156737 – Calling then on promise in Workers may crash in Debug builds

RESOLVED FIXED 156737

Calling then on promise in Workers may crash in Debug builds

https://bugs.webkit.org/show_bug.cgi?id=156737

Summary Calling then on promise in Workers may crash in Debug builds

youenn fablet

Reported 2016-04-19 02:42:37 PDT

After studying bug 153781, it seems that the test causing crashes in Worker is the last one in LayoutTests/imported/w3c/web-platform-tests/streams/readable-streams/count-queuing-strategy-integration.js. It basically does a lot of promise.then(...).then(...).

Attachments
Unskipping fetch api debug tests (3.95 KB, patch) 2016-09-01 00:57 PDT, youenn fablet	no flags	Details Formatted Diff Diff
View All Add attachment proposed patch, testcase, etc.

youenn fablet

Comment 1 2016-04-19 02:43:23 PDT

The following test sample crashes sometimes (not very often) on Mac and GTK when run through rwt with the following options "--debug -f --iterations=1000" <!DOCTYPE html> <meta charset="utf-8"> <div id="title">Testing promise chaining in workers. This test passes if not crashing.</div> <div id="log"></div> <script> var worker = new Worker(window.URL.createObjectURL(new Blob( ["Promise.resolve().then();\n", "postMessage('done');"], { "type" : "text\/javascript" }))); worker.onmessage = function() { document.getElementById("log").innerHTML = "PASS" if (window.testRunner) testRunner.notifyDone(); }; if (window.testRunner) { testRunner.dumpAsText(); testRunner.waitUntilDone(); } </script> The log is similar to the one in bug 153781: For GTK: STDERR: ASSERTION FAILED: !exec->hadException() STDERR: ../../Source/WebCore/bindings/js/JSDOMGlobalObjectTask.cpp(67) : void WebCore::JSGlobalObjectCallback::call() STDERR: 1 0x7f2202ca87ad /localHome/youenn/WebKit/WebKitBuild/Debug/lib/libjavascriptcoregtk-4.0.so.18(WTFCrash+0x1e) [0x7f2202ca87ad] STDERR: 2 0x7f22094c8e4d /localHome/youenn/WebKit/WebKitBuild/Debug/lib/libwebkit2gtk-4.0.so.37(WebCore::JSGlobalObjectCallback::call()+0x143) [0x7f22094c8e4d] STDERR: 3 0x7f22094c8680 /localHome/youenn/WebKit/WebKitBuild/Debug/lib/libwebkit2gtk-4.0.so.37(+0x5680680) [0x7f22094c8680] STDERR: 4 0x7f22094c89b4 /localHome/youenn/WebKit/WebKitBuild/Debug/lib/libwebkit2gtk-4.0.so.37(+0x56809b4) [0x7f22094c89b4] STDERR: 5 0x7f22093e5c27 /localHome/youenn/WebKit/WebKitBuild/Debug/lib/libwebkit2gtk-4.0.so.37(std::function<void (WebCore::ScriptExecutionContext&)>::operator()(WebCore::ScriptExecutionContext&) const+0x49) [0x7f22093e5c27] STDERR: 6 0x7f22093e5b6f /localHome/youenn/WebKit/WebKitBuild/Debug/lib/libwebkit2gtk-4.0.so.37(WebCore::ScriptExecutionContext::Task::performTask(WebCore::ScriptExecutionContext&)+0x23) [0x7f22093e5b6f] STDERR: 7 0x7f220a61b3fb /localHome/youenn/WebKit/WebKitBuild/Debug/lib/libwebkit2gtk-4.0.so.37(WebCore::WorkerRunLoop::Task::performTask(WebCore::WorkerRunLoop const&, WebCore::WorkerGlobalScope*)+0x6d) [0x7f220a61b3fb] For MAC: ASSERTION FAILED: !exec->hadException() /Users/youenn/Documents/WebKit/Source/WebCore/bindings/js/JSDOMGlobalObjectTask.cpp(91) : void WebCore::JSGlobalObjectCallback::call() 1 0x11209c821 WTFCrash 2 0x1189d27ac WebCore::JSGlobalObjectCallback::call() 3 0x1189cef71 WebCore::JSGlobalObjectTask::JSGlobalObjectTask(WebCore::JSDOMGlobalObject*, WTF::PassRefPtr<JSC::Microtask>)::$_0::operator()(WebCore::ScriptExecutionContext&) const 4 0x1189cef3d _ZNSt3__128__invoke_void_return_wrapperIvE6__callIJRZN7WebCore18JSGlobalObjectTaskC1EPNS3_17JSDOMGlobalObjectEN3WTF10PassRefPtrIN3JSC9MicrotaskEEEE3$_0RNS3_22ScriptExecutionContextEEEEvDpOT_ 5 0x1189ceda9 std::__1::__function::__func<WebCore::JSGlobalObjectTask::JSGlobalObjectTask(WebCore::JSDOMGlobalObject*, WTF::PassRefPtr<JSC::Microtask>)::$_0, std::__1::allocator<WebCore::JSGlobalObjectTask::JSGlobalObjectTask(WebCore::JSDOMGlobalObject*, WTF::PassRefPtr<JSC::Microtask>)::$_0>, void (WebCore::ScriptExecutionContext&)>::operator()(WebCore::ScriptExecutionContext&) 6 0x116f98b08 std::__1::function<void (WebCore::ScriptExecutionContext&)>::operator()(WebCore::ScriptExecutionContext&) const

