Bug 137887 - Lookup of "self" sometimes fails in a worker, making http/tests/security/cross-origin-shared-worker-allowed.html flaky
Summary: Lookup of "self" sometimes fails in a worker, making http/tests/security/cros...
Status: NEW
Alias: None
Product: WebKit
Classification: Unclassified
Component: WebCore JavaScript (show other bugs)
Version: 528+ (Nightly build)
Hardware: Unspecified Unspecified
: P2 Normal
Assignee: Nobody
Keywords: InRadar, MakingBotsRed
Depends on:
Reported: 2014-10-20 11:32 PDT by Alexey Proskuryakov
Modified: 2016-09-09 10:55 PDT (History)
4 users (show)

See Also:


Note You need to log in before you can comment on or make changes to this bug.
Description Alexey Proskuryakov 2014-10-20 11:32:19 PDT
http/tests/security/cross-origin-shared-worker-allowed.html is flaky:

+CONSOLE MESSAGE: line 1: ReferenceError: Can't find variable: self

This test is trivially simple, so it's a pretty big correctness issue.

In debug builds, it asserts:

Thread 28 Crashed:: WebCore: Worker
0   com.apple.JavaScriptCore      	0x000000010b20bdea WTFCrash + 42 (Assertions.cpp:321)
1   com.apple.JavaScriptCore      	0x000000010afe9776 JSC::HashTable::createTable() const + 70 (Lookup.cpp:31)
2   com.apple.WebCore             	0x00000001106dafeb JSC::HashTable::initializeIfNeeded() const + 43 (Lookup.h:91)
3   com.apple.WebCore             	0x00000001106dad70 JSC::HashTable::entry(JSC::PropertyName) const + 32 (Lookup.h:98)
4   com.apple.WebCore             	0x000000011077d864 bool JSC::getStaticFunctionSlot<JSC::JSObject>(JSC::ExecState*, JSC::HashTable const&, JSC::JSObject*, JSC::PropertyName, JSC::PropertySlot&) + 100 (Lookup.h:229)
5   com.apple.WebCore             	0x0000000110c5d179 WebCore::JSWorkerGlobalScopePrototype::getOwnPropertySlot(JSC::JSObject*, JSC::ExecState*, JSC::PropertyName, JSC::PropertySlot&) + 89 (JSWorkerGlobalScope.cpp:634)
6   com.apple.JavaScriptCore      	0x000000010a948b47 JSC::JSObject::fastGetOwnPropertySlot(JSC::ExecState*, JSC::VM&, JSC::Structure&, JSC::PropertyName, JSC::PropertySlot&) + 167 (JSObject.h:1261)
7   com.apple.JavaScriptCore      	0x000000010a948926 JSC::JSObject::getPropertySlot(JSC::ExecState*, JSC::PropertyName, JSC::PropertySlot&) + 150 (JSObject.h:1273)
8   com.apple.JavaScriptCore      	0x000000010a96c811 JSC::JSValue::get(JSC::ExecState*, JSC::PropertyName, JSC::PropertySlot&) const + 257 (JSCJSValueInlines.h:695)
9   com.apple.JavaScriptCore      	0x000000010afdea21 llint_slow_path_get_by_id + 241 (LLIntSlowPaths.cpp:578)

This is ASSERT(!keys).
Comment 1 Alexey Proskuryakov 2015-01-15 10:21:50 PST
This particular test is no longer relevant, with shared workers being removed. I don't remember if we hit this crash elsewhere, but the root cause seems unlikely to be specific to shared workers.
Comment 2 David Kilzer (:ddkilzer) 2016-09-09 10:55:42 PDT