Bug 171091 - Regression(r215229): ASSERTION FAILED: !m_scriptHash || m_scriptHash == m_script.impl()->hash()
Summary: Regression(r215229): ASSERTION FAILED: !m_scriptHash || m_scriptHash == m_scr...
Status: RESOLVED FIXED
Alias: None
Product: WebKit
Classification: Unclassified
Component: Page Loading (show other bugs)
Version: WebKit Nightly Build
Hardware: Unspecified Unspecified
: P2 Normal
Assignee: Chris Dumez
URL:
Keywords: InRadar
: 172094 172506 (view as bug list)
Depends on:
Blocks: 170122
  Show dependency treegraph
 
Reported: 2017-04-20 17:07 PDT by Ryan Haddad
Modified: 2017-05-23 14:06 PDT (History)
15 users (show)

See Also:


Attachments
Patch (6.29 KB, patch)
2017-05-23 10:40 PDT, Chris Dumez
no flags Details | Formatted Diff | Diff
Archive of layout-test-results from ews100 for mac-elcapitan (1.63 MB, application/zip)
2017-05-23 11:13 PDT, Build Bot
no flags Details
Archive of layout-test-results from ews106 for mac-elcapitan-wk2 (1.71 MB, application/zip)
2017-05-23 11:19 PDT, Build Bot
no flags Details
Archive of layout-test-results from ews115 for mac-elcapitan (2.19 MB, application/zip)
2017-05-23 12:01 PDT, Build Bot
no flags Details
Archive of layout-test-results from ews122 for ios-simulator-wk2 (7.43 MB, application/zip)
2017-05-23 12:10 PDT, Build Bot
no flags Details
Patch (7.63 KB, patch)
2017-05-23 12:49 PDT, Chris Dumez
no flags Details | Formatted Diff | Diff

