Saw this crash on ASan: Crashed Thread: 26 WebCore: Worker Exception Type: EXC_CRASH (SIGABRT) Exception Codes: 0x0000000000000000, 0x0000000000000000 Application Specific Information: ================================================================ ==646==ERROR: AddressSanitizer: heap-use-after-free on address 0x603000a5a900 at pc 0x000113ec2607 bp 0x000143530080 sp 0x000143530078 READ of size 4 at 0x603000a5a900 thread T360 ==646==WARNING: failed to fork external symbolizer (errno: 1) #0 0x113ec2606 in WTF::StringImpl::ref() (/Volumes/Data/slave/yosemite-asan-production-wk2-tests/build/buildToTest/WebCore.framework/Versions/A/WebCore+0x4d5606) #1 0x113edbe5c in WTF::RefPtr<WTF::StringImpl>::operator=(WTF::RefPtr<WTF::StringImpl> const&) (/Volumes/Data/slave/yosemite-asan-production-wk2-tests/build/buildToTest/WebCore.framework/Versions/A/WebCore+0x4eee5c) #2 0x113edbd3d in WTF::String::operator=(WTF::String const&) (/Volumes/Data/slave/yosemite-asan-production-wk2-tests/build/buildToTest/WebCore.framework/Versions/A/WebCore+0x4eed3d) #3 0x113f4538d in WTF::AtomicString::operator=(WTF::AtomicString const&) (/Volumes/Data/slave/yosemite-asan-production-wk2-tests/build/buildToTest/WebCore.framework/Versions/A/WebCore+0x55838d) #4 0x113bbeb43 in WebCore::XMLHttpRequest::createRequest(int&) (/Volumes/Data/slave/yosemite-asan-production-wk2-tests/build/buildToTest/WebCore.framework/Versions/A/WebCore+0x1d1b43) #5 0x113bbe619 in WebCore::XMLHttpRequest::send(WTF::String const&, int&) (/Volumes/Data/slave/yosemite-asan-production-wk2-tests/build/buildToTest/WebCore.framework/Versions/A/WebCore+0x1d1619) #6 0x113bbe10b in WebCore::XMLHttpRequest::send(int&) (/Volumes/Data/slave/yosemite-asan-production-wk2-tests/build/buildToTest/WebCore.framework/Versions/A/WebCore+0x1d110b) #7 0x113bbdc3b in WebCore::JSXMLHttpRequest::send(JSC::ExecState*) (/Volumes/Data/slave/yosemite-asan-production-wk2-tests/build/buildToTest/WebCore.framework/Versions/A/WebCore+0x1d0c3b) #8 0x113bbda95 in WebCore::jsXMLHttpRequestPrototypeFunctionSend(JSC::ExecState*) (/Volumes/Data/slave/yosemite-asan-production-wk2-tests/build/buildToTest/WebCore.framework/Versions/A/WebCore+0x1d0a95) #9 0x5f049b0089e7 (<unknown module>) #10 0x112e9e636 in llint_entry (/Volumes/Data/slave/yosemite-asan-production-wk2-tests/build/buildToTest/JavaScriptCore.framework/Versions/A/JavaScriptCore+0xa2c636) #11 0x112e98be5 in vmEntryToJavaScript (/Volumes/Data/slave/yosemite-asan-production-wk2-tests/build/buildToTest/JavaScriptCore.framework/Versions/A/JavaScriptCore+0xa26be5) #12 0x112cfc78f in JSC::JITCode::execute(JSC::VM*, JSC::ProtoCallFrame*) (/Volumes/Data/slave/yosemite-asan-production-wk2-tests/build/buildToTest/JavaScriptCore.framework/Versions/A/JavaScriptCore+0x88a78f) #13 0x1124e1d77 in JSC::Interpreter::executeCall(JSC::ExecState*, JSC::JSObject*, JSC::CallType, JSC::CallData const&, JSC::JSValue, JSC::ArgList const&) (/Volumes/Data/slave/yosemite-asan-production-wk2-tests/build/buildToTest/JavaScriptCore.framework/Versions/A/JavaScriptCore+0x6fd77) #14 0x1124e1991 in JSC::call(JSC::ExecState*, JSC::JSValue, JSC::CallType, JSC::CallData const&, JSC::JSValue, JSC::ArgList