Bug 217203 – [ iOS ] ASSERTION FAILED: ScriptDisallowedScope::InMainThread::isEventDispatchAllowedInSubtree

• Status: RESOLVED
• Resolution: FIXED
• Component: New Bugs

[Hector Lopez]

Created attachment 410295 [details]
run-api-test stdio for 267847

TestWebKitAPI.WKAttachmentTestsIOS.TargetedPreviewsWhenDroppingImages

Test is failing according to history on iOS. Occurrence of first failure correspond with introduction of testing. Test is shows it is crashing with assertion failed when looking at run-api-test stdio (see attached or below). Could not reproduce the crash or failure on local machine.

History:

https://results.webkit.org/?suite=api-tests&test=TestWebKitAPI.WKAttachmentTestsIOS.TargetedPreviewsWhenDroppingImages

Crash log:

TestWebKitAPI.WKAttachmentTestsIOS.TargetedPreviewsWhenDroppingImages
        ASSERTION FAILED: ScriptDisallowedScope::InMainThread::isEventDispatchAllowedInSubtree(*this)
        ./dom/Node.cpp(2353) : void WebCore::Node::dispatchSubtreeModifiedEvent()
        1   0x35e297169 WTFCrash
        2   0x35e297189 WTFCrashWithSecurityImplication
        3   0x3689e75f3 WebCore::Node::dispatchSubtreeModifiedEvent()
        4   0x3688fbe33 WebCore::Element::didRemoveAttribute(WebCore::QualifiedName const&, WTF::AtomString const&)
        5   0x3688ee016 WebCore::Element::removeAttributeInternal(unsigned int, WebCore::Element::SynchronizationOfLazyAttribute)
        6   0x3688ee16c WebCore::Element::removeAttribute(WebCore::QualifiedName const&)
        7   0x36971386c WebCore::DragController::finalizeDroppedImagePlaceholder(WebCore::HTMLImageElement&)
        8   0x349413a34 WebKit::WebPage::didFinishLoadingImageForElement(WebCore::HTMLImageElement&)
        9   0x3496c7091 WebKit::WebChromeClient::didFinishLoadingImageForElement(WebCore::HTMLImageElement&)
        10  0x3697d6f8b WebCore::Page::didFinishLoadingImageForElement(WebCore::HTMLImageElement&)
        11  0x36a101752 WebCore::RenderImage::notifyFinished(WebCore::CachedResource&, WebCore::NetworkLoadMetrics const&)
        12  0x36963bbaf WebCore::CachedResource::didAddClient(WebCore::CachedResourceClient&)
        13  0x36963b770 WebCore::CachedImage::didAddClient(WebCore::CachedResourceClient&)
        14  0x369644f62 WebCore::CachedResource::addClient(WebCore::CachedResourceClient&)
        15  0x36a104c22 WebCore::RenderImageResource::setCachedImage(WebCore::CachedImage*)
        16  0x368da30fb WebCore::HTMLImageElement::didAttachRenderers()
        17  0x36a480d87 WebCore::RenderTreeUpdater::updateAfterDescendants(WebCore::Element&, WebCore::Style::ElementUpdates const*)
        18  0x36a480ca0 WebCore::RenderTreeUpdater::popParent()
        19  0x36a4801e0 WebCore::RenderTreeUpdater::popParentsToDepth(unsigned int)
        20  0x36a47fb86 WebCore::RenderTreeUpdater::updateRenderTree(WebCore::ContainerNode&)
        21  0x36a47f6c3 WebCore::RenderTreeUpdater::commit(std::__1::unique_ptr<WebCore::Style::Update const, std::__1::default_delete<WebCore::Style::Update const> >)
        22  0x36881feed WebCore::Document::updateRenderTree(std::__1::unique_ptr<WebCore::Style::Update const, std::__1::default_delete<WebCore::Style::Update const> >)
        23  0x36882045d WebCore::Document::resolveStyle(WebCore::Document::ResolveStyleType)
        24  0x368820dfd WebCore::Document::updateStyleIfNeeded()
        25  0x36974b3b7 WebCore::FrameView::updateLayoutAndStyleIfNeededRecursive()
        26  0x3697cf3ee WebCore::Page::layoutIfNeeded()
        27  0x3697cf5d9 WebCore::Page::updateRendering()
        28  0x34998f2a6 WebKit::WebPage::updateRendering()
        29  0x3483f44eb WebKit::RemoteLayerTreeDrawingArea::updateRendering()
        30  0x3483fedd7 decltype(*(std::__1::forward<WebKit::RemoteLayerTreeDrawingArea*&>(fp0)).*fp()) std::__1::__invoke<void (WebKit::RemoteLayerTreeDrawingArea::*&)(), WebKit::RemoteLayerTreeDrawingArea*&, void>(void (WebKit::RemoteLayerTreeDrawingArea::*&)(), WebKit::RemoteLayerTreeDrawingArea*&)
        31  0x3483fed50 std::__1::__bind_return<void (WebKit::RemoteLayerTreeDrawingArea::*)(), std::__1::tuple<WebKit::RemoteLayerTreeDrawingArea*>, std::__1::tuple<>, __is_valid_bind_return<void (WebKit::RemoteLayerTreeDrawingArea::*)(), std::__1::tuple<WebKit::RemoteLayerTreeDrawingArea*>, std::__1::tuple<> >::value>::type std::__1::__apply_functor<void (WebKit::RemoteLayerTreeDrawingArea::*)(), std::__1::tuple<WebKit::RemoteLayerTreeDrawingArea*>, 0ul, std::__1::tuple<> >(void (WebKit::RemoteLayerTreeDrawingArea::*&)(), std::__1::tuple<WebKit::RemoteLayerTreeDrawingArea*>&, std::__1::__tuple_indices<0ul>, std::__1::tuple<>&&)
        LEAK: 1 WebProcessPool
        LEAK: 1 WebPageProxy
        