Note You need to log in before you can comment on or make changes to this bug.
Description Ryan Haddad 2017-04-20 17:07:42 PDT
ASSERTION FAILED: !m_scriptHash || m_scriptHash == m_script.impl()->hash()
/Volumes/Data/slave/elcapitan-debug/build/Source/WebCore/loader/cache/CachedScript.cpp(91) : WTF::StringView WebCore::CachedScript::script()
1   0x11ac3f4f0 WTFCrash
2   0x10db1c730 WebCore::CachedScript::script()
3   0x10f686d86 WebCore::CachedScriptSourceProvider::source() const
4   0x119ce38ef JSC::SourceProvider::getRange(int, int) const
5   0x119ce3a41 JSC::UnlinkedSourceCode::view() const
6   0x119d1622c JSC::SourceCodeKey::string() const
7   0x119d160cc JSC::SourceCodeKey::operator==(JSC::SourceCodeKey const&) const
8   0x119d15fdd JSC::SourceCodeKey::Hash::equal(JSC::SourceCodeKey const&, JSC::SourceCodeKey const&)
9   0x119d15e0d bool WTF::IdentityHashTranslator<WTF::HashMap<JSC::SourceCodeKey, JSC::SourceCodeValue, JSC::SourceCodeKey::Hash, JSC::SourceCodeKey::HashTraits, WTF::HashTraits<JSC::SourceCodeValue> >::KeyValuePairTraits, JSC::SourceCodeKey::Hash>::equal<JSC::SourceCodeKey, JSC::SourceCodeKey>(JSC::SourceCodeKey const&, JSC::SourceCodeKey const&)
10  0x119d15cdc WTF::KeyValuePair<JSC::SourceCodeKey, JSC::SourceCodeValue>* WTF::HashTable<JSC::SourceCodeKey, WTF::KeyValuePair<JSC::SourceCodeKey, JSC::SourceCodeValue>, WTF::KeyValuePairKeyExtractor<WTF::KeyValuePair<JSC::SourceCodeKey, JSC::SourceCodeValue> >, JSC::SourceCodeKey::Hash, WTF::HashMap<JSC::SourceCodeKey, JSC::SourceCodeValue, JSC::SourceCodeKey::Hash, JSC::SourceCodeKey::HashTraits, WTF::HashTraits<JSC::SourceCodeValue> >::KeyValuePairTraits, JSC::SourceCodeKey::HashTraits>::inlineLookup<WTF::IdentityHashTranslator<WTF::HashMap<JSC::SourceCodeKey, JSC::SourceCodeValue, JSC::SourceCodeKey::Hash, JSC::SourceCodeKey::HashTraits, WTF::HashTraits<JSC::SourceCodeValue> >::KeyValuePairTraits, JSC::SourceCodeKey::Hash>, JSC::SourceCodeKey>(JSC::SourceCodeKey const&)
11  0x119d15b9d WTF::KeyValuePair<JSC::SourceCodeKey, JSC::SourceCodeValue>* WTF::HashTable<JSC::SourceCodeKey, WTF::KeyValuePair<JSC::SourceCodeKey, JSC::SourceCodeValue>, WTF::KeyValuePairKeyExtractor<WTF::KeyValuePair<JSC::SourceCodeKey, JSC::SourceCodeValue> >, JSC::SourceCodeKey::Hash, WTF::HashMap<JSC::SourceCodeKey, JSC::SourceCodeValue, JSC::SourceCodeKey::Hash, JSC::SourceCodeKey::HashTraits, WTF::HashTraits<JSC::SourceCodeValue> >::KeyValuePairTraits, JSC::SourceCodeKey::HashTraits>::lookup<WTF::IdentityHashTranslator<WTF::HashMap<JSC::SourceCodeKey, JSC::SourceCodeValue, JSC::SourceCodeKey::Hash, JSC::SourceCodeKey::HashTraits, WTF::HashTraits<JSC::SourceCodeValue> >::KeyValuePairTraits, JSC::SourceCodeKey::Hash>, JSC::SourceCodeKey>(JSC::SourceCodeKey const&)
12  0x119d15aff WTF::HashTableIterator<JSC::SourceCodeKey, WTF::KeyValuePair<JSC::SourceCodeKey, JSC::SourceCodeValue>, WTF::KeyValuePairKeyExtractor<WTF::KeyValuePair<JSC::SourceCodeKey, JSC::SourceCodeValue> >, JSC::SourceCodeKey::Hash, WTF::HashMap<JSC::SourceCodeKey, JSC::SourceCodeValue, JSC::SourceCodeKey::Hash, JSC::SourceCodeKey::HashTraits, WTF::HashTraits<JSC::SourceCodeValue> >::KeyValuePairTraits, JSC::SourceCodeKey::HashTraits> WTF::HashTable<JSC::SourceCodeKey, WTF::KeyValuePair<JSC::SourceCodeKey, JSC::SourceCodeValue>, WTF::KeyValuePairKeyExtractor<WTF::KeyValuePair<JSC::SourceCodeKey, JSC::SourceCodeValue> >, JSC::SourceCodeKey::Hash, WTF::HashMap<JSC::SourceCodeKey, JSC::SourceCodeValue, JSC::SourceCodeKey::Hash, JSC::SourceCodeKey::HashTraits, WTF::HashTraits<JSC::SourceCodeValue> >::KeyValuePairTraits, JSC::SourceCodeKey::HashTraits>::find<WTF::IdentityHashTranslator<WTF::HashMap<JSC::SourceCodeKey, JSC::SourceCodeValue, JSC::SourceCodeKey::Hash, JSC::SourceCodeKey::HashTraits, WTF::HashTraits<JSC::SourceCodeValue> >::KeyValuePairTraits, JSC::SourceCodeKey::Hash>, JSC::SourceCodeKey>(JSC::SourceCodeKey const&)
13  0x119d15a74 WTF::HashTable<JSC::SourceCodeKey, WTF::KeyValuePair<JSC::SourceCodeKey, JSC::SourceCodeValue>, WTF::KeyValuePairKeyExtractor<WTF::KeyValuePair<JSC::SourceCodeKey, JSC::SourceCodeValue> >, JSC::SourceCodeKey::Hash, WTF::HashMap<JSC::SourceCodeKey, JSC::SourceCodeValue, JSC::SourceCodeKey::Hash, JSC::SourceCodeKey::HashTraits, WTF::HashTraits<JSC::SourceCodeValue> >::KeyValuePairTraits, JSC::SourceCodeKey::HashTraits>::find(JSC::SourceCodeKey const&)
14  0x119d1598f WTF::HashMap<JSC::SourceCodeKey, JSC::SourceCodeValue, JSC::SourceCodeKey::Hash, JSC::SourceCodeKey::HashTraits, WTF::HashTraits<JSC::SourceCodeValue> >::find(JSC::SourceCodeKey const&)
15  0x119d14968 JSC::CodeCacheMap::findCacheAndUpdateAge(JSC::SourceCodeKey const&)
16  0x119d13b88 JSC::UnlinkedProgramCodeBlock* JSC::CodeCache::getUnlinkedGlobalCodeBlock<JSC::UnlinkedProgramCodeBlock, JSC::ProgramExecutable>(JSC::VM&, JSC::ProgramExecutable*, JSC::SourceCode const&, JSC::JSParserStrictMode, JSC::JSParserScriptMode, JSC::DebuggerMode, JSC::ParserError&, JSC::EvalContextType)
17  0x119d12d28 JSC::CodeCache::getUnlinkedProgramCodeBlock(JSC::VM&, JSC::ProgramExecutable*, JSC::SourceCode const&, JSC::JSParserStrictMode, JSC::DebuggerMode, JSC::ParserError&)
18  0x11a967789 JSC::ProgramExecutable::initializeGlobalProperties(JSC::VM&, JSC::ExecState*, JSC::JSScope*)
19  0x11a506ed3 JSC::Interpreter::executeProgram(JSC::SourceCode const&, JSC::ExecState*, JSC::JSObject*)
20  0x119d6ebd8 JSC::evaluate(JSC::ExecState*, JSC::SourceCode const&, JSC::JSValue, WTF::NakedPtr<JSC::Exception>&)
21  0x119d6ed20 JSC::profiledEvaluate(JSC::ExecState*, JSC::ProfilingReason, JSC::SourceCode const&, JSC::JSValue, WTF::NakedPtr<JSC::Exception>&)
22  0x10ff1b52b WebCore::JSMainThreadExecState::profiledEvaluate(JSC::ExecState*, JSC::ProfilingReason, JSC::SourceCode const&, JSC::JSValue, WTF::NakedPtr<JSC::Exception>&)
23  0x10ff14b48 WebCore::ScriptController::evaluateInWorld(WebCore::ScriptSourceCode const&, WebCore::DOMWrapperWorld&, WebCore::ExceptionDetails*)
24  0x10ff14c6d WebCore::ScriptController::evaluate(WebCore::ScriptSourceCode const&, WebCore::ExceptionDetails*)
25  0x10ff2afbe WebCore::ScriptElement::executeClassicScript(WebCore::ScriptSourceCode const&)
26  0x10f6855a2 WebCore::LoadableClassicScript::execute(WebCore::ScriptElement&)
27  0x10ff2b393 WebCore::ScriptElement::executeScriptAndDispatchEvent(WebCore::LoadableScript&)
28  0x10ff2b409 WebCore::ScriptElement::executePendingScript(WebCore::PendingScript&)
29  0x10e679974 WebCore::HTMLScriptRunner::executePendingScriptAndDispatchEvent(WebCore::PendingScript&)
30  0x10e67a012 WebCore::HTMLScriptRunner::executeParsingBlockingScripts()
31  0x10e67a179 WebCore::HTMLScriptRunner::executeScriptsWaitingForLoad(WebCore::PendingScript&)

