Bug 171462 – ASSERTION FAILED: m_scriptExecutionContext->isContextThread() seen with LayoutTest crypto/workers/crypto-random-values-limits-worker.html

• Status: RESOLVED
• Resolution: FIXED
• Component: WebCore Misc.

[Matt Lewis]

Created attachment 308614 [details]
crash-log

Saw this assertion Failure with test crypto/workers/crypto-random-values-limits-worker.html

ASSERTION FAILED: m_scriptExecutionContext->isContextThread()
/Volumes/Data/slave/sierra-debug/build/Source/WebCore/dom/ContextDestructionObserver.cpp(48) : void WebCore::ContextDestructionObserver::observeContext(WebCore::ScriptExecutionContext *)
1   0x1150a176d WTFCrash
2   0x1199d0b85 WebCore::ContextDestructionObserver::observeContext(WebCore::ScriptExecutionContext*)
3   0x1199d0c67 WebCore::ContextDestructionObserver::~ContextDestructionObserver()
4   0x11bf3ed3d WebCore::SubtleCrypto::~SubtleCrypto()
5   0x11bf3ecb5 WebCore::SubtleCrypto::~SubtleCrypto()
6   0x11bf3ecd9 WebCore::SubtleCrypto::~SubtleCrypto()
7   0x119a0eb5f WTF::RefCounted<WebCore::SubtleCrypto>::deref() const
8   0x119a0eb01 WTF::Ref<WebCore::SubtleCrypto>::~Ref()
9   0x119a0e335 WTF::Ref<WebCore::SubtleCrypto>::~Ref()
10  0x119a0e2d1 WebCore::Crypto::~Crypto()
11  0x119a0e375 WebCore::Crypto::~Crypto()
12  0x119a0e399 WebCore::Crypto::~Crypto()
13  0x119e3028f WTF::RefCounted<WebCore::Crypto>::deref() const
14  0x119e318e5 void WTF::derefIfNotNull<WebCore::Crypto>(WebCore::Crypto*)
15  0x119e318a3 WTF::RefPtr<WebCore::Crypto>::~RefPtr()
16  0x119e1f055 WTF::RefPtr<WebCore::Crypto>::~RefPtr()
17  0x11c409edd WebCore::WorkerGlobalScope::~WorkerGlobalScope()
18  0x119ca13f5 WebCore::DedicatedWorkerGlobalScope::~DedicatedWorkerGlobalScope()
19  0x119ca1415 WebCore::DedicatedWorkerGlobalScope::~DedicatedWorkerGlobalScope()
20  0x119ca1469 WebCore::DedicatedWorkerGlobalScope::~DedicatedWorkerGlobalScope()
21  0x119ca2231 WTF::RefCounted<WebCore::WorkerGlobalScope>::deref() const
22  0x11b2ae467 void WTF::derefIfNotNull<WebCore::WorkerGlobalScope>(WebCore::WorkerGlobalScope*)
23  0x11c42cfab WTF::RefPtr<WebCore::WorkerGlobalScope>::operator=(std::nullptr_t)
24  0x11c42cded WebCore::WorkerThread::workerThread()
25  0x11c42c7e5 WebCore::WorkerThread::workerThreadStart(void*)
26  0x11511c7a9 WTF::Thread::create(void (*)(void*), void*, char const*)::$_0::operator()() const
27  0x11511c77d void std::__1::__invoke_void_return_wrapper<void>::__call<WTF::Thread::create(void (*)(void*), void*, char const*)::$_0&>(WTF::Thread::create(void (*)(void*), void*, char const*)::$_0&&&)
28  0x11511c729 std::__1::__function::__func<WTF::Thread::create(void (*)(void*), void*, char const*)::$_0, std::__1::allocator<WTF::Thread::create(void (*)(void*), void*, char const*)::$_0>, void ()>::operator()()
29  0x1145b739a std::__1::function<void ()>::operator()() const
30  0x11511afb7 WTF::threadEntryPoint(void*)
31  0x11511d0c2 WTF::wtfThreadEntryPoint(void*)

Build results:
https://build.webkit.org/results/Apple%20Sierra%20Debug%20WK2%20(Tests)/r215938%20(715)/results.html

History:
https://webkit-test-results.webkit.org/dashboards/flakiness_dashboard.html#showAllRuns=true&tests=crypto%2Fworkers%2Fcrypto-random-values-limits-worker.html

[Ryan Haddad]

I think I have seen this assertion failure with another crypto test recently, but old test results aren't accessible at the moment.