youenn fablet

Comment 2 2016-04-19 02:46:03 PDT

It appears that the job executed is the call of "promiseReactionJob", a JS built-in function defined in Source/JavaScriptCore/builtin/PromiseOperations.js Any idea on the issue?

youenn fablet

Comment 3 2016-05-10 06:52:07 PDT

Digging a little bit further, the issue seems related to the web worker being asked to stop while the web worker is still wanting to run promiseReactionJob. Requesting the web worker triggers the watch dog. An exception is then sometimes hit either just before executing promiseReactionJob (in Interpreter::executeCall) or as part of op_watchdog.

youenn fablet

Comment 4 2016-08-05 05:35:37 PDT

I am not able to reproduce this error anymore. Related to promises and Workers, I am sometimes hitting the following assertion: 6 ASSERTION FAILED: promise.inherits(JSPromise::info()) 7 /Users/youenn/Apple/Safari/OpenSource/Source/JavaScriptCore/runtime/JSPromiseDeferred.cpp(63) : static JSC::JSPromiseDeferred *JSC::JSPromiseDeferred::create(JSC::ExecState *, JSC::JSGlobalObject *) 8 1 0x109dd01ad WTFCrash 9 2 0x10992b97e JSC::JSPromiseDeferred::create(JSC::ExecState*, JSC::JSGlobalObject*) 10 3 0x10d19bf95 WebCore::callPromiseFunction(JSC::ExecState&, long long (*)(JSC::ExecState*, JSC::JSPromiseDeferred*)) 11 4 0x10d87f0bc WebCore::jsWorkerGlobalScopePrototypeFunctionFetchRequest(JSC::ExecState*) 12 5 0x5be8827ae8c8 13 6 0x5be8828a28e7 14 7 0x1099f334b llint_entry 15 8 0x5be8828968b3 16 9 0x1099ec2ce vmEntryToJavaScript 17 10 0x1097df7d7 JSC::JITCode::execute(JSC::VM*, JSC::ProtoCallFrame*) 18 11 0x109766d37 JSC::Interpreter::executeCall(JSC::ExecState*, JSC::JSObject*, JSC::CallType, JSC::CallData const&, JSC::JSValue, JSC::ArgList const&) 19 12 0x109022838 JSC::call(JSC::ExecState*, JSC::JSValue, JSC::CallType, JSC::CallData const&, JSC::JSValue, JSC::ArgList const&) 20 13 0x109022a1b JSC::profiledCall(JSC::ExecState*, JSC::ProfilingReason, JSC::JSValue, JSC::CallType, JSC::CallData const&, JSC::JSValue, JSC::ArgList const&) 21 14 0x1098ce40b JSC::JSJobMicrotask::run(JSC::ExecState*) 22 15 0x10d2aba77 WebCore::JSGlobalObjectCallback::call() 23 16 0x10d2ab931 WebCore::JSGlobalObjectTask::JSGlobalObjectTask(WebCore::JSDOMGlobalObject*, WTF::Ref<JSC::Microtask>&&)::$_0::operator()(WebCore::ScriptExecutionContext&) const 24 17 0x10d2ab7d4 WTF::Function<void (WebCore::ScriptExecutionContext&)>::CallableWrapper<WebCore::JSGlobalObjectTask::JSGlobalObjectTask(WebCore::JSDOMGlobalObject*, WTF::Ref<JSC::Microtask>&&)::$_0>::call(WebCore::ScriptExecutionContext&) 