const&) (/Volumes/Data/slave/yosemite-asan-production-wk2-tests/build/buildToTest/JavaScriptCore.framework/Versions/A/JavaScriptCore+0x6f991) #15 0x1127bd2c1 in JSC::call(JSC::ExecState*, JSC::JSValue, JSC::CallType, JSC::CallData const&, JSC::JSValue, JSC::ArgList const&, JSC::JSValue*) (/Volumes/Data/slave/yosemite-asan-production-wk2-tests/build/buildToTest/JavaScriptCore.framework/Versions/A/JavaScriptCore+0x34b2c1) #16 0x113bc0de4 in WebCore::JSEventListener::handleEvent(WebCore::ScriptExecutionContext*, WebCore::Event*) (/Volumes/Data/slave/yosemite-asan-production-wk2-tests/build/buildToTest/WebCore.framework/Versions/A/WebCore+0x1d3de4) #17 0x113bc053e in WebCore::EventTarget::fireEventListeners(WebCore::Event*, WebCore::EventTargetData*, WTF::Vector<WebCore::RegisteredEventListener, 1ul, WTF::CrashOnOverflow>&) (/Volumes/Data/slave/yosemite-asan-production-wk2-tests/build/buildToTest/WebCore.framework/Versions/A/WebCore+0x1d353e) #18 0x113a3fa61 in WebCore::EventTarget::fireEventListeners(WebCore::Event*) (/Volumes/Data/slave/yosemite-asan-production-wk2-tests/build/buildToTest/WebCore.framework/Versions/A/WebCore+0x52a61) #19 0x113bbd3d5 in WebCore::EventTarget::dispatchEvent(WTF::PassRefPtr<WebCore::Event>) (/Volumes/Data/slave/yosemite-asan-production-wk2-tests/build/buildToTest/WebCore.framework/Versions/A/WebCore+0x1d03d5) #20 0x113bbd134 in WebCore::XMLHttpRequestProgressEventThrottle::dispatchEvent(WTF::PassRefPtr<WebCore::Event>) (/Volumes/Data/slave/yosemite-asan-production-wk2-tests/build/buildToTest/WebCore.framework/Versions/A/WebCore+0x1d0134) #21 0x113bbcedd in WebCore::XMLHttpRequestProgressEventThrottle::dispatchReadyStateChangeEvent(WTF::PassRefPtr<WebCore::Event>, WebCore::ProgressEventAction) (/Volumes/Data/slave/yosemite-asan-production-wk2-tests/build/buildToTest/WebCore.framework/Versions/A/WebCore+0x1cfedd) #22 0x113bbcb66 in WebCore::XMLHttpRequest::callReadyStateChangeListener() (/Volumes/Data/slave/yosemite-asan-production-wk2-tests/build/buildToTest/WebCore.framework/Versions/A/WebCore+0x1cfb66) #23 0x113bfa530 in WebCore::XMLHttpRequest::didFinishLoading(unsigned long, double) (/Volumes/Data/slave/yosemite-asan-production-wk2-tests/build/buildToTest/WebCore.framework/Versions/A/WebCore+0x20d530) #24 0x115d4eb23 in WebCore::WorkerRunLoop::runInMode(WebCore::WorkerGlobalScope*, WebCore::ModePredicate const&, WebCore::WorkerRunLoop::WaitMode) (/Volumes/Data/slave/yosemite-asan-production-wk2-tests/build/buildToTest/WebCore.framework/Versions/A/WebCore+0x2361b23) #25 0x115d4e8cf in WebCore::WorkerRunLoop::run(WebCore::WorkerGlobalScope*) (/Volumes/Data/slave/yosemite-asan-production-wk2-tests/build/buildToTest/WebCore.framework/Versions/A/WebCore+0x23618cf) #26 0x115d5718a in WebCore::WorkerThread::workerThread() (/Volumes/Data/slave/yosemite-asan-production-wk2-tests/build/buildToTest/WebCore.framework/Versions/A/WebCore+0x236a18a) #27 0x11247b78d in WTF::threadEntryPoint(void*) (/Volumes/Data/slave/yosemite-asan-production-wk2-tests/build/buildToTest/JavaScriptCore.framework/Versions/A/JavaScriptCore+0x978d) #28 0x11247b63d in