This is a regression from within the past month or so. It happens quite often. I need to get a better backtrace. ASSERTION FAILED: The string being removed is atomic in the string table of an other thread! iterator != atomicStringTable.end() ../../Source/WTF/wtf/text/AtomicStringImpl.cpp(453) : static void WTF::AtomicStringImpl::remove(WTF::AtomicStringImpl*) 1 0x7fbf665d1d5c /home/mcatanzaro/src/jhbuild/install/lib/libjavascriptcoregtk-4.0.so.18(WTFCrash+0x1e) [0x7fbf665d1d5c] 2 0x7fbf665ffc4e /home/mcatanzaro/src/jhbuild/install/lib/libjavascriptcoregtk-4.0.so.18(_ZN3WTF16AtomicStringImpl6removeEPS0_+0xfe) [0x7fbf665ffc4e] 3 0x7fbf6660a0ad /home/mcatanzaro/src/jhbuild/install/lib/libjavascriptcoregtk-4.0.so.18(_ZN3WTF10StringImplD1Ev+0x9b) [0x7fbf6660a0ad] 4 0x7fbf6660a200 /home/mcatanzaro/src/jhbuild/install/lib/libjavascriptcoregtk-4.0.so.18(_ZN3WTF10StringImpl7destroyEPS0_+0x18) [0x7fbf6660a200] 5 0x7fbf6c1c3666 /home/mcatanzaro/src/jhbuild/install/lib/libwebkit2gtk-4.0.so.37(_ZN3WTF10StringImpl5derefEv+0x2a) [0x7fbf6c1c3666] 6 0x7fbf6c1c6056 /home/mcatanzaro/src/jhbuild/install/lib/libwebkit2gtk-4.0.so.37(_ZN3WTF14derefIfNotNullINS_10StringImplEEEvPT_+0x28) [0x7fbf6c1c6056] 7 0x7fbf6c1c440f /home/mcatanzaro/src/jhbuild/install/lib/libwebkit2gtk-4.0.so.37(_ZN3WTF6RefPtrINS_10StringImplEED1Ev+0x2f) [0x7fbf6c1c440f] 8 0x7fbf6c1c3742 /home/mcatanzaro/src/jhbuild/install/lib/libwebkit2gtk-4.0.so.37(_ZN3WTF6StringD1Ev+0x18) [0x7fbf6c1c3742] 9 0x7fbf6c1e0a1a /home/mcatanzaro/src/jhbuild/install/lib/libwebkit2gtk-4.0.so.37(_ZN3WTF12AtomicStringD1Ev+0x18) [0x7fbf6c1e0a1a] 10 0x7fbf5998e1e8 /lib64/libc.so.6(+0x391e8) [0x7fbf5998e1e8] 11 0x7fbf5998e235 /lib64/libc.so.6(+0x39235) [0x7fbf5998e235] 12 0x7fbf6c1f0337 /home/mcatanzaro/src/jhbuild/install/lib/libwebkit2gtk-4.0.so.37(_ZN3IPC10Connection24didFailToSendSyncMessageEv+0x25) [0x7fbf6c1f0337] 13 0x7fbf6c1edcb1 /home/mcatanzaro/src/jhbuild/install/lib/libwebkit2gtk-4.0.so.37(_ZN3IPC10Connection15sendSyncMessageEmSt10unique_ptrINS_7EncoderESt14default_deleteIS2_EENSt6chrono8durationIlSt5ratioILl1ELl1000EEEEN3WTF9OptionSetINS_14SendSyncOptionEEE+0xe5) [0x7fbf6c1edcb1] 14 0x7fbf6c48deb4 /home/mcatanzaro/src/jhbuild/install/lib/libwebkit2gtk-4.0.so.37(_ZN3IPC10Connection8sendSyncIN8Messages15WebProcessProxy15ShouldTerminateEEEbOT_ONS5_5ReplyEmNSt6chrono8durationIlSt5ratioILl1ELl1000EEEEN3WTF9OptionSetINS_14SendSyncOptionEEE+0x120) [0x7fbf6c48deb4] 15 0x7fbf6c484b24 /home/mcatanzaro/src/jhbuild/install/lib/libwebkit2gtk-4.0.so.37(_ZN6WebKit10WebProcess15shouldTerminateEv+0xc0) [0x7fbf6c484b24] 16 0x7fbf6c22694b /home/mcatanzaro/src/jhbuild/install/lib/libwebkit2gtk-4.0.so.37(_ZN6WebKit12ChildProcess21terminationTimerFiredEv+0x23) [0x7fbf6c22694b] 17 0x7fbf6c2268c6 /home/mcatanzaro/src/jhbuild/install/lib/libwebkit2gtk-4.0.so.37(_ZN6WebKit12ChildProcess17enableTerminationEv+0x80) [0x7fbf6c2268c6] 18 0x7fbf6c484a60 /home/mcatanzaro/src/jhbuild/install/lib/libwebkit2gtk-4.0.so.37(_ZN6WebKit10WebProcess13removeWebPageEm+0x8e) [0x7fbf6c484a60] 19 0x7fbf6c5f645c /home/mcatanzaro/src/jhbuild/install/lib/libwebkit2gtk-4.0.so.37(_ZN6WebKit7WebPage5closeEv+0x46a) [0x7fbf6c5f645c] 20 0x7fbf6c962d77 /home/mcatanzaro/src/jhbuild/install/lib/libwebkit2gtk-4.0.so.37(_ZN3IPC22callMemberFunctionImplIN6WebKit7WebPageEMS2_FvvESt5tupleIJEEJEEEvPT_T0_OT1_St16integer_sequenceImJXspT2_EEE+0x65) [0x7fbf6c962d77] 21 0x7fbf6c961478 /home/mcatanzaro/src/jhbuild/install/lib/libwebkit2gtk-4.0.so.37(_ZN3IPC18callMemberFunctionIN6WebKit7WebPageEMS2_FvvESt5tupleIJEESt16integer_sequenceImJEEEEvOT1_PT_T0_+0x41) [0x7fbf6c961478] 22 0x7fbf6c95d358 /home/mcatanzaro/src/jhbuild/install/lib/libwebkit2gtk-4.0.so.37(_ZN3IPC13handleMessageIN8Messages7WebPage5CloseEN6WebKit7WebPageEMS5_FvvEEEvRNS_7DecoderEPT0_T1_+0x8f) [0x7fbf6c95d358] 23 0x7fbf6c95767a /home/mcatanzaro/src/jhbuild/install/lib/libwebkit2gtk-4.0.so.37(_ZN6WebKit7WebPage24didReceiveWebPageMessageERN3IPC10ConnectionERNS1_7DecoderE+0x1d9c) [0x7fbf6c95767a] 24 0x7fbf6c601b62 /home/mcatanzaro/src/jhbuild/install/lib/libwebkit2gtk-4.0.so.37(_ZN6WebKit7WebPage17didReceiveMessageERN3IPC10ConnectionERNS1_7DecoderE+0x240) [0x7fbf6c601b62] 25 0x7fbf6c20b325 /home/mcatanzaro/src/jhbuild/install/lib/libwebkit2gtk-4.0.so.37(_ZN3IPC18MessageReceiverMap15dispatchMessageERNS_10ConnectionERNS_7DecoderE+0x125) [0x7fbf6c20b325] 26 0x7fbf6c484ca4 /home/mcatanzaro/src/jhbuild/install/lib/libwebkit2gtk-4.0.so.37(_ZN6WebKit10WebProcess17didReceiveMessageERN3IPC10ConnectionERNS1_7DecoderE+0x4c) [0x7fbf6c484ca4] 27 0x7fbf6c1f04ba /home/mcatanzaro/src/jhbuild/install/lib/libwebkit2gtk-4.0.so.37(_ZN3IPC10Connection15dispatchMessageERNS_7DecoderE+0x3a) [0x7fbf6c1f04ba] 28 0x7fbf6c1f0624 /home/mcatanzaro/src/jhbuild/install/lib/libwebkit2gtk-4.0.so.37(_ZN3IPC10Connection15dispatchMessageESt10unique_ptrINS_7DecoderESt14default_deleteIS2_EE+0x166) [0x7fbf6c1f0624] 29 0x7fbf6c1f0816 /home/mcatanzaro/src/jhbuild/install/lib/libwebkit2gtk-4.0.so.37(_ZN3IPC10Connection18dispatchOneMessageEv+0xc8) [0x7fbf6c1f0816] 30 0x7fbf6c1f035a /home/mcatanzaro/src/jhbuild/install/lib/libwebkit2gtk-4.0.so.37(+0x4a7135a) [0x7fbf6c1f035a] 31 0x7fbf6c1f6f2e /home/mcatanzaro/src/jhbuild/install/lib/libwebkit2gtk-4.0.so.37(+0x4a77f2e) [0x7fbf6c1f6f2e]
I added a print statement: if (iterator == atomicStringTable.end()) WTFLogAlways("******%s********", string->utf8(LenientConversion).data()); ASSERT_WITH_MESSAGE(iterator != atomicStringTable.end(), "The string being removed is atomic in the string table of an other thread!"); The next time I saw the crash, the string printed was "u_projectionMatrix" That's a local variable in WebCore/platform/graphics/texmap/TextureMapperShaderProgram.cpp. I have no clue what this file is doing, but it looks like some serious black magic.
(In reply to comment #1) > The next time I saw the crash, the string printed was "u_projectionMatrix" Looks like it's always this string.
On what thread is the assertion occurring? These AtomicString objects should be constructed on the composition thread, and added to the AtomicString table for that thread. I assume the destruction of these is happening on the main thread, via at-exit handlers. Using static NeverDestroyed<AtomicString> objects would probably fix this.
(In reply to comment #3) > On what thread is the assertion occurring? The main thread. > These AtomicString objects should be constructed on the composition thread, > and added to the AtomicString table for that thread. Sad. > I assume the destruction of these is happening on the main thread, via > at-exit handlers. Yes. > Using static NeverDestroyed<AtomicString> objects would probably fix this. OK, probably!
Created attachment 288692 [details] Patch
Comment on attachment 288692 [details] Patch View in context: https://bugs.webkit.org/attachment.cgi?id=288692&action=review > Source/WebCore/platform/graphics/texmap/TextureMapperShaderProgram.h:35 > +#define TEXMAP_DECLARE_VARIABLE(Accessor, Name, Type) GC3Duint Accessor##Location() { static NeverDestroyed<const AtomicString> name(Name); return getLocation(name.get(), Type); } AtomicString::ConstructFromLiteral should be passed as the second argument to the constructor. I think all the strings used with the macro are literals.
Committed r206061: <http://trac.webkit.org/changeset/206061>
*** Bug 164919 has been marked as a duplicate of this bug. ***