25 18 0x10c87b551 WTF::Function<void (WebCore::ScriptExecutionContext&)>::operator()(WebCore::ScriptExecutionContext&) const 26 19 0x10c8669fd WebCore::ScriptExecutionContext::Task::performTask(WebCore::ScriptExecutionContext&) 27 20 0x10e7e0619 WebCore::WorkerRunLoop::Task::performTask(WebCore::WorkerRunLoop const&, WebCore::WorkerGlobalScope*) 28 21 0x10e7df78b WebCore::WorkerRunLoop::runInMode(WebCore::WorkerGlobalScope*, WebCore::ModePredicate const&, WebCore::WorkerRunLoop::WaitMode) 29 22 0x10e7df2f6 WebCore::WorkerRunLoop::run(WebCore::WorkerGlobalScope*) 30 23 0x10e7e7930 WebCore::WorkerThread::runEventLoop() 31 24 0x10c7d82a8 WebCore::DedicatedWorkerThread::runEventLoop() 32 25 0x10e7e774d WebCore::WorkerThread::workerThread() 33 26 0x10e7e72f5 WebCore::WorkerThread::workerThreadStart(void*) 34 27 0x109e397e9 WTF::createThread(void (*)(void*), void*, char const*)::$_0::operator()() const 35 28 0x109e397bd void std::__1::__invoke_void_return_wrapper<void>::__call<WTF::createThread(void (*)(void*), void*, char const*)::$_0&>(WTF::createThread(void (*)(void*), void*, char const*)::$_0&&&) 36 29 0x109e39769 std::__1::__function::__func<WTF::createThread(void (*)(void*), void*, char const*)::$_0, std::__1::allocator<WTF::createThread(void (*)(void*), void*, char const*)::$_0>, void ()>::operator()() 37 30 0x109448faa std::__1::function<void ()>::operator()() const 38 31 0x109e38407 WTF::threadEntryPoint(void*) 39 LEAK: 1 WebProcessPool 40 LEAK: 1 WebPageProxy

youenn fablet

Comment 5 2016-09-01 00:51:26 PDT

It might be the case that https://bugs.webkit.org/show_bug.cgi?id=161426 fixed the issue. I will try reenabling fetch tests on debug bots.

youenn fablet

Comment 6 2016-09-01 00:57:09 PDT

Created attachment 287608 [details] Unskipping fetch api debug tests

WebKit Commit Bot

Comment 7 2016-09-01 01:28:36 PDT

Comment on attachment 287608 [details] Unskipping fetch api debug tests Clearing flags on attachment: 287608 Committed r205284: <http://trac.webkit.org/changeset/205284>

WebKit Commit Bot

Comment 8 2016-09-01 01:28:41 PDT

All reviewed patches have been landed. Closing bug.

Note You need to log in before you can comment on or make changes to this bug.

Status RESOLVED

Resolution FIXED

Priority P2

Severity Normal

Classification Unclassified

Version WebKit Nightly Build

Hardware Unspecified

OS Unspecified

Product WebKit

Component WebCore Misc.

Assignee

youenn fablet

Reported

2016-04-19 02:42 PDT

Modified

2016-09-01 01:28 PDT History

CC List

10 users Show

URL

Keywords

Depends on

Blocks