WTF::wtfThreadEntryPoint(void*) (/Volumes/Data/slave/yosemite-asan-production-wk2-tests/build/buildToTest/JavaScriptCore.framework/Versions/A/JavaScriptCore+0x963d) #29 0x7fff92a8c267 in _pthread_body (/usr/lib/system/libsystem_pthread.dylib+0x3267) #30 0x7fff92a8c1e4 in _pthread_start (/usr/lib/system/libsystem_pthread.dylib+0x31e4) #31 0x7fff92a8a41c in thread_start (/usr/lib/system/libsystem_pthread.dylib+0x141c) 0x603000a5a900 is located 0 bytes inside of 24-byte region [0x603000a5a900,0x603000a5a918) freed by thread T0 here: #0 0x1085b1b89 in wrap_free (/Applications/Xcode.app/Contents/Developer/Toolchains/XcodeDefault.xctoolchain/usr/lib/clang/7.0.0/lib/darwin/libclang_rt.asan_osx_dynamic.dylib+0x42b89) #1 0x1130db730 in bmalloc::Deallocator::deallocateSlowCase(void*) (/Volumes/Data/slave/yosemite-asan-production-wk2-tests/build/buildToTest/JavaScriptCore.framework/Versions/A/JavaScriptCore+0xc69730) #2 0x115bf5721 in WebCore::ThreadableLoaderOptions::~ThreadableLoaderOptions() (/Volumes/Data/slave/yosemite-asan-production-wk2-tests/build/buildToTest/WebCore.framework/Versions/A/WebCore+0x2208721) #3 0x1143c1f8e in WebCore::DocumentThreadableLoader::~DocumentThreadableLoader() (/Volumes/Data/slave/yosemite-asan-production-wk2-tests/build/buildToTest/WebCore.framework/Versions/A/WebCore+0x9d4f8e) #4 0x113bfa68d in WebCore::DocumentThreadableLoader::~DocumentThreadableLoader() (/Volumes/Data/slave/yosemite-asan-production-wk2-tests/build/buildToTest/WebCore.framework/Versions/A/WebCore+0x20d68d) #5 0x115d60b3d in WebCore::WorkerThreadableLoader::MainThreadBridge::~MainThreadBridge() (/Volumes/Data/slave/yosemite-asan-production-wk2-tests/build/buildToTest/WebCore.framework/Versions/A/WebCore+0x2373b3d) #6 0x11435d099 in WebCore::Document::postTask(WebCore::ScriptExecutionContext::Task)::$_0::operator()() const (/Volumes/Data/slave/yosemite-asan-production-wk2-tests/build/buildToTest/WebCore.framework/Versions/A/WebCore+0x970099) #7 0x11264fb4d in WTF::callFunctionObject(void*) (/Volumes/Data/slave/yosemite-asan-production-wk2-tests/build/buildToTest/JavaScriptCore.framework/Versions/A/JavaScriptCore+0x1ddb4d) #8 0x1124f17cb in WTF::dispatchFunctionsFromMainThread() (/Volumes/Data/slave/yosemite-asan-production-wk2-tests/build/buildToTest/JavaScriptCore.framework/Versions/A/JavaScriptCore+0x7f7cb) #9 0x7fff8ac53cff in __NSThreadPerformPerform (/System/Library/Frameworks/Foundation.framework/Versions/C/Foundation+0x92cff) #10 0x7fff854b1a00 in __CFRUNLOOP_IS_CALLING_OUT_TO_A_SOURCE0_PERFORM_FUNCTION__ (/System/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation+0x80a00) #11 0x7fff854a3b8c in __CFRunLoopDoSources0 (/System/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation+0x72b8c) #12 0x7fff854a31be in __CFRunLoopRun (/System/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation+0x721be) #13 0x7fff854a2bd7 in CFRunLoopRunSpecific (/System/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation+0x71bd7) #14 0x7fff8ccd656e in RunCurrentEventLoopInMode (/System/Library/Frameworks/Carbon.framework/Versions/A/Frameworks/HIToolbox.framework/Versions/A/HIToolbox+0x3256e) #15 0x7fff8ccd62e9 in ReceiveNextEventCommon (/System/Library/Frameworks/Carbon.framework/Versions/A/Frameworks/HIToolbox.framework/Versions/A/HIToolbox+0x322e9) #16 0x7fff8ccd612a in _BlockUntilNextEventMatchingListInModeWithFilter (/System/Library/Frameworks/Carbon.framework/Versions/A/Frameworks/HIToolbox.framework/Versions/A/HIToolbox+0x3212a) #17 0x7fff87b6e9ba in _DPSNextEvent (/System/Library/Frameworks/AppKit.framework/Versions/C/AppKit+0x919ba) #18 0x7fff87b6df67 in -[NSApplication nextEventMatchingMask:untilDate:inMode:dequeue:] (/System/Library/Frameworks/AppKit.framework/Versions/C/AppKit+0x90f67) #19 0x7fff87b63bf2 in -[NSApplication run] (/System/Library/Frameworks/AppKit.framework/Versions/C/AppKit+0x86bf2) #20 0x7fff87ae0353 in NSApplicationMain (/System/Library/Frameworks/AppKit.framework/Versions/C/AppKit+0x3353) #21 0x7fff91c64957 in _xpc_objc_main (/usr/lib/system/libxpc.dylib+0x16957) #22 0x7fff91c6605f in xpc_main (/usr/lib/system/libxpc.dylib+0x1805f) #23 0x108563934 in ?? (/Volumes/Data/slave/yosemite-asan-production-wk2-tests/build/buildToTest/WebKit.framework/Versions/A/XPCServices/com.apple.WebKit.WebContent.Development.xpc/Contents/MacOS/com.apple.WebKit.WebContent.Development+0x100001934) #24 0x7fff86d2f5c8 in start (/usr/lib/system/libdyld.dylib+0x35c8) #25 0x0 (<unknown module>) previously allocated by thread T360 here: #0 0x1085b19c0 in wrap_malloc (/Applications/Xcode.app/Contents/Developer/Toolchains/XcodeDefault.xctoolchain/usr/lib/clang/7.0.0/lib/darwin/libclang_rt.asan_osx_dynamic.dylib+0x429c0) #1 0x1130d21e6 in bmalloc::Allocator::allocateSlowCase(unsigned long) (/Volumes/Data/slave/yosemite-asan-production-wk2-tests/build/buildToTest/JavaScriptCore.framework/Versions/A/JavaScriptCore+0xc601e6) #2 0x1130a8055 in bmalloc::Allocator::allocate(unsigned long) (/Volumes/Data/slave/yosemite-asan-production-wk2-tests/build/buildToTest/JavaScriptCore.framework/Versions/A/JavaScriptCore+0xc36055) #3 0x11247d90d in WTF::StringImpl::createFromLiteral(char const*, unsigned int) (/Volumes/Data/slave/yosemite-asan-production-wk2-tests/build/buildToTest/JavaScriptCore.framework/Versions/A/JavaScriptCore+0xb90d) #4 0x11308fd15 in WTF::CharBufferFromLiteralDataTranslator::translate(WTF::StringImpl*&, WTF::HashTranslatorCharBuffer<char> const&, unsigned int) (/Volumes/Data/slave/yosemite-asan-production-wk2-tests/build/buildToTest/JavaScriptCore.framework/Versions/A/JavaScriptCore+0xc1dd15) #5 0x11308f8d3 in WTF::HashTableAddResult<WTF::HashTableIterator<WTF::StringImpl*, WTF::StringImpl*, WTF::IdentityExtractor, WTF::StringHash, WTF::HashTraits<WTF::StringImpl*>, WTF::HashTraits<WTF::StringImpl*> > > WTF::HashTable<WTF::StringImpl*, WTF::StringImpl*, WTF::IdentityExtractor, WTF::StringHash, WTF::HashTraits<WTF::StringImpl*>, WTF::HashTraits<WTF::StringImpl*> >::addPassingHashCode<WTF::HashSetTranslatorAdapter<WTF::CharBufferFromLiteralDataTranslator>, WTF::HashTranslatorCharBuffer<char> const&, WTF::HashTranslatorCharBuffer<char> const&>(WTF::HashTranslatorCharBuffer<char> const&&&, WTF::HashTranslatorCharBuffer<char> const&&&) (/Volumes/Data/slave/yosemite-asan-production-wk2-tests/build/buildToTest/JavaScriptCore.framework/Versions/A/JavaScriptCore+0xc1d8d3) #6 0x11308f700 in