Bug 151838 – Web Inspector: CRASH in LayoutTests/inspector/debugger/terminate-dedicated-worker-while-paused.html

• Status: RESOLVED
• Resolution: INVALID
• Component: Web Inspector

[Joseph Pecoraro]

Created attachment 266581 [details]
[CRASH] Multiple Crash Report

* SUMMARY
CRASH in LayoutTests/inspector/debugger/terminate-dedicated-worker-while-paused.html.

* STEPS TO REPRODUCE
1. Unskip LayoutTests/inspector/debugger/terminate-dedicated-worker-while-paused.html
2. shell> run-webkit-tests --debug inspector/debugger --iterations=10 -1
  => this test crashes

* CRASH LOG
Multiple attached

> Crashed Thread:        34  WebCore: Worker
> Exception Type:        EXC_BAD_ACCESS (SIGSEGV)
> Exception Codes:       KERN_INVALID_ADDRESS at 0x0000000000000000
>
Thread 0:: Dispatch queue: com.apple.main-thread
> 0   llint_entry + 3366
> 1   llint_entry + 26604
> 2   llint_entry + 27485
> 3   llint_entry + 26604
> 4   llint_entry + 26604
> 5   vmEntryToJavaScript + 334
> 6   JSC::JITCode::execute(JSC::VM*, JSC::ProtoCallFrame*) + 213 (JITCode.cpp:80)
> 7   JSC::Interpreter::executeCall(JSC::ExecState*, JSC::JSObject*, JSC::CallType, JSC::CallData const&, JSC::JSValue, JSC::ArgList const&) + 1186 (Interpreter.cpp:1032)
> 8   JSC::call(JSC::ExecState*, JSC::JSValue, JSC::CallType, JSC::CallData const&, JSC::JSValue, JSC::ArgList const&) + 190 (CallData.cpp:39)
> 9   JSC::call(JSC::ExecState*, JSC::JSValue, JSC::CallType, JSC::CallData const&, JSC::JSValue, JSC::ArgList const&, WTF::NakedPtr<JSC::Exception>&) + 83 (CallData.cpp:44)
> 10  WebCore::JSMainThreadExecState::call(JSC::ExecState*, JSC::JSValue, JSC::CallType, JSC::CallData const&, JSC::JSValue, JSC::ArgList const&, WTF::NakedPtr<JSC::Exception>&) + 107 (JSMainThreadExecState.h:56)
> 11  WebCore::functionCallHandlerFromAnyThread(JSC::ExecState*, JSC::JSValue, JSC::CallType, JSC::CallData const&, JSC::JSValue, JSC::ArgList const&, WTF::NakedPtr<JSC::Exception>&) + 109 (JSMainThreadExecState.cpp:54)
> 12  Deprecated::ScriptFunctionCall::call(bool&) + 488 (ScriptFunctionCall.cpp:138)
> 13  Inspector::InjectedScriptBase::callFunctionWithEvalEnabled(Deprecated::ScriptFunctionCall&, bool&) const + 193 (InjectedScriptBase.cpp:81)
> 14  Inspector::InjectedScriptBase::makeCall(Deprecated::ScriptFunctionCall&, WTF::RefPtr<Inspector::InspectorValue>*) + 137 (InjectedScriptBase.cpp:100)
> 15  Inspector::InjectedScriptBase::makeEvalCall(WTF::String&, Deprecated::ScriptFunctionCall&, WTF::RefPtr<Inspector::Protocol::Runtime::RemoteObject>*, Inspector::Protocol::OptOutput<bool>*, Inspector::Protocol::OptOutput<int>*) + 78 (InjectedScriptBase.cpp:112)
> 16  Inspector::InjectedScript::evaluate(WTF::String&, WTF::String const&, WTF::String const&, bool, bool, bool, bool, WTF::RefPtr<Inspector::Protocol::Runtime::RemoteObject>*, Inspector::Protocol::OptOutput<bool>*, Inspector::Protocol::OptOutput<int>*) + 417 (InjectedScript.cpp:68)
> 17  Inspector::InspectorRuntimeAgent::evaluate(WTF::String&, WTF::String const&, WTF::String const*, bool const*, bool const*, int const*, bool const*, bool const*, bool const*, WTF::RefPtr<Inspector::Protocol::Runtime::RemoteObject>&, Inspector::Protocol::OptOutput<bool>*, Inspector::Protocol::OptOutput<int>*) + 626 (InspectorRuntimeAgent.cpp:128)
