Bug 162483 – DumpRenderTree crashed in com.apple.WebCore: WTF::Optional<WebCore::FetchBodyOwner::BlobLoader>::operator bool const + 12

• Status: RESOLVED
• Resolution: FIXED
• Component: WebCore Misc.

[youenn fablet]

Crash log is:
0   com.apple.WebCore             	0x00000001160d269c WTF::Optional<WebCore::FetchBodyOwner::BlobLoader>::operator bool() const + 12
1   com.apple.WebCore             	0x00000001160d14a5 WebCore::FetchBodyOwner::stop() + 213
2   com.apple.WebCore             	0x00000001179428c2 WebCore::ScriptExecutionContext::stopActiveDOMObjects() + 290
3   com.apple.WebCore             	0x0000000118097da9 WebCore::WorkerThread::stop()::$_0::operator()(WebCore::ScriptExecutionContext&) const + 57
4   com.apple.WebCore             	0x0000000118097d47 WTF::Function<void (WebCore::ScriptExecutionContext&)>::CallableWrapper<WebCore::WorkerThread::stop()::$_0>::call(WebCore::ScriptExecutionContext&) + 55
5   com.apple.WebCore             	0x0000000115ef5b57 WTF::Function<void (WebCore::ScriptExecutionContext&)>::operator()(WebCore::ScriptExecutionContext&) const + 119
6   com.apple.WebCore             	0x0000000115ee59fd WebCore::ScriptExecutionContext::Task::performTask(WebCore::ScriptExecutionContext&) + 29
7   com.apple.WebCore             	0x000000011808f6c9 WebCore::WorkerRunLoop::Task::performTask(WebCore::WorkerRunLoop const&, WebCore::WorkerGlobalScope*) + 105
8   com.apple.WebCore             	0x000000011808f4e8 WebCore::WorkerRunLoop::runCleanupTasks(WebCore::WorkerGlobalScope*) + 408
9   com.apple.WebCore             	0x000000011808ed63 WebCore::WorkerRunLoop::run(WebCore::WorkerGlobalScope*) + 115
10  com.apple.WebCore             	0x0000000118097455 WebCore::WorkerThread::runEventLoop() + 53
11  com.apple.WebCore             	0x0000000115e4d2c9 WebCore::DedicatedWorkerThread::runEventLoop() + 89
12  com.apple.WebCore             	0x0000000118097377 WebCore::WorkerThread::workerThread() + 1127
13  com.apple.WebCore             	0x0000000118096f05 WebCore::WorkerThread::workerThreadStart(void*) + 21

[youenn fablet]

Created attachment 289671 [details]
Patch

[Alexey Proskuryakov]

Is this rdar://problem/28438651?

[youenn fablet]

(In reply to comment #2)
> Is this rdar://problem/28438651?

Yes

[youenn fablet]

Comment on attachment 289671 [details]
Patch

I see three options here:
1. Remove the assert (which ensures that we correctly unset pending request)
2. Protect the body owner but this is not very useful in release
3. Protect the body owner in debug mode but that makes a difference with release, which may be also annoying.

I chose option 3 but could also go with option 1

[youenn fablet]

Created attachment 289944 [details]
Patch

[youenn fablet]

Created attachment 290081 [details]
Patch

[Alex Christensen]

Comment on attachment 290081 [details]
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=290081&action=review

> Source/WebCore/Modules/fetch/FetchBodyOwner.cpp:61
> +        ASSERT(isUniqueReference || !m_blobLoader);

ASSERT_UNUSED would make this cleaner.

[youenn fablet]

Created attachment 290307 [details]
Patch for landing

[WebKit Commit Bot]

Comment on attachment 290307 [details]
Patch for landing

Rejecting attachment 290307 [details] from commit-queue.

Failed to run "['/Volumes/Data/EWS/WebKit/Tools/Scripts/webkit-patch', '--status-host=webkit-queues.webkit.org', '--bot-id=webkit-cq-03', 'build', '--no-clean', '--no-update', '--build-style=release', '--port=mac']" exit_code: 2 cwd: /Volumes/Data/EWS/WebKit

Last 500 characters of output:
_64/FloatPolygon.dia -c /Volumes/Data/EWS/WebKit/Source/WebCore/platform/graphics/FloatPolygon.cpp -o /Volumes/Data/EWS/WebKit/WebKitBuild/WebCore.build/Release/WebCore.build/Objects-normal/x86_64/FloatPolygon.o

** BUILD FAILED **


The following build commands failed:
	CompileC /Volumes/Data/EWS/WebKit/WebKitBuild/WebCore.build/Release/WebCore.build/Objects-normal/x86_64/FetchBodyOwner.o Modules/fetch/FetchBodyOwner.cpp normal x86_64 c++ com.apple.compilers.llvm.clang.1_0.compiler
(1 failure)

Full output: http://webkit-queues.webkit.org/results/2173332

[youenn fablet]

Created attachment 290309 [details]
Patch for landing

[WebKit Commit Bot]

Comment on attachment 290309 [details]
Patch for landing

Clearing flags on attachment: 290309

Committed r206633: <http://trac.webkit.org/changeset/206633>

[WebKit Commit Bot]

All reviewed patches have been landed.  Closing bug.

[David Kilzer (:ddkilzer)]

<rdar://problem/28438651>