Bug 172490 – ASSERT(!m_beginTime) in SMILTimeContainer::begin fires on many sites

• Status: RESOLVED
• Resolution: FIXED
• Component: Animations

[Joseph Pecoraro]

Assertion failure in SMILTimeContainer.cpp:

Steps to reproduce:
1. Load https://www.theverge.com/2017/5/22/15673712/anker-battery-charger-amazon-empire-steven-yang-interview
2. Wait for a bit
  => ASSERT

ASSERTION FAILED: !m_beginTime
OpenSource/Source/WebCore/svg/animation/SMILTimeContainer.cpp(141) : void WebCore::SMILTimeContainer::begin()
1   0x1207e535d WTFCrash
2   0x116c8a429 WebCore::SMILTimeContainer::begin()
3   0x116e7e7f4 WebCore::SVGDocumentExtensions::startAnimations()
4   0x114b94417 WebCore::Document::implicitClose()
5   0x114f5a87b WebCore::FrameLoader::checkCallImplicitClose()
6   0x114f5a5b0 WebCore::FrameLoader::checkCompleted()
7   0x114b9a03c WebCore::Document::checkCompleted()
8   0x114b86905 WebCore::Document::loadEventDelayTimerFired()
9   0x114bc8cfb void std::__1::__invoke_void_return_wrapper<void>::__call<std::__1::__bind<void (WebCore::Document::*&)(), WebCore::Document*>&>(std::__1::__bind<void (WebCore::Document::*&)(), WebCore::Document*>&&&)
10  0x114bc8be9 std::__1::__function::__func<std::__1::__bind<void (WebCore::Document::*&)(), WebCore::Document*>, std::__1::allocator<std::__1::__bind<void (WebCore::Document::*&)(), WebCore::Document*> >, void ()>::operator()()
11  0x11448af0a std::__1::function<void ()>::operator()() const
12  0x11448ae29 WebCore::Timer::fired()
13  0x1170082b0 WebCore::ThreadTimers::sharedTimerFiredInternal()
14  0x1170094f1 WebCore::ThreadTimers::setSharedTimer(WebCore::SharedTimer*)::$_0::operator()() const
15  0x1170094bd void std::__1::__invoke_void_return_wrapper<void>::__call<WebCore::ThreadTimers::setSharedTimer(WebCore::SharedTimer*)::$_0&>(WebCore::ThreadTimers::setSharedTimer(WebCore::SharedTimer*)::$_0&&&)
16  0x117009469 std::__1::__function::__func<WebCore::ThreadTimers::setSharedTimer(WebCore::SharedTimer*)::$_0, std::__1::allocator<WebCore::ThreadTimers::setSharedTimer(WebCore::SharedTimer*)::$_0>, void ()>::operator()()
17  0x11448af0a std::__1::function<void ()>::operator()() const
18  0x11629c448 WebCore::MainThreadSharedTimer::fired()
19  0x11629c7d9 WebCore::timerFired(__CFRunLoopTimer*, void*)
20  0x7fffb8db4e04 __CFRUNLOOP_IS_CALLING_OUT_TO_A_TIMER_CALLBACK_FUNCTION__
21  0x7fffb8db4a93 __CFRunLoopDoTimer
22  0x7fffb8db45ea __CFRunLoopDoTimers
23  0x7fffb8dabfc1 __CFRunLoopRun
24  0x7fffb8dab544 CFRunLoopRunSpecific
25  0x7fffb830bebc RunCurrentEventLoopInMode
26  0x7fffb830bcf1 ReceiveNextEventCommon
27  0x7fffb830bb26 _BlockUntilNextEventMatchingListInModeWithFilter
28  0x7fffb68a5bf8 _DPSNextEvent
29  0x7fffb702184e -[NSApplication(NSEvent) _nextEventMatchingEventMask:untilDate:inMode:dequeue:]
30  0x7fffb689a57f -[NSApplication run]
31  0x7fffb6864fb2 NSApplicationMain

[Charlie Turner]

*** Bug 190413 has been marked as a duplicate of this bug. ***

[Charlie Turner]

*** Bug 192687 has been marked as a duplicate of this bug. ***

[Charlie Turner]