> 18  non-virtual thunk to Inspector::InspectorRuntimeAgent::evaluate(WTF::String&, WTF::String const&, WTF::String const*, bool const*, bool const*, int const*, bool const*, bool const*, bool const*, WTF::RefPtr<Inspector::Protocol::Runtime::RemoteObject>&, Inspector::Protocol::OptOutput<bool>*, Inspector::Protocol::OptOutput<int>*) + 252 (InspectorRuntimeAgent.cpp:116)
> 19  Inspector::RuntimeBackendDispatcher::evaluate(long, WTF::RefPtr<Inspector::InspectorObject>&&) + 2601 (InspectorBackendDispatchers.cpp:4969)
> 20  Inspector::RuntimeBackendDispatcher::dispatch(long, WTF::String const&, WTF::Ref<Inspector::InspectorObject>&&) + 827 (InspectorBackendDispatchers.cpp:4898)
> 21  Inspector::BackendDispatcher::dispatch(WTF::String const&) + 1997 (InspectorBackendDispatcher.cpp:181)
> 22  WebCore::InspectorController::dispatchMessageFromFrontend(WTF::String const&) + 47 (InspectorController.cpp:381)
> 23  WebCore::InspectorBackendDispatchTask::timerFired() + 158 (InspectorFrontendClientLocal.cpp:103)
> ...
> 
> Thread 34 Crashed:: WebCore: Worker
> 0   WTF::Atomic<unsigned char>::compareExchangeWeak(unsigned char, unsigned char, std::__1::memory_order) + 367 (atomic:879)
> 1   WTF::LockBase::lock() + 37 (Lock.h:51)
> 2   void WTF::addIterator<JSC::CodeBlock*, JSC::CodeBlock*, WTF::IdentityExtractor, WTF::PtrHash<JSC::CodeBlock*>, WTF::HashTraits<JSC::CodeBlock*>, WTF::HashTraits<JSC::CodeBlock*> >(WTF::HashTable<JSC::CodeBlock*, JSC::CodeBlock*, WTF::IdentityExtractor, WTF::PtrHash<JSC::CodeBlock*>, WTF::HashTraits<JSC::CodeBlock*>, WTF::HashTraits<JSC::CodeBlock*> > const*, WTF::HashTableConstIterator<JSC::CodeBlock*, JSC::CodeBlock*, WTF::IdentityExtractor, WTF::PtrHash<JSC::CodeBlock*>, WTF::HashTraits<JSC::CodeBlock*>, WTF::HashTraits<JSC::CodeBlock*> >*) + 162 (HashTable.h:1386)
> 3   WTF::HashTableConstIterator<JSC::CodeBlock*, JSC::CodeBlock*, WTF::IdentityExtractor, WTF::PtrHash<JSC::CodeBlock*>, WTF::HashTraits<JSC::CodeBlock*>, WTF::HashTraits<JSC::CodeBlock*> >::HashTableConstIterator(WTF::HashTable<JSC::CodeBlock*, JSC::CodeBlock*, WTF::IdentityExtractor, WTF::PtrHash<JSC::CodeBlock*>, WTF::HashTraits<JSC::CodeBlock*>, WTF::HashTraits<JSC::CodeBlock*> > const*, JSC::CodeBlock* const*, JSC::CodeBlock* const*) + 59 (HashTable.h:128)
> 4   WTF::HashTableConstIterator<JSC::CodeBlock*, JSC::CodeBlock*, WTF::IdentityExtractor, WTF::PtrHash<JSC::CodeBlock*>, WTF::HashTraits<JSC::CodeBlock*>, WTF::HashTraits<JSC::CodeBlock*> >::HashTableConstIterator(WTF::HashTable<JSC::CodeBlock*, JSC::CodeBlock*, WTF::IdentityExtractor, WTF::PtrHash<JSC::CodeBlock*>, WTF::HashTraits<JSC::CodeBlock*>, WTF::HashTraits<JSC::CodeBlock*> > const*, JSC::CodeBlock* const*, JSC::CodeBlock* const*) + 45 (HashTable.h:129)
> 5   WTF::HashTable<JSC::CodeBlock*, JSC::CodeBlock*, WTF::IdentityExtractor, WTF::PtrHash<JSC::CodeBlock*>, WTF::HashTraits<JSC::CodeBlock*>, WTF::HashTraits<JSC::CodeBlock*> >::makeConstIterator(JSC::CodeBlock**) const + 64 (HashTable.h:463)
