInContainerINS_4NodeENS_13ContainerNodeEEEvRT0_+0xe8) [0x7f5d1a11a737]
STDERR: 8   0x7f5d1a113e7c /home/slave/webkitgtk/gtk-linux-64-debug/build/WebKitBuild/Debug/lib/libwebkit2gtk-3.0.so.25(_ZN7WebCore13ContainerNode22removeDetachedChildrenEv+0x62) [0x7f5d1a113e7c]
STDERR: 9   0x7f5d1a114229 /home/slave/webkitgtk/gtk-linux-64-debug/build/WebKitBuild/Debug/lib/libwebkit2gtk-3.0.so.25(_ZN7WebCore13ContainerNodeD1Ev+0x5b) [0x7f5d1a114229]
STDERR: 10  0x7f5d1a189319 /home/slave/webkitgtk/gtk-linux-64-debug/build/WebKitBuild/Debug/lib/libwebkit2gtk-3.0.so.25(_ZN7WebCore7ElementD1Ev+0x18f) [0x7f5d1a189319]
STDERR: 11  0x7f5d1a2176fc /home/slave/webkitgtk/gtk-linux-64-debug/build/WebKitBuild/Debug/lib/libwebkit2gtk-3.0.so.25(_ZN7WebCore13StyledElementD1Ev+0x5a) [0x7f5d1a2176fc]
STDERR: 12  0x7f5d1a3251ca /home/slave/webkitgtk/gtk-linux-64-debug/build/WebKitBuild/Debug/lib/libwebkit2gtk-3.0.so.25(_ZN7WebCore11HTMLElementD1Ev+0x2a) [0x7f5d1a3251ca]
STDERR: 13  0x7f5d1a36643a /home/slave/webkitgtk/gtk-linux-64-debug/build/WebKitBuild/Debug/lib/libwebkit2gtk-3.0.so.25(_ZN7WebCore16HTMLMediaElementD1Ev+0x686) [0x7f5d1a36643a]
STDERR: 14  0x7f5d1a3ba796 /home/slave/webkitgtk/gtk-linux-64-debug/build/WebKitBuild/Debug/lib/libwebkit2gtk-3.0.so.25(_ZN7WebCore16HTMLVideoElementD1Ev+0x126) [0x7f5d1a3ba796]
STDERR: 15  0x7f5d1a3ba826 /home/slave/webkitgtk/gtk-linux-64-debug/build/WebKitBuild/Debug/lib/libwebkit2gtk-3.0.so.25(_ZN7WebCore16HTMLVideoElementD0Ev+0x18) [0x7f5d1a3ba826]
STDERR: 16  0x7f5d1a1da0d8 /home/slave/webkitgtk/gtk-linux-64-debug/build/WebKitBuild/Debug/lib/libwebkit2gtk-3.0.so.25(_ZN7WebCore4Node14removedLastRefEv+0x58) [0x7f5d1a1da0d8]
STDERR: 17  0x7f5d19afd0bd /home/slave/webkitgtk/gtk-linux-64-debug/build/WebKitBuild/Debug/lib/libwebkit2gtk-3.0.so.25(_ZN7WebCore10TreeSharedINS_4NodeEE5derefEv+0x159) [0x7f5d19afd0bd]
STDERR: 18  0x7f5d1a1d43fe /home/slave/webkitgtk/gtk-linux-64-debug/build/WebKitBuild/Debug/lib/libwebkit2gtk-3.0.so.25(_ZN7WebCore4Node16derefEventTargetEv+0x1c) [0x7f5d1a1d43fe]
STDERR: 19  0x7f5d19d77381 /home/slave/webkitgtk/gtk-linux-64-debug/build/WebKitBuild/Debug/lib/libwebkit2gtk-3.0.so.25(_ZN7WebCore11EventTarget5derefEv+0x23) [0x7f5d19d77381]
STDERR: 20  0x7f5d19d79818 /home/slave/webkitgtk/gtk-linux-64-debug/build/WebKitBuild/Debug/lib/libwebkit2gtk-3.0.so.25(_ZN3WTF14derefIfNotNullIN7WebCore11EventTargetEEEvPT_+0x28) [0x7f5d19d79818]
STDERR: 21  0x7f5d19da372b /home/slave/webkitgtk/gtk-linux-64-debug/build/WebKitBuild/Debug/lib/libwebkit2gtk-3.0.so.25(_ZN3WTF6RefPtrIN7WebCore11EventTargetEED1Ev+0x1b) [0x7f5d19da372b]
