This is an extremely common assertion on bots.
Thread 0 Crashed:: Dispatch queue: com.apple.main-thread
1 com.apple.WebCore 0x0000000106881ca3 JSC::Bindings::Instance::createRuntimeObject(JSC::ExecState*) + 163 (BridgeJSC.cpp:74)
2 com.apple.WebCore 0x000000010795da73 JSC::Bindings::convertObjcValueToValue(JSC::ExecState*, void*, JSC::Bindings::ObjcValueType, JSC::Bindings::RootObject*) + 1571 (objc_utility.mm:202)
3 com.apple.WebCore 0x0000000107959864 JSC::Bindings::ObjcInstance::invokeObjcMethod(JSC::ExecState*, JSC::Bindings::ObjcMethod*) + 2356 (objc_instance.mm:343)
4 com.apple.WebCore 0x0000000107958f08 JSC::Bindings::ObjcInstance::invokeMethod(JSC::ExecState*, JSC::RuntimeMethod*) + 312 (objc_instance.mm:233)
5 com.apple.WebCore 0x0000000107d44e67 JSC::callRuntimeMethod(JSC::ExecState*) + 503 (runtime_method.cpp:100)
It was very difficult for me to reproduce this locally. I managed to hit it once with
run-webkit-tests platform/mac/editing/attributed-string/ --iter 1000 -v -gf
This isn't this the same assertion we're hitting on other layout tests?
I don't know which assertion you have in mind, but the answer is likely no. It's only a small subset of tests that have a code path through ObjcInstance::invokeMethod.
Still seeing this quite often
Still seeing it a few times a day:
Looks like there are at least two problems here:
- Somehow, s_instanceWrapperCache contains an entry with an invalidated root object, which makes no sense.
- The cache should not be global, because Objective C instances can be used in multiple pages at once, and they need separate ObjcInstances then.
Both are pretty bad bugs I think.
This was failing extremely frequently lately - most of the time, multiple bots were red because of this issue alone. Marked as flakily crashing in debug in <http://trac.webkit.org/r160840>.
Looks like this is a bug in Objective-C binding code?
This lurked for four years before we noticed!?
Yes, it appears so.
These attributed string tests were added this August, and I guess we didn't cover this aspect of Objective-C bindings in tests before. Also, these crashes became more frequent over the last few months, presumably because of some timing differences in loading, GC, or just different hardware on bots.
platform/mac/plugins/jsobjc-simple.html is affected too.