Bug 190895 – [curl] ASSERTION FAILED: !m_didNotifyResponse || m_multipartHandle

• Status: RESOLVED
• Resolution: FIXED
• Component: Platform

[Fujii Hironori]

[curl] ASSERTION FAILED: !m_didNotifyResponse || m_multipartHandle

Some test cases are failing due to hitting this assertion failure.

https://build.webkit.org/results/WinCairo%2064-bit%20WKL%20Debug%20(Tests)/r237400%20(986)/results.html
https://build.webkit.org/results/WinCairo%2064-bit%20WKL%20Debug%20(Tests)/r237400%20(986)/http/tests/xmlhttprequest/response-access-on-error-crash-log.txt

> ASSERTION FAILED: !m_didNotifyResponse || m_multipartHandle
> ..\..\Source\WebCore\platform\network\curl\CurlRequest.cpp(553) : WebCore::CurlRequest::invokeDidReceiveResponse
> 1   00007FF94CE3221A WTFCrash
> 2   00007FF930925CC1 WTFCrashWithInfo
> 3   00007FF9329D6216 WebCore::CurlRequest::invokeDidReceiveResponse
> 4   00007FF9329D5674 WebCore::CurlRequest::didCompleteTransfer
> 5   00007FF933F021CA <lambda_5806470903b2870987393fc72f55f7e5>::operator()
> 6   00007FF933F0323B WTF::Function<void __cdecl(WebCore::CurlRequestSchedulerClient *)>::CallableWrapper<<lambda_5806470903b2870987393fc72f55f7e5> >::call
> 7   00007FF933F023C4 WTF::Function<void __cdecl(WebCore::CurlRequestSchedulerClient *)>::operator()
> 8   00007FF933F020B0 <lambda_1da8f92f09c065ef17064f00a6de3c5d>::operator()
> 9   00007FF933F0313F WTF::Function<void __cdecl(void)>::CallableWrapper<<lambda_1da8f92f09c065ef17064f00a6de3c5d> >::call
> 10  00007FF930925598 WTF::Function<void __cdecl(void)>::operator()
> 11  00007FF933EFCD2C WebCore::CurlRequestScheduler::executeTasks
> 12  00007FF933EFCF12 WebCore::CurlRequestScheduler::workerThread
> 13  00007FF933F022EB <lambda_f9d7a5b486f6e184d8e42c552b16bba4>::operator()
> 14  00007FF933F032BF WTF::Function<void __cdecl(void)>::CallableWrapper<<lambda_f9d7a5b486f6e184d8e42c552b16bba4> >::call
> 15  00007FF94CE49E07 WTF::Function<void __cdecl(void)>::operator()
> 16  00007FF94CEBCB3E WTF::Thread::entryPoint
> 17  00007FF94CF3E058 WTF::wtfThreadEntryPoint
> 18  00007FF94BC5DC05 iswascii
> 19  00007FF9531F1FE4 BaseThreadInitThunk
> 20  00007FF965A2EF91 RtlUserThreadStart

[Fujii Hironori]

The other day I saw this assertion failure while using MiniBrowser. IIRC, m_didNotifyResponse was true in that case.

[Fujii Hironori]

I'm stupid. It is obvious. m_didNotifyResponse is true and m_multipartHandle is false in that case. Nvm my comment.

[Fujii Hironori]

This issue occurs in WK2, too.

> python ./Tools/Scripts/run-webkit-tests --debug --wincairo --no-retry-failures --child-processes=1 -v http/tests/xmlhttprequest/access-control-basic-denied.html http/tests/xmlhttprequest/access-control-repeated-failed-preflight-crash.html

[Fujii Hironori]

Here is the members of CurlRequest that assertion failure is happening.