WTF::HashTableAddResult<WTF::HashTableIterator<WTF::StringImpl*, WTF::StringImpl*, WTF::IdentityExtractor, WTF::StringHash, WTF::HashTraits<WTF::StringImpl*>, WTF::HashTraits<WTF::StringImpl*> > > WTF::HashSet<WTF::StringImpl*, WTF::StringHash, WTF::HashTraits<WTF::StringImpl*> >::add<WTF::CharBufferFromLiteralDataTranslator, WTF::HashTranslatorCharBuffer<char> >(WTF::HashTranslatorCharBuffer<char> const&) (/Volumes/Data/slave/yosemite-asan-production-wk2-tests/build/buildToTest/JavaScriptCore.framework/Versions/A/JavaScriptCore+0xc1d700) #7 0x113089c56 in WTF::Ref<WTF::StringImpl> WTF::addToStringTable<WTF::HashTranslatorCharBuffer<char>, WTF::CharBufferFromLiteralDataTranslator>(WTF::HashTranslatorCharBuffer<char> const&) (/Volumes/Data/slave/yosemite-asan-production-wk2-tests/build/buildToTest/JavaScriptCore.framework/Versions/A/JavaScriptCore+0xc17c56) #8 0x11247d815 in WTF::AtomicString::addFromLiteralData(char const*, unsigned int) (/Volumes/Data/slave/yosemite-asan-production-wk2-tests/build/buildToTest/JavaScriptCore.framework/Versions/A/JavaScriptCore+0xb815) #9 0x1140a6ebd in WebCore::CachedResourceRequestInitiators::CachedResourceRequestInitiators() (/Volumes/Data/slave/yosemite-asan-production-wk2-tests/build/buildToTest/WebCore.framework/Versions/A/WebCore+0x6b9ebd) #10 0x113a0ab4a in WebCore::ThreadGlobalData::ThreadGlobalData() (/Volumes/Data/slave/yosemite-asan-production-wk2-tests/build/buildToTest/WebCore.framework/Versions/A/WebCore+0x1db4a) #11 0x113a0aa35 in WTF::ThreadSpecific<WebCore::ThreadGlobalData>::operator WebCore::ThreadGlobalData*() (/Volumes/Data/slave/yosemite-asan-production-wk2-tests/build/buildToTest/WebCore.framework/Versions/A/WebCore+0x1da35) #12 0x115bfebf8 in WTF::ThreadSpecific<WebCore::ThreadGlobalData>::operator*() (/Volumes/Data/slave/yosemite-asan-production-wk2-tests/build/buildToTest/WebCore.framework/Versions/A/WebCore+0x2211bf8) #13 0x115d50372 in WebCore::RunLoopSetup::RunLoopSetup(WebCore::WorkerRunLoop&) (/Volumes/Data/slave/yosemite-asan-production-wk2-tests/build/buildToTest/WebCore.framework/Versions/A/WebCore+0x2363372) #14 0x115d4eeb7 in WebCore::WorkerRunLoop::runInMode(WebCore::WorkerGlobalScope*, WTF::String const&, WebCore::WorkerRunLoop::WaitMode) (/Volumes/Data/slave/yosemite-asan-production-wk2-tests/build/buildToTest/WebCore.framework/Versions/A/WebCore+0x2361eb7) #15 0x115d5ad90 in WebCore::WorkerThreadableLoader::loadResourceSynchronously(WebCore::WorkerGlobalScope*, WebCore::ResourceRequest const&, WebCore::ThreadableLoaderClient&, WebCore::ThreadableLoaderOptions const&) (/Volumes/Data/slave/yosemite-asan-production-wk2-tests/build/buildToTest/WebCore.framework/Versions/A/WebCore+0x236dd90) #16 0x115d5533c in WebCore::WorkerScriptLoader::loadSynchronously(WebCore::ScriptExecutionContext*, WebCore::URL const&, WebCore::CrossOriginRequestPolicy) (/Volumes/Data/slave/yosemite-asan-production-wk2-tests/build/buildToTest/WebCore.framework/Versions/A/WebCore+0x236833c) #17 0x115d3dda9 in WebCore::WorkerGlobalScope::importScripts(WTF::Vector<WTF::String, 0ul, WTF::CrashOnOverflow> const&, int&) (/Volumes/Data/slave/yosemite-asan-production-wk2-tests/build/buildToTest/WebCore.framework/Versions/A/WebCore+0x2350da9) #18 0x11432183b in WebCore::DedicatedWorkerGlobalScope::importScripts(WTF::Vector<WTF::String, 0ul, WTF::CrashOnOverflow> const&, int&) (/Volumes/Data/slave/yosemite-asan-production-wk2-tests/build/buildToTest/WebCore.framework/Versions/A/WebCore+0x93483b) #19 0x abort() called CRASHING TEST: /xmlhttprequest/workers/methods-async.html