[Radar WebKit Bug Importer]

<rdar://problem/31906859>

[Jiewen Tan]

Thread 8 Crashed:: WebCore: Worker
0   com.apple.JavaScriptCore      	0x0000000110994ea4 WTFCrash + 36 (Assertions.cpp:292)
1   com.apple.WebCore             	0x0000000117e07f45 WebCore::ContextDestructionObserver::observeContext(WebCore::ScriptExecutionContext*) + 101 (ContextDestructionObserver.cpp:48)
2   com.apple.WebCore             	0x0000000117e08027 WebCore::ContextDestructionObserver::~ContextDestructionObserver() + 39 (ContextDestructionObserver.cpp:43)
3   com.apple.WebCore             	0x0000000117e479dd WebCore::Crypto::~Crypto() + 93 (Crypto.cpp:56)
4   com.apple.WebCore             	0x0000000117e47a65 WebCore::Crypto::~Crypto() + 21 (Crypto.cpp:56)
5   com.apple.WebCore             	0x0000000117e47a89 WebCore::Crypto::~Crypto() + 25 (Crypto.cpp:55)
6   com.apple.WebCore             	0x0000000118264acf WTF::RefCounted<WebCore::Crypto>::deref() const + 79 (RefCounted.h:145)
7   com.apple.WebCore             	0x0000000118266125 void WTF::derefIfNotNull<WebCore::Crypto>(WebCore::Crypto*) + 53 (PassRefPtr.h:41)
8   com.apple.WebCore             	0x00000001182660e3 WTF::RefPtr<WebCore::Crypto>::~RefPtr() + 83 (RefPtr.h:62)
9   com.apple.WebCore             	0x0000000118253845 WTF::RefPtr<WebCore::Crypto>::~RefPtr() + 21 (RefPtr.h:62)
10  com.apple.WebCore             	0x000000011a84a56d WebCore::WorkerGlobalScope::~WorkerGlobalScope() + 237 (WorkerGlobalScope.cpp:106)
11  com.apple.WebCore             	0x00000001180d89e5 WebCore::DedicatedWorkerGlobalScope::~DedicatedWorkerGlobalScope() + 21 (DedicatedWorkerGlobalScope.cpp:59)
12  com.apple.WebCore             	0x00000001180d8a05 WebCore::DedicatedWorkerGlobalScope::~DedicatedWorkerGlobalScope() + 21 (DedicatedWorkerGlobalScope.cpp:59)
13  com.apple.WebCore             	0x00000001180d8a59 WebCore::DedicatedWorkerGlobalScope::~DedicatedWorkerGlobalScope() + 25 (DedicatedWorkerGlobalScope.cpp:58)
14  com.apple.WebCore             	0x00000001180d9821 WTF::RefCounted<WebCore::WorkerGlobalScope>::deref() const + 81 (RefCounted.h:145)
15  com.apple.WebCore             	0x00000001196f8b57 void WTF::derefIfNotNull<WebCore::WorkerGlobalScope>(WebCore::WorkerGlobalScope*) + 55 (PassRefPtr.h:41)
16  com.apple.WebCore             	0x000000011a86d63b WTF::RefPtr<WebCore::WorkerGlobalScope>::operator=(std::nullptr_t) + 91 (RefPtr.h:152)
17  com.apple.WebCore             	0x000000011a86d47d WebCore::WorkerThread::workerThread() + 1533 (WorkerThread.cpp:204)
18  com.apple.WebCore             	0x000000011a86ce75 WebCore::WorkerThread::workerThreadStart(void*) + 21 (WorkerThread.cpp:149)
19  com.apple.JavaScriptCore      	0x0000000110a10019 WTF::Thread::create(void (*)(void*), void*, char const*)::$_0::operator()() const + 25 (Threading.cpp:116)
20  com.apple.JavaScriptCore      	0x0000000110a0ffed void std::__1::__invoke_void_return_wrapper<void>::__call<WTF::Thread::create(void (*)(void*), void*, char const*)::$_0&>(WTF::Thread::create(void (*)(void*), void*, char const*)::$_0&&&) + 45 (__functional_base:469)
21  com.apple.JavaScriptCore      	0x0000000110a0ff99 std::__1::__function::__func<WTF::Thread::create(void (*)(void*), void*, char const*)::$_0, std::__1::allocator<WTF::Thread::create(void (*)(void*), void*, char const*)::$_0>, void ()>::operator()() + 41 (functional:1437)
22  com.apple.JavaScriptCore      	0x000000010feaa06a std::__1::function<void ()>::operator()() const + 26 (functional:1817)
23  com.apple.JavaScriptCore      	0x0000000110a0e827 WTF::threadEntryPoint(void*) + 151 (Threading.cpp:99)
24  com.apple.JavaScriptCore      	0x0000000110a10932 WTF::wtfThreadEntryPoint(void*) + 402 (ThreadingPthreads.cpp:203)
25  libsystem_pthread.dylib       	0x00007fffa5dd893b _pthread_body + 180
26  libsystem_pthread.dylib       	0x00007fffa5dd8887 _pthread_start + 286
27  libsystem_pthread.dylib       	0x00007fffa5dd808d thread_start + 13