        /Volumes/Data/slave/ios-simulator-14-debug/build/Tools/TestWebKitAPI/Tests/WebKitCocoa/WKAttachmentTests.mm:1758
        Value of: CGRectContainsPoint([imageElementBounds firstObject].CGRectValue, firstDelayedPreview.target.center)
          Actual: false
        Expected: true
        
        
        /Volumes/Data/slave/ios-simulator-14-debug/build/Tools/TestWebKitAPI/Tests/WebKitCocoa/WKAttachmentTests.mm:1762
        Value of: CGRectContainsPoint([imageElementBounds lastObject].CGRectValue, secondDelayedPreview.target.center)
          Actual: false
        Expected: true
        
        
        /Volumes/Data/slave/ios-simulator-14-debug/build/Tools/TestWebKitAPI/cocoa/TestWKWebView.mm:156
        Expected equality of these values:
          count
            Which is: 2
          [self stringByEvaluatingJavaScript:script].integerValue
            Which is: 0
        
        
        /Volumes/Data/slave/ios-simulator-14-debug/build/Tools/TestWebKitAPI/Tests/WebKitCocoa/WKAttachmentTests.mm:1767
        Expected equality of these values:
          pngAttachment.info.contentType
            Which is: ""
          @"image/png"
            Which is: "image/png"
        
        
        /Volumes/Data/slave/ios-simulator-14-debug/build/Tools/TestWebKitAPI/Tests/WebKitCocoa/WKAttachmentTests.mm:1768
        Expected equality of these values:
          gifAttachment.info.contentType
            Which is: ""
          @"image/gif"
            Which is: "image/gif"
        


Preparing upload data ...
"xcrun --sdk iphonesimulator --show-sdk-version" took 0.01s
"perl Tools/Scripts/webkit-build-directory --ios-simulator" took 1.11s
"svn info" took 0.02s
"svn info" took 0.02s
"svn info" took 0.02s
"svn info" took 0.02s
"svn info" took 0.02s
"svn info" took 0.02s
"svn info" took 0.02s
"svn info" took 0.02s
Uploading to https://results.webkit.org ...
Starting new HTTPS connection (1): results.webkit.org:443
https://results.webkit.org:443 "POST /api/upload HTTP/1.1" 200 168
    Uploaded results to https://results.webkit.org
Uploads completed!
Testing completed, Exit status: 3
No handlers could be found for logger "webkitpy.common.system.executive"

[Radar WebKit Bug Importer]

<rdar://problem/69864747>

[Hector Lopez]

First appearance of crash/failure that I could find on

https://build.webkit.org/builders/Apple-iPadOS-14-Simulator-Debug-WK2-Tests?numbuilds=50

is at build #1:

https://build.webkit.org/builders/Apple-iPadOS-14-Simulator-Debug-WK2-Tests/builds/1

but changes for that build do not appear to be assisted with a change for the crash/failure

[Hector Lopez]

Able to reproduce crash on r 267814 with

run-api-tests --ios-simulator

[Hector Lopez]

Could not reproduce on r267814 with:

run-api-tests TestWebKitAPI.WKAttachmentTestsIOS.TargetedPreviewsWhenDroppingImages --iterations 100 exit-after-n-failures 3 --ios-simulator

[Wenson Hsieh]

Created attachment 410372 [details]
Patch

[EWS]

Committed r267915: <https://trac.webkit.org/changeset/267915>

All reviewed patches have been landed. Closing bug and clearing flags on attachment 410372 [details].