> 6   WTF::HashTable<JSC::CodeBlock*, JSC::CodeBlock*, WTF::IdentityExtractor, WTF::PtrHash<JSC::CodeBlock*>, WTF::HashTraits<JSC::CodeBlock*>, WTF::HashTraits<JSC::CodeBlock*> >::begin() const + 89 (HashTable.h:376)
> 7   WTF::HashSet<JSC::CodeBlock*, WTF::PtrHash<JSC::CodeBlock*>, WTF::HashTraits<JSC::CodeBlock*> >::begin() const + 39 (HashSet.h:173)
> 8   void JSC::CodeBlockSet::iterate<JSC::Debugger::ClearCodeBlockDebuggerRequestsFunctor>(JSC::Debugger::ClearCodeBlockDebuggerRequestsFunctor&) + 67 (CodeBlockSet.h:83)
> 9   void JSC::Heap::forEachCodeBlock<JSC::Debugger::ClearCodeBlockDebuggerRequestsFunctor>(JSC::Debugger::ClearCodeBlockDebuggerRequestsFunctor&) + 63 (HeapInlines.h:155)
> 10  JSC::Debugger::clearBreakpoints() + 100 (Debugger.cpp:480)
> 11  Inspector::ScriptDebugServer::clearBreakpoints() + 31 (ScriptDebugServer.cpp:126)
> 12  Inspector::InspectorDebuggerAgent::clearDebuggerBreakpointState() + 32 (InspectorDebuggerAgent.cpp:786)
> 13  Inspector::InspectorDebuggerAgent::clearInspectorBreakpointState() + 189 (InspectorDebuggerAgent.cpp:781)
> 14  Inspector::InspectorDebuggerAgent::disable(bool) + 86 (InspectorDebuggerAgent.cpp:107)
> 15  WebCore::WebDebuggerAgent::disable(bool) + 47 (WebDebuggerAgent.cpp:49)
> 16  Inspector::InspectorDebuggerAgent::willDestroyFrontendAndBackend(Inspector::DisconnectReason) + 54 (InspectorDebuggerAgent.cpp:83)
> 17  Inspector::AgentRegistry::willDestroyFrontendAndBackend(Inspector::DisconnectReason) + 117 (InspectorAgentRegistry.cpp:68)
> 18  WebCore::WorkerInspectorController::disconnectFrontend(Inspector::DisconnectReason) + 248 (WorkerInspectorController.cpp:163)
> 19  WebCore::WorkerInspectorController::workerGlobalScopeDestroyed() + 114 (WorkerInspectorController.cpp:145)
> 20  WebCore::WorkerGlobalScope::~WorkerGlobalScope() + 214 (WorkerGlobalScope.cpp:87)
> 21  WebCore::DedicatedWorkerGlobalScope::~DedicatedWorkerGlobalScope() + 21 (DedicatedWorkerGlobalScope.cpp:56)
> 22  WebCore::DedicatedWorkerGlobalScope::~DedicatedWorkerGlobalScope() + 21 (DedicatedWorkerGlobalScope.cpp:56)
> 23  WebCore::DedicatedWorkerGlobalScope::~DedicatedWorkerGlobalScope() + 25 (DedicatedWorkerGlobalScope.cpp:55)
> 24  WTF::RefCounted<WebCore::WorkerGlobalScope>::deref() + 83 (RefCounted.h:146)
> 25  void WTF::derefIfNotNull<WebCore::WorkerGlobalScope>(WebCore::WorkerGlobalScope*) + 58 (PassRefPtr.h:43)
> 26  WTF::RefPtr<WebCore::WorkerGlobalScope>::operator=(std::nullptr_t) + 55 (RefPtr.h:142)
> 27  WebCore::WorkerThread::workerThread() + 1312 (WorkerThread.cpp:168)
> 28  WebCore::WorkerThread::workerThreadStart(void*) + 21 (WorkerThread.cpp:129)
> ...

[Radar WebKit Bug Importer]

<rdar://problem/23753808>

[Joseph Pecoraro]

I wonder if this is a multi-threading issue. The crash is always on the Worker thread iterating the Heap and sometimes (see crash reports) the main thread is evaluating JavaScript. In once case even in JSC::Heap::deleteAllCodeBlocks. I don't see any guarded access to the heap here.

[Timothy Hatcher]

I am pretty sure worker code was removed recently.

[Joseph Pecoraro]

It was. I'll close this out.