[Matt Lewis]

Also saw this same crash in test crypto/workers/subtle/hkdf-import-key-derive-bits.html

[Matt Lewis]

(In reply to Matt Lewis from comment #4)
> Also saw this same crash in test
> crypto/workers/subtle/hkdf-import-key-derive-bits.html

Build Results:
https://build.webkit.org/results/Apple%20Sierra%20Debug%20WK2%20(Tests)/r216025%20(758)/results.html

[Jiewen Tan]

Created attachment 308871 [details]
Patch

[Jiewen Tan]

Created attachment 308880 [details]
Patch

[Brent Fulgham]

View in context: https://bugs.webkit.org/attachment.cgi?id=308871&action=review

r=me

> Source/WebCore/ChangeLog:3
> +        ASSERTION FAILED: m_scriptExecutionContext->isContextThread() seenu with LayoutTest crypto/workers/crypto-random-values-limits-worker.html

seenu -> seen

> Source/WebCore/ChangeLog:15
> +        therefore they have to inherit ContextDestructionObserver.

therefore they inherit from ContextDestructionObserver.

> Source/WebCore/ChangeLog:19
> +        3) Members of an object are destroyed after the corresponding desturctor is called.

"... corresponding DESTRUCTOR is called."

> Source/WebCore/ChangeLog:21
> +        ~WorkerGlobalScope() and before the destruction of the m_crypto member, isContextThread() will fail.

~WorkerGlobalScope(), but before ...

> Source/WebCore/ChangeLog:22
> +        To prevent that, we have to nullify m_crypto before the async call.

... we set m_crypto to nullptr before making the async call.

[Brent Fulgham]

Comment on attachment 308880 [details]
Patch

See my review comments in the text field.

[Jiewen Tan]

(In reply to Brent Fulgham from comment #9)
> Comment on attachment 308880 [details]
> Patch
> 
> See my review comments in the text field.

Thanks Brent for r+ my patch.

[WebKit Commit Bot]

Comment on attachment 308880 [details]
Patch

Clearing flags on attachment: 308880

Committed r216133: <http://trac.webkit.org/changeset/216133>

[WebKit Commit Bot]

All reviewed patches have been landed.  Closing bug.