Created attachment 250834 [details] proposed fix
Comment on attachment 250834 [details] proposed fix I should have built before posting :)
Created attachment 250837 [details] proposed fix
Comment on attachment 250837 [details] proposed fix Attachment 250837 [details] did not pass mac-ews (mac): Output: http://webkit-queues.appspot.com/results/5089664146866176 Number of test failures exceeded the failure limit.
Created attachment 250848 [details] Archive of layout-test-results from ews102 for mac-mavericks The attached test failures were seen while running run-webkit-tests on the mac-ews. Bot: ews102 Port: mac-mavericks Platform: Mac OS X 10.9.5
Comment on attachment 250837 [details] proposed fix Attachment 250837 [details] did not pass mac-wk2-ews (mac-wk2): Output: http://webkit-queues.appspot.com/results/5647298541387776 New failing tests: js/dom/Promise-reject-in-workers.html http/tests/workers/worker-importScripts.html js/dom/Promise-then-in-workers.html js/dom/Promise-resolve-in-workers.html js/dom/Promise-init-in-workers.html http/tests/xmlhttprequest/workers/access-control-basic-get-fail-non-simple.html http/tests/websocket/tests/hybi/workers/receive-blob.html http/tests/workers/text-encoding.html http/tests/xmlhttprequest/workers/referer.html http/tests/workers/worker-importScriptsOnError.html js/dom/Promise-simple-in-workers.html http/tests/xmlhttprequest/timeout/xmlhttprequest-timeout-worker-overrides.html http/tests/xmlhttprequest/workers/methods.html js/dom/Promise-then-without-callbacks-in-workers.html http/tests/xmlhttprequest/timeout/xmlhttprequest-timeout-worker-overridesexpires.html http/tests/xmlhttprequest/timeout/xmlhttprequest-timeout-worker-simple.html js/dom/global-constructors-attributes-dedicated-worker.html http/tests/xmlhttprequest/workers/xmlhttprequest-file-not-found.html http/tests/xmlhttprequest/workers/close.html http/tests/xmlhttprequest/timeout/xmlhttprequest-timeout-worker-twice.html http/tests/xmlhttprequest/timeout/xmlhttprequest-timeout-worker-synconworker.html js/dom/Promise-resolve-state-in-workers.html http/tests/xmlhttprequest/timeout/xmlhttprequest-timeout-worker-aborted.html http/tests/xmlhttprequest/workers/methods-async.html js/dom/Promise-catch-in-workers.html
Created attachment 250858 [details] Archive of layout-test-results from ews106 for mac-mavericks-wk2 The attached test failures were seen while running run-webkit-tests on the mac-wk2-ews. Bot: ews106 Port: mac-mavericks-wk2 Platform: Mac OS X 10.9.5
Created attachment 250859 [details] proposed fix
Comment on attachment 250859 [details] proposed fix r=me
Comment on attachment 250859 [details] proposed fix Clearing flags on attachment: 250859 Committed r182866: <http://trac.webkit.org/changeset/182866>
All reviewed patches have been landed. Closing bug.