STDERR: 22  0x7f5d1a19ee12 /home/slave/webkitgtk/gtk-linux-64-debug/build/WebKitBuild/Debug/lib/libwebkit2gtk-3.0.so.25(_ZN7WebCore5EventD1Ev+0x3e) [0x7f5d1a19ee12]
STDERR: 23  0x7f5d1a19ee72 /home/slave/webkitgtk/gtk-linux-64-debug/build/WebKitBuild/Debug/lib/libwebkit2gtk-3.0.so.25(_ZN7WebCore5EventD0Ev+0x18) [0x7f5d1a19ee72]
STDERR: 24  0x7f5d19b87306 /home/slave/webkitgtk/gtk-linux-64-debug/build/WebKitBuild/Debug/lib/libwebkit2gtk-3.0.so.25(_ZN3WTF10RefCountedIN7WebCore5EventEE5derefEv+0x48) [0x7f5d19b87306]
STDERR: 25  0x7f5d1b115a18 /home/slave/webkitgtk/gtk-linux-64-debug/build/WebKitBuild/Debug/lib/libwebkit2gtk-3.0.so.25(_ZN7WebCore7JSEvent11releaseImplEv+0x20) [0x7f5d1b115a18]
STDERR: 26  0x7f5d1b115934 /home/slave/webkitgtk/gtk-linux-64-debug/build/WebKitBuild/Debug/lib/libwebkit2gtk-3.0.so.25(_ZN7WebCore12JSEventOwner8finalizeEN3JSC6HandleINS1_7UnknownEEEPv+0x6a) [0x7f5d1b115934]
STDERR: 27  0x7f5d1f94c15d /home/slave/webkitgtk/gtk-linux-64-debug/build/WebKitBuild/Debug/lib/libjavascriptcoregtk-3.0.so.0(_ZN3JSC9WeakBlock8finalizeEPNS_8WeakImplE+0xb5) [0x7f5d1f94c15d]
STDERR: 28  0x7f5d1f94bb7f /home/slave/webkitgtk/gtk-linux-64-debug/build/WebKitBuild/Debug/lib/libjavascriptcoregtk-3.0.so.0(_ZN3JSC9WeakBlock5sweepEv+0x89) [0x7f5d1f94bb7f]
STDERR: 29  0x7f5d1f94c4b8 /home/slave/webkitgtk/gtk-linux-64-debug/build/WebKitBuild/Debug/lib/libjavascriptcoregtk-3.0.so.0(_ZN3JSC7WeakSet5sweepEv+0x2e) [0x7f5d1f94c4b8]
STDERR: 30  0x7f5d1f94327a /home/slave/webkitgtk/gtk-linux-64-debug/build/WebKitBuild/Debug/lib/libjavascriptcoregtk-3.0.so.0(_ZN3JSC11MarkedBlock5sweepENS0_9SweepModeE+0x66) [0x7f5d1f94327a]
STDERR: 31  0x7f5d1f946199 /home/slave/webkitgtk/gtk-linux-64-debug/build/WebKitBuild/Debug/lib/libjavascriptcoregtk-3.0.so.0(_ZN3JSC5SweepclEPNS_11MarkedBlockE+0x21) [0x7f5d1f946199]
Comment 10 Geoffrey Garen 2014-05-07 17:06:05 PDT
Created attachment 231030 [details]
Patch
Comment 11 Mark Hahnenberg 2014-05-07 17:06:42 PDT
Comment on attachment 231030 [details]
Patch

r=me
Comment 12 Geoffrey Garen 2014-05-07 17:07:33 PDT
Committed r168453: <http://trac.webkit.org/changeset/168453>
Comment 13 WebKit Commit Bot 2017-03-07 21:18:01 PST
The commit-queue just saw media/track/media-element-enqueue-event-crash.html flake (text diff) while processing attachment 303766 [details] on bug 169336.
Bot: webkit-cq-02  Port: <class 'webkitpy.common.config.ports.MacPort'>  Platform: Mac OS X 10.11.6
Comment 14 WebKit Commit Bot 2017-03-07 21:18:05 PST
Created attachment 303776 [details]
Archive of layout-test-results from webkit-cq-02