> -		this	0x000002b57563b230 {m_client=0x0000000000000000 <NULL> m_cancelled=false m_messageQueue=0x0000000000000000 <NULL> ...}	WebCore::CurlRequest *
> +		WTF::ThreadSafeRefCounted<WebCore::CurlRequest,WTF::DestructionThread::Any>	{...}	WTF::ThreadSafeRefCounted<WebCore::CurlRequest,WTF::DestructionThread::Any>
> +		WebCore::CurlRequestSchedulerClient	{...}	WebCore::CurlRequestSchedulerClient
> +		WebCore::CurlMultipartHandleClient	{...}	WebCore::CurlMultipartHandleClient
> +		m_client	0x0000000000000000 <NULL>	WebCore::CurlRequestClient *
> 		m_cancelled	false	bool
> +		m_messageQueue	0x0000000000000000 <NULL>	WTF::MessageQueue<WTF::Function<void ()> > *
> +		m_request	{...}	WebCore::ResourceRequest
> +		m_user	{m_impl={m_ptr=0x0000000000000000 <NULL> } }	WTF::String
> +		m_password	{m_impl={m_ptr=0x0000000000000000 <NULL> } }	WTF::String
> 		m_authType	0xffffffef	unsigned long
> 		m_shouldSuspend	false	bool
> 		m_enableMultipart	false	bool
> +		m_curlHandle	unique_ptr {m_handle=0x000002b5756304a0 m_errorBuffer=0x000002b575635a30 "Operation too slow. Less than 1 bytes/sec transferred the last 10 seconds" ...}	std::unique_ptr<WebCore::CurlHandle,std::default_delete<WebCore::CurlHandle> >
> +		m_formDataStream	{m_formData={m_ptr=0x0000000000000000 <NULL> } m_postData=empty m_isContentLengthUpdated=false ...}	WebCore::CurlFormDataStream
> +		m_multipartHandle	empty	std::unique_ptr<WebCore::CurlMultipartHandle,std::default_delete<WebCore::CurlMultipartHandle> >
> +		m_response	{url={m_string={m_impl={m_ptr=0x000002b575600e10 {...} } } m_isValid=0x00000001 m_protocolIsInHTTPFamily=...} ...}	WebCore::CurlResponse
> 		m_didReceiveResponse	true	bool
> 		m_didNotifyResponse	true	bool
> 		m_didReturnFromNotify	false	bool
> 		m_actionAfterInvoke	ReceiveData (0x00000001)	WebCore::CurlRequest::Action
> 		m_finishedResultCode	CURLE_OPERATION_TIMEDOUT (0x0000001c)	<unnamed-tag>
> 		m_isPausedOfRequest	false	bool
> 		m_isPausedOfCallback	true	bool
> +		m_pauseStateMutex	{m_byte={value=0x00 '\0' } }	WTF::Lock
> 		m_isHandlePaused	true	bool
> +		m_downloadMutex	{m_byte={value=0x00 '\0' } }	WTF::Lock
> 		m_isEnabledDownloadToFile	false	bool
> +		m_downloadFilePath	{m_impl={m_ptr=0x0000000000000000 <NULL> } }	WTF::String
> 		m_downloadFileHandle	0xffffffffffffffff	void *
> +		m_certificateInfo	{m_verificationError=0x00000000 m_certificateChain={...} }	WebCore::CertificateInfo
> 		m_captureExtraMetrics	false	bool
> +		m_networkLoadMetrics	{domainLookupStart={m_value=0.00061202049255371094 } domainLookupEnd={m_value=0.015612020492553710 } ...}	WebCore::NetworkLoadMetrics
> +		m_requestStartTime	{m_value=1549261830.5828714 }	WTF::MonotonicTime
> +		m_performStartTime	{m_value=1549261830.5834835 }	WTF::MonotonicTime
> 		m_totalReceivedSize	0x0000000000000000	unsigned __int64
> 		behaviorAfterInvoke	FinishTransfer (0x00000003)	WebCore::CurlRequest::Action
> +		response	{url={m_string={m_impl={m_ptr=0x000002b575600e10 {...} } } m_isValid=0x00000001 m_protocolIsInHTTPFamily=...} ...}	const WebCore::CurlResponse &

[Fujii Hironori]

Here is the callstack:

> WTF.dll!WTFCrash() Line 255	C++
> WebKit2.dll!WTFCrashWithInfo(int, const char *, const char *, int) Line 560	C++
> WebKit2.dll!WebCore::CurlRequest::invokeDidReceiveResponse(const WebCore::CurlResponse & response, WebCore::CurlRequest::Action behaviorAfterInvoke) Line 553	C++
> WebKit2.dll!WebCore::CurlRequest::didCompleteTransfer(<unnamed-tag> result) Line 428	C++
> WebKit2.dll!WebCore::CurlRequestScheduler::completeTransfer::<unnamed-tag>::operator()(WebCore::CurlRequestSchedulerClient * client) Line 210	C++
> WebKit2.dll!WTF::Function<void (WebCore::CurlRequestSchedulerClient *)>::CallableWrapper<`lambda at ..\..\Source\WebCore\platform\network\curl\CurlRequestScheduler.cpp:208:30'>::call(WebCore::CurlRequestSchedulerClient * in) Line 101	C++
> WebKit2.dll!WTF::Function<void (WebCore::CurlRequestSchedulerClient *)>::operator()(WebCore::CurlRequestSchedulerClient * in) Line 56	C++
> WebKit2.dll!WebCore::CurlRequestScheduler::finalizeTransfer::<unnamed-tag>::operator()() Line 232	C++
> WebKit2.dll!WTF::Function<void ()>::CallableWrapper<`lambda at ..\..\Source\WebCore\platform\network\curl\CurlRequestScheduler.cpp:222:17'>::call() Line 101	C++
> WebKit2.dll!WTF::Function<void ()>::operator()() Line 56	C++
> WebKit2.dll!WebCore::CurlRequestScheduler::executeTasks() Line 129	C++
> WebKit2.dll!WebCore::CurlRequestScheduler::workerThread() Line 146	C++
> WebKit2.dll!WebCore::CurlRequestScheduler::startThreadIfNeeded::<unnamed-tag>::operator()() Line 89	C++
> WebKit2.dll!WTF::Function<void ()>::CallableWrapper<`lambda at ..\..\Source\WebCore\platform\network\curl\CurlRequestScheduler.cpp:87:49'>::call() Line 101	C++
> WTF.dll!WTF::Function<void ()>::operator()() Line 56	C++
> WTF.dll!WTF::Thread::entryPoint(WTF::Thread::NewThreadContext * newThreadContext) Line 137	C++
> WTF.dll!WTF::wtfThreadEntryPoint(void * data) Line 152	C++
> [External Code]

[Fujii Hironori]

It seems that CurlRequestScheduler::completeTransfer was called while waiting for the reply of DidReceiveResponse.

[Fujii Hironori]

Created attachment 361043 [details]
Patch

[Fujii Hironori]

Comment on attachment 361043 [details]
Patch

Clearing flags on attachment: 361043

Committed r240958: <https://trac.webkit.org/changeset/240958>

[Fujii Hironori]

All reviewed patches have been landed.  Closing bug.

[Radar WebKit Bug Importer]

<rdar://problem/47806894>