This is seen with LayoutTest imported/w3c/web-platform-tests/dom/ranges/Range-surroundContents.html, but the crash log lists imported/w3c/csswg-test/css-shapes-1/shape-outside/values/shape-outside-shape-notation-000.html as the crashing test.

https://webkit-test-results.webkit.org/dashboards/flakiness_dashboard.html#showAllRuns=true&tests=imported%2Fw3c%2Fweb-platform-tests%2Fdom%2Franges%2FRange-surroundContents.html
Comment 1 Ryan Haddad 2017-04-20 17:15:04 PDT
The earliest crash seen with this test on the flakiness dashboard appears to be Apr 13 01:25:20 2017 @ r215314

https://build.webkit.org/builders/Apple%20Sierra%20Debug%20WK2%20(Tests)/builds/456
Comment 2 Alexey Proskuryakov 2017-04-20 19:35:56 PDT
This assertion has been hit many times before, when using Safari with debug builds of WebKit.

But it does look like it started being hit on tests recently indeed. The earliest test crash I see was on April 11th, https/tests/xmlhttprequest/zero-length-response.html.

Not really enough data to blame, but could well be new tests added in <http://trac.webkit.org/r215164>.
Comment 3 Radar WebKit Bug Importer 2017-04-20 23:03:49 PDT
<rdar://problem/31752046>
Comment 4 Alexey Proskuryakov 2017-05-14 12:31:56 PDT
*** Bug 172094 has been marked as a duplicate of this bug. ***
Comment 5 Alexey Proskuryakov 2017-05-14 12:32:51 PDT
One test got skipped in r216846, but that's one of the many victims, not the culprit.
Comment 6 Chris Dumez 2017-05-23 10:04:57 PDT
*** Bug 172506 has been marked as a duplicate of this bug. ***
Comment 7 Chris Dumez 2017-05-23 10:40:14 PDT
Created attachment 311023 [details]
Patch
Comment 8 Alexey Proskuryakov 2017-05-23 11:11:28 PDT
Comment on attachment 311023 [details]
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=311023&action=review

> LayoutTests/fast/dom/script-charset-update.html:33
> +<script src="../../resources/js-test-post.js"></script>

Can you get rid of pre/post variants in favor of "js-test.js"?
Comment 9 Build Bot 2017-05-23 11:13:09 PDT
Comment on attachment 311023 [details]
Patch

