Bug 192673 - REGRESSION: Crashes in MarkedBlock::aboutToMarkSlow on imported/w3c/web-platform-tests/FileAPI/idlharness.worker.html and other tests
Summary: REGRESSION: Crashes in MarkedBlock::aboutToMarkSlow on imported/w3c/web-platf...
Status: RESOLVED DUPLICATE of bug 190047
Alias: None
Product: WebKit
Classification: Unclassified
Component: JavaScriptCore (show other bugs)
Version: WebKit Nightly Build
Hardware: Unspecified Unspecified
: P2 Normal
Assignee: WebKit Commit Bot
Keywords: InRadar
Depends on:
Blocks: 50856
  Show dependency treegraph
Reported: 2018-12-13 11:56 PST by WebKit Commit Bot
Modified: 2018-12-14 13:40 PST (History)
10 users (show)

See Also:

Archive of layout-test-results from webkit-cq-02 (2.45 MB, application/zip)
2018-12-13 11:56 PST, WebKit Commit Bot
no flags Details

Note You need to log in before you can comment on or make changes to this bug.
Description WebKit Commit Bot 2018-12-13 11:56:05 PST
This is an automatically generated bug from the commit-queue.
imported/w3c/web-platform-tests/FileAPI/idlharness.worker.html has been flaky on the commit-queue.

imported/w3c/web-platform-tests/FileAPI/idlharness.worker.html was authored by .

The commit-queue just saw imported/w3c/web-platform-tests/FileAPI/idlharness.worker.html flake (DumpRenderTree crashed) while processing attachment 357239 [details] on bug 192639.
Bot: webkit-cq-02  Port: <class 'webkitpy.common.config.ports.MacPort'>  Platform: Mac OS X 10.12.6

The bots will update this with information from each new failure.

If you believe this bug to be fixed or invalid, feel free to close.  The bots will re-open if the flake re-occurs.

If you would like to track this test fix with another bug, please close this bug as a duplicate.  The bots will follow the duplicate chain when making future comments.
Comment 1 WebKit Commit Bot 2018-12-13 11:56:06 PST
Created attachment 357242 [details]
Archive of layout-test-results from webkit-cq-02
Comment 2 Alexey Proskuryakov 2018-12-14 10:59:05 PST
Thread 0 Crashed:: Dispatch queue: com.apple.main-thread
0   com.apple.JavaScriptCore      	0x00000001038e1a6e JSC::MarkedBlock::aboutToMarkSlow(unsigned int) + 94 (atomic:882)
1   com.apple.JavaScriptCore      	0x0000000103c3cd0a JSC::JSImmutableButterfly::visitChildren(JSC::JSCell*, JSC::SlotVisitor&) + 298 (MarkedBlock.h:559)
2   com.apple.JavaScriptCore      	0x00000001038edb34 JSC::SlotVisitor::drain(WTF::MonotonicTime)::$_3::operator()(JSC::MarkStackArray&) const + 324 (SlotVisitor.cpp:397)
3   com.apple.JavaScriptCore      	0x00000001038ead02 JSC::SlotVisitor::drain(WTF::MonotonicTime) + 210 (SlotVisitorInlines.h:190)
4   com.apple.JavaScriptCore      	0x00000001038eb949 JSC::SlotVisitor::drainInParallel(WTF::MonotonicTime) + 57 (SlotVisitor.cpp:703)
5   com.apple.JavaScriptCore      	0x00000001038c470b JSC::Heap::runFixpointPhase(JSC::GCConductor) + 2027 (SlotVisitor.h:283)
6   com.apple.JavaScriptCore      	0x00000001038c3408 JSC::Heap::runCurrentPhase(JSC::GCConductor, JSC::CurrentThreadState*) + 200 (Heap.cpp:1175)
7   com.apple.JavaScriptCore      	0x00000001038cc5fb WTF::ScopedLambdaFunctor<void (JSC::CurrentThreadState&), JSC::Heap::collectInMutatorThread()::$_0>::implFunction(void*, JSC::CurrentThreadState&) + 27 (Heap.cpp:1791)
8   com.apple.JavaScriptCore      	0x00000001038deba5 JSC::callWithCurrentThreadState(WTF::ScopedLambda<void (JSC::CurrentThreadState&)> const&) + 117 (MachineStackMarker.cpp:226)
9   com.apple.JavaScriptCore      	0x00000001038c6ccd JSC::Heap::collectInMutatorThread() + 93 (CollectingScope.h:43)
10  com.apple.JavaScriptCore      	0x00000001038c6b95 JSC::Heap::stopIfNecessarySlow(unsigned int) + 53 (Heap.cpp:1771)
11  com.apple.JavaScriptCore      	0x00000001038c6a8f JSC::Heap::stopIfNecessarySlow() + 47 (Heap.cpp:1745)
12  com.apple.JavaScriptCore      	0x00000001038c06a4 JSC::Heap::collectIfNecessaryOrDefer(JSC::GCDeferralContext*) + 132 (Heap.cpp:2566)
13  com.apple.JavaScriptCore      	0x00000001038ddff9 JSC::LocalAllocator::allocateSlowCase(JSC::GCDeferralContext*, JSC::AllocationFailureMode) + 281 (LocalAllocator.cpp:128)
14  com.apple.JavaScriptCore      	0x00000001035e9d6d JSC::JSString::createHasOtherOwner(JSC::VM&, WTF::Ref<WTF::StringImpl, WTF::DumbPtrTraits<WTF::StringImpl> >&&) + 269 (LocalAllocatorInlines.h:37)
Comment 3 Keith Miller 2018-12-14 11:10:18 PST
hmm, looks like a GC bug. Do we know roughly when this started?
Comment 4 Alexey Proskuryakov 2018-12-14 11:40:45 PST
This started yesterday. Seems somewhat frequent actually, and impacts other worker tests too, see e.g. <https://build.webkit.org/results/Apple%20Sierra%20Debug%20WK1%20(Tests)/r239187%20(10710)/results.html>
Comment 5 Radar WebKit Bug Importer 2018-12-14 11:41:31 PST
Comment 6 Alexey Proskuryakov 2018-12-14 11:42:44 PST
Maybe we should roll back https://trac.webkit.org/r239153 to see if that was the culprit? Timing wise, it seems likely.
Comment 7 Keith Miller 2018-12-14 13:22:31 PST
(In reply to Alexey Proskuryakov from comment #6)
> Maybe we should roll back https://trac.webkit.org/r239153 to see if that was
> the culprit? Timing wise, it seems likely.

Seems reasonable, we can always reland later.
Comment 8 Ryan Haddad 2018-12-14 13:40:39 PST
Rolling out in https://bugs.webkit.org/show_bug.cgi?id=192715.

Duping this to the original Bugzilla for the change.

*** This bug has been marked as a duplicate of bug 190047 ***