Bug 198795 - API Test [Mojave+ WK2 Debug ] TestWebKitAPI.WKAttachmentTestsMac.InsertDroppedFilePromisesAsAttachments is a flaky crash
Summary: API Test [Mojave+ WK2 Debug ] TestWebKitAPI.WKAttachmentTestsMac.InsertDroppe...
Status: NEW
Alias: None
Product: WebKit
Classification: Unclassified
Component: WebKit API (show other bugs)
Version: WebKit Nightly Build
Hardware: Unspecified Unspecified
: P2 Normal
Assignee: Nobody
URL:
Keywords: InRadar
Depends on:
Blocks:
 
Reported: 2019-06-12 11:05 PDT by Shawn Roberts
Modified: 2019-06-24 10:38 PDT (History)
7 users (show)

See Also:


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Shawn Roberts 2019-06-12 11:05:33 PDT
The following API test is a flaky crash on Mojave+ WK2 Debug testers

TestWebKitAPI.WKAttachmentTestsMac.InsertDroppedFilePromisesAsAttachments

Test was added in r235137

Test appears to have been a flaky crash for quite some time now but it appears we have not noticed it.

around 6/07/2019 it started to crash more consistently and around 6/11/2019 started to crash every 3 runs or so.

https://build.webkit.org/builders/Apple%20Mojave%20Debug%20WK2%20%28Tests%29?numbuilds=200 I can see a crash back on May 31st as well. https://build.webkit.org/builders/Apple%20Mojave%20Debug%20WK2%20%28Tests%29/builds/2836/steps/run-api-tests/logs/stdio

Reproduced locally 2 ways. 

run-api-tests TestWebKitAPI.WKAttachmentTestsMac.InsertDroppedFilePromisesAsAttachments --iter 200 --debug

I can also reproduce it in guard malloc and it fails more consistently in that configuration.

I can reproduce the crash in both modes going all the way back to r235137 and it produces the same crash. I don't know if recent jsc changes in this area may have made it more consistent. 

Attaching the full crash log and the guard malloc crash log to the radar. 

0   com.apple.JavaScriptCore      	0x000000010bc798cd bmalloc::SmallLine::deref(std::__1::unique_lock<bmalloc::Mutex>&) + 45
1   com.apple.JavaScriptCore      	0x000000010bc795fc bmalloc::Heap::derefSmallLine(std::__1::unique_lock<bmalloc::Mutex>&, bmalloc::Object, std::__1::array<bmalloc::List<bmalloc::SmallPage>, 112ul>&) + 60
2   com.apple.JavaScriptCore      	0x000000010bc79525 bmalloc::Deallocator::processObjectLog(std::__1::unique_lock<bmalloc::Mutex>&) + 165
3   com.apple.JavaScriptCore      	0x000000010bc7976e bmalloc::Deallocator::deallocateSlowCase(void*) + 270
4   com.apple.JavaScriptCore      	0x000000010bbe3244 bmalloc::Deallocator::deallocate(void*) + 68
5   com.apple.JavaScriptCore      	0x000000010bbe31e5 bmalloc::Cache::deallocate(bmalloc::HeapKind, void*) + 165
6   com.apple.JavaScriptCore      	0x000000010bbe277b bmalloc::api::free(void*, bmalloc::HeapKind) + 27
7   com.apple.JavaScriptCore      	0x000000010bbe2757 WTF::fastFree(void*) + 23
8   com.apple.JavaScriptCore      	0x000000010bc40737 WTF::StringWrapperCFAllocator::deallocate(void*, void*) + 103
Comment 1 Shawn Roberts 2019-06-12 11:06:45 PDT
Adding Wenson who created the test. Andy who made a recent change that affected Catalina, and Saam and Keith who appear to have made some changes in the past on bmalloc::SmallLine::deref and have had recent changes in this area after the test seems to have gotten more flaky?
Comment 2 Radar WebKit Bug Importer 2019-06-12 11:08:34 PDT
<rdar://problem/51674325>
Comment 3 Wenson Hsieh 2019-06-12 11:22:28 PDT
(In reply to Shawn Roberts from comment #1)
> Adding Wenson who created the test. Andy who made a recent change that
> affected Catalina, and Saam and Keith who appear to have made some changes
> in the past on bmalloc::SmallLine::deref and have had recent changes in this
> area after the test seems to have gotten more flaky?

I don’t think this test failure is relevant to JSC.
Comment 4 Ryan Haddad 2019-06-24 10:38:25 PDT
Disabled test in https://trac.webkit.org/r246739