Attachment 311023 [details] did not pass mac-ews (mac):
Output: http://webkit-queues.webkit.org/results/3801439

New failing tests:
imported/w3c/web-platform-tests/html/semantics/scripting-1/the-script-element/script-charset-01.html
fast/loader/cache-encoding.html
Comment 10 Build Bot 2017-05-23 11:13:10 PDT
Created attachment 311028 [details]
Archive of layout-test-results from ews100 for mac-elcapitan

The attached test failures were seen while running run-webkit-tests on the mac-ews.
Bot: ews100  Port: mac-elcapitan  Platform: Mac OS X 10.11.6
Comment 11 Build Bot 2017-05-23 11:19:54 PDT
Comment on attachment 311023 [details]
Patch

Attachment 311023 [details] did not pass mac-wk2-ews (mac-wk2):
Output: http://webkit-queues.webkit.org/results/3801448

New failing tests:
imported/w3c/web-platform-tests/html/semantics/scripting-1/the-script-element/script-charset-01.html
fast/loader/cache-encoding.html
Comment 12 Build Bot 2017-05-23 11:19:55 PDT
Created attachment 311030 [details]
Archive of layout-test-results from ews106 for mac-elcapitan-wk2

The attached test failures were seen while running run-webkit-tests on the mac-wk2-ews.
Bot: ews106  Port: mac-elcapitan-wk2  Platform: Mac OS X 10.11.6
Comment 13 Build Bot 2017-05-23 12:01:49 PDT
Comment on attachment 311023 [details]
Patch

Attachment 311023 [details] did not pass mac-debug-ews (mac):
Output: http://webkit-queues.webkit.org/results/3801614

New failing tests:
imported/w3c/web-platform-tests/html/semantics/scripting-1/the-script-element/script-charset-01.html
fast/loader/cache-encoding.html
Comment 14 Build Bot 2017-05-23 12:01:51 PDT
Created attachment 311036 [details]
Archive of layout-test-results from ews115 for mac-elcapitan

The attached test failures were seen while running run-webkit-tests on the mac-debug-ews.
Bot: ews115  Port: mac-elcapitan  Platform: Mac OS X 10.11.6
Comment 15 Build Bot 2017-05-23 12:10:35 PDT
Comment on attachment 311023 [details]
Patch

Attachment 311023 [details] did not pass ios-sim-ews (ios-simulator-wk2):
Output: http://webkit-queues.webkit.org/results/3801577

New failing tests:
imported/w3c/web-platform-tests/html/semantics/scripting-1/the-script-element/script-charset-01.html
fast/loader/cache-encoding.html
Comment 16 Build Bot 2017-05-23 12:10:36 PDT
Created attachment 311037 [details]
Archive of layout-test-results from ews122 for ios-simulator-wk2

The attached test failures were seen while running run-webkit-tests on the ios-sim-ews.
Bot: ews122  Port: ios-simulator-wk2  Platform: Mac OS X 10.11.6
Comment 17 Chris Dumez 2017-05-23 12:21:32 PDT
(In reply to Alexey Proskuryakov from comment #8)
> Comment on attachment 311023 [details]
> Patch
> 
> View in context:
> https://bugs.webkit.org/attachment.cgi?id=311023&action=review
> 
> > LayoutTests/fast/dom/script-charset-update.html:33
> > +<script src="../../resources/js-test-post.js"></script>
> 
> Can you get rid of pre/post variants in favor of "js-test.js"?

Sure, whenever you answer me this:
https://bugs.webkit.org/show_bug.cgi?id=172401#c7
Comment 18 Chris Dumez 2017-05-23 12:46:39 PDT
Rolled out patch that caused this via https://trac.webkit.org/r217289. I'll use this bug to add a test that was consistently crashing.
Comment 19 Chris Dumez 2017-05-23 12:49:46 PDT
Created attachment 311039 [details]
Patch
Comment 20 Chris Dumez 2017-05-23 13:53:43 PDT
Comment on attachment 311039 [details]
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=311039&action=review

> LayoutTests/fast/dom/script-charset-update.html:5
> +<script src="../../resources/js-test-pre.js"></script>

The test is not passing is js-test.js, I am investigating separately.
Comment 21 Geoffrey Garen 2017-05-23 13:55:42 PDT
Comment on attachment 311039 [details]
Patch

r=me
Comment 22 Chris Dumez 2017-05-23 14:06:27 PDT
Comment on attachment 311039 [details]
Patch

Clearing flags on attachment: 311039

Committed r217300: <http://trac.webkit.org/changeset/217300>
Comment 23 Chris Dumez 2017-05-23 14:06:30 PDT
All reviewed patches have been landed.  Closing bug.