Created attachment 399016 [details]
Full backtrace of crash

Attached is the full backtrace, here's the relevant thread snippet,

(gdb) bt
#0  0x00007f347addc4ae in WTFCrash () at /home/cht/igalia/sources/WebKit/Source/WTF/wtf/Assertions.cpp:309
#1  0x00007f3486ef72bb in WTFCrashWithInfo () at DerivedSources/ForwardingHeaders/wtf/Assertions.h:671
#2  0x00007f348bb178c9 in WebCore::SMILTimeContainer::begin (this=0x7f33ddad5bb0) at /home/cht/igalia/sources/WebKit/Source/WebCore/svg/animation/SMILTimeContainer.cpp:119
#3  0x00007f348b89cece in WebCore::SVGDocumentExtensions::startAnimations (this=0x7f33fdafb678) at /home/cht/igalia/sources/WebKit/Source/WebCore/svg/SVGDocumentExtensions.cpp:97
#4  0x00007f348a19b026 in WebCore::Document::implicitClose (this=0x7f33f2f48b88) at /home/cht/igalia/sources/WebKit/Source/WebCore/dom/Document.cpp:3111
#5  0x00007f348ab2c09b in WebCore::FrameLoader::checkCallImplicitClose (this=0x7f33f0d34d00) at /home/cht/igalia/sources/WebKit/Source/WebCore/loader/FrameLoader.cpp:966
#6  0x00007f348ab2bbfa in WebCore::FrameLoader::checkCompleted (this=0x7f33f0d34d00) at /home/cht/igalia/sources/WebKit/Source/WebCore/loader/FrameLoader.cpp:907
#7  0x00007f348ab2c160 in WebCore::FrameLoader::completed (this=0x7f33de6b6340) at /home/cht/igalia/sources/WebKit/Source/WebCore/loader/FrameLoader.cpp:1221
#8  0x00007f348ab2bc17 in WebCore::FrameLoader::checkCompleted (this=0x7f33de6b6340) at /home/cht/igalia/sources/WebKit/Source/WebCore/loader/FrameLoader.cpp:911
#9  0x00007f348ab2bc7b in WebCore::FrameLoader::loadDone (this=0x7f33de6b6340, type=WebCore::LoadCompletionType::Finish) at /home/cht/igalia/sources/WebKit/Source/WebCore/loader/FrameLoader.cpp:830
#10 0x00007f348ac42dcd in WebCore::CachedResourceLoader::loadDone (this=0x7f33f09b2880, type=WebCore::LoadCompletionType::Finish, shouldPerformPostLoadActions=true) at /home/cht/igalia/sources/WebKit/Source/WebCore/loader/cache/CachedResourceLoader.cpp:1363
#11 0x00007f348abb11ee in WebCore::SubresourceLoader::notifyDone (this=0x7f33de471a00, type=WebCore::LoadCompletionType::Finish) at /home/cht/igalia/sources/WebKit/Source/WebCore/loader/SubresourceLoader.cpp:840
#12 0x00007f348abad920 in WebCore::SubresourceLoader::didFinishLoading (this=0x7f33de471a00, networkLoadMetrics=...) at /home/cht/igalia/sources/WebKit/Source/WebCore/loader/SubresourceLoader.cpp:740
#13 0x00007f34883bfe25 in WebKit::WebResourceLoader::didFinishResourceLoad (this=0x7f33db40e480, networkLoadMetrics=...) at /home/cht/igalia/sources/WebKit/Source/WebKit/WebProcess/Network/WebResourceLoader.cpp:251
#14 0x00007f348750cb60 in IPC::callMemberFunctionImpl<WebKit::WebResourceLoader, void (WebKit::WebResourceLoader::*)(WebCore::NetworkLoadMetrics const&), std::tuple<WebCore::NetworkLoadMetrics>, 0ul> (object=0x7f33db40e480, function=(void (WebKit::WebResourceLoader::*)(WebKit::WebResourceLoader * const, const WebCore::NetworkLoadMetrics &)) 0x7f34883bfad0 <WebKit::WebResourceLoader::didFinishResourceLoad(WebCore::NetworkLoadMetrics const&)>, args=...) at /home/cht/igalia/sources/WebKit/Source/WebKit/Platform/IPC/HandleMessage.h:41
#15 0x00007f348750c1d0 in IPC::callMemberFunction<WebKit::WebResourceLoader, void (WebKit::WebResourceLoader::*)(WebCore::NetworkLoadMetrics const&), std::tuple<WebCore::NetworkLoadMetrics>, std::integer_sequence<unsigned long, 0ul> > (args=..., object=0x7f33db40e480, function=(void (WebKit::WebResourceLoader::*)(WebKit::WebResourceLoader * const, const WebCore::NetworkLoadMetrics &)) 0x7f34883bfad0 <WebKit::WebResourceLoader::didFinishResourceLoad(WebCore::NetworkLoadMetrics const&)>) at /home/cht/igalia/sources/WebKit/Source/WebKit/Platform/IPC/HandleMessage.h:47
#16 0x00007f3487509d1e in IPC::handleMessage<Messages::WebResourceLoader::DidFinishResourceLoad, WebKit::WebResourceLoader, void (WebKit::WebResourceLoader::*)(WebCore::NetworkLoadMetrics const&)> (decoder=..., object=0x7f33db40e480, function=(void (WebKit::WebResourceLoader::*)(WebKit::WebResourceLoader * const, const WebCore::NetworkLoadMetrics &)) 0x7f34883bfad0 <WebKit::WebResourceLoader::didFinishResourceLoad(WebCore::NetworkLoadMetrics const&)>) at /home/cht/igalia/sources/WebKit/Source/WebKit/Platform/IPC/HandleMessage.h:114
#17 0x00007f3487509510 in WebKit::WebResourceLoader::didReceiveWebResourceLoaderMessage (this=0x7f33db40e480, connection=..., decoder=...) at DerivedSources/WebKit/WebResourceLoaderMessageReceiver.cpp:70
#18 0x00007f34883b7870 in WebKit::NetworkProcessConnection::didReceiveMessage (this=0x7f346f7ea038, connection=..., decoder=...) at /home/cht/igalia/sources/WebKit/Source/WebKit/WebProcess/Network/NetworkProcessConnection.cpp:91
#19 0x00007f3487a500af in IPC::Connection::dispatchMessage (this=0x7f346f7e51c0, decoder=...) at /home/cht/igalia/sources/WebKit/Source/WebKit/Platform/IPC/Connection.cpp:996
#20 0x00007f3487a50642 in IPC::Connection::dispatchMessage (this=0x7f346f7e51c0, message=...) at /home/cht/igalia/sources/WebKit/Source/WebKit/Platform/IPC/Connection.cpp:1065
#21 0x00007f3487a50ba0 in IPC::Connection::dispatchOneIncomingMessage (this=0x7f346f7e51c0) at /home/cht/igalia/sources/WebKit/Source/WebKit/Platform/IPC/Connection.cpp:1134
#22 0x00007f3487a5456e in IPC::Connection::enqueueIncomingMessage(std::unique_ptr<IPC::Decoder, std::default_delete<IPC::Decoder> >)::$_7::operator()() (this=0x7f33fc4fa868) at /home/cht/igalia/sources/WebKit/Source/WebKit/Platform/IPC/Connection.cpp:973
#23 0x00007f3487a544fe in WTF::Detail::CallableWrapper<IPC::Connection::enqueueIncomingMessage(std::unique_ptr<IPC::Decoder, std::default_delete<IPC::Decoder> >)::$_7, void>::call() (this=0x7f33fc4fa860) at DerivedSources/ForwardingHeaders/wtf/Function.h:52
#24 0x00007f3486ef6b22 in WTF::Function<void ()>::operator()() const (this=0x7ffed4029cf8) at DerivedSources/ForwardingHeaders/wtf/Function.h:84
#25 0x00007f347ae131c8 in WTF::RunLoop::performWork (this=0x7f346f7f8000) at /home/cht/igalia/sources/WebKit/Source/WTF/wtf/RunLoop.cpp:119
#26 0x00007f347aea67fc in WTF::RunLoop::RunLoop()::$_0::operator()(void*) const (this=0x7f346f7f8000, userData=0x7f346f7f8000) at /home/cht/igalia/sources/WebKit/Source/WTF/wtf/glib/RunLoopGLib.cpp:68
#27 0x00007f347aea67d5 in WTF::RunLoop::RunLoop()::$_0::__invoke(void*) (userData=0x7f346f7f8000) at /home/cht/igalia/sources/WebKit/Source/WTF/wtf/glib/RunLoopGLib.cpp:67
#28 0x00007f347aea67b1 in WTF::$_3::operator() (this=0x1660d60, source=0x1660d60, callback=0x7f347aea67c0 <WTF::RunLoop::RunLoop()::$_0::__invoke(void*)>, userData=0x7f346f7f8000) at /home/cht/igalia/sources/WebKit/Source/WTF/wtf/glib/RunLoopGLib.cpp:45
#29 0x00007f347aea6755 in WTF::$_3::__invoke (source=0x1660d60, callback=0x7f347aea67c0 <WTF::RunLoop::RunLoop()::$_0::__invoke(void*)>, userData=0x7f346f7f8000) at /home/cht/igalia/sources/WebKit/Source/WTF/wtf/glib/RunLoopGLib.cpp:40
#30 0x00007f3473b31dd8 in ?? () from /lib/x86_64-linux-gnu/libglib-2.0.so.0
#31 0x0000000001555820 in ?? ()
#32 0x00007f3400000000 in ?? ()
#33 0x0000000000000000 in ?? ()

[Brent Fulgham]

This seems to be tracked by this radar:
<rdar://45153186>

[Fujii Hironori]

Created attachment 463354 [details]
test case

[Fujii Hironori]

Created attachment 463355 [details]
Patch

[Simon Fraser (smfr)]

Comment on attachment 463355 [details]
Patch

Nice fix!

[Fujii Hironori]

Comment on attachment 463355 [details]
Patch

Thank you!

[EWS]

Committed 256253@main (58eb1cbd097a): <https://commits.webkit.org/256253@main>

All reviewed patches have been landed. Closing bug and clearing flags on attachment 463355 [details].