229714 – REGRESSION (r281771): ASSERTION FAILED: !m_deletionHasBegun under WebCore::Permissions::~Permissions()

RESOLVED FIXED 229714

REGRESSION (r281771): ASSERTION FAILED: !m_deletionHasBegun under WebCore::Permissions::~Permissions()

https://bugs.webkit.org/show_bug.cgi?id=229714

Summary REGRESSION (r281771): ASSERTION FAILED: !m_deletionHasBegun under WebCore::Pe...

ayumi_kojima

Reported 2021-08-31 09:01:57 PDT

Many fast tests are flaky on macOS-Catalina-Debug-WK1-Tests-EWS. fast/misc/test-observegc.html fast/multicol/block-axis-vertical-lr.html fast/multicol/break-properties.html fast/multicol/column-count-with-rules.html fast/multicol/assert-with-nested-columns-and-spanner.html fast/multicol/column-span-parent-continuation-crash.html fast/parser/broken-comment-4.html fast/repaint/erase-overflow.html fast/repaint/fixed-move-after-keyboard-scroll.html fast/shapes/parsing/parsing-shape-image-threshold.html fast/visual-viewport/viewport-dimensions-iframe.html Crash log: ASSERTION FAILED: !m_deletionHasBegun /Volumes/Data/worker/macOS-Catalina-Debug-Build-EWS/build/WebKitBuild/Debug/usr/local/include/wtf/ThreadSafeRefCounted.h(83) : bool WTF::ThreadSafeRefCountedBase::derefBase() const 1 0x11590b3f9 WTFCrash 2 0x11590b419 WTFCrashWithSecurityImplication 3 0x136533687 WTF::ThreadSafeRefCountedBase::derefBase() const 4 0x1376a419f WTF::ThreadSafeRefCounted<WebCore::PermissionController, (WTF::DestructionThread)0>::deref() const 5 0x1376a4147 WTF::DefaultRefDerefTraits<WebCore::PermissionController>::derefIfNotNull(WebCore::PermissionController*) 6 0x1376a4109 WTF::RefPtr<WebCore::PermissionController, WTF::RawPtrTraits<WebCore::PermissionController>, WTF::DefaultRefDerefTraits<WebCore::PermissionController> >::~RefPtr() 7 0x1376a4095 WTF::RefPtr<WebCore::PermissionController, WTF::RawPtrTraits<WebCore::PermissionController>, WTF::DefaultRefDerefTraits<WebCore::PermissionController> >::~RefPtr() 8 0x1376a4056 WebCore::Permissions::~Permissions() 9 0x1376a4025 WebCore::Permissions::~Permissions() 10 0x1376a3ffb std::__1::default_delete<WebCore::Permissions>::operator()(WebCore::Permissions*) const 11 0x1376a3fbc WTF::RefCounted<WebCore::Permissions, std::__1::default_delete<WebCore::Permissions> >::deref() const 12 0x1376a3f41 WTF::DefaultRefDerefTraits<WebCore::Permissions>::derefIfNotNull(WebCore::Permissions*) 13 0x1376a3f09 WTF::RefPtr<WebCore::Permissions, WTF::RawPtrTraits<WebCore::Permissions>, WTF::DefaultRefDerefTraits<WebCore::Permissions> >::~RefPtr() 14 0x1376a3d25 WTF::RefPtr<WebCore::Permissions, WTF::RawPtrTraits<WebCore::Permissions>, WTF::DefaultRefDerefTraits<WebCore::Permissions> >::~RefPtr() 15 0x138a5c505 WebCore::NavigatorPermissions::~NavigatorPermissions() 16 0x138a472a5 WebCore::NavigatorPermissions::~NavigatorPermissions() 17 0x138a472cc WebCore::NavigatorPermissions::~NavigatorPermissions() 18 0x1369d732f std::__1::default_delete<WebCore::Supplement<WebCore::Navigator> >::operator()(WebCore::Supplement<WebCore::Navigator>*) const 19 0x1369d723f std::__1::unique_ptr<WebCore::Supplement<WebCore::Navigator>, std::__1::default_delete<WebCore::Supplement<WebCore::Navigator> > >::reset(WebCore::Supplement<WebCore::Navigator>*) 20 0x1369d7709 std::__1::unique_ptr<WebCore::Supplement<WebCore::Navigator>, std::__1::default_delete<WebCore::Supplement<WebCore::Navigator> > >::~unique_ptr() 21 0x1369d3125 std::__1::unique_ptr<WebCore::Supplement<WebCore::Navigator>, std::__1::default_delete<WebCore::Supplement<WebCore::Navigator> > >::~unique_ptr() 22 0x1369d646e WTF::KeyValuePair<char const*, std::__1::unique_ptr<WebCore::Supplement<WebCore::Navigator>, std::__1::default_delete<WebCore::Supplement<WebCore::Navigator> > > >::~KeyValuePair() 23 0x1369d6205 WTF::KeyValuePair<char const*, std::__1::unique_ptr<WebCore::Supplement<WebCore::Navigator>, std::__1::default_delete<WebCore::Supplement<WebCore::Navigator> > > >::~KeyValuePair() 24 0x13a549421 WTF::HashTable<char const*, WTF::KeyValuePair<char const*, std::__1::unique_ptr<WebCore::Supplement<WebCore::Navigator>, std::__1::default_delete<WebCore::Supplement<WebCore::Navigator> > > >, WTF::KeyValuePairKeyExtractor<WTF::KeyValuePair<char const*, std::__1::unique_ptr<WebCore::Supplement<WebCore::Navigator>, std::__1::default_delete<WebCore::Supplement<WebCore::Navigator> > > > >, WTF::PtrHash<char const*>, WTF::HashMap<char const*, std::__1::unique_ptr<WebCore::Supplement<WebCore::Navigator>, std::__1::default_delete<WebCore::Supplement<WebCore::Navigator> > >, WTF::PtrHash<char const*>, WTF::HashTraits<char const*>, WTF::HashTraits<std::__1::unique_ptr<WebCore::Supplement<WebCore::Navigator>, std::__1::default_delete<WebCore::Supplement<WebCore::Navigator> > > >, WTF::HashTableTraits>::KeyValuePairTraits, WTF::HashTraits<char const*> >::deallocateTable(WTF::KeyValuePair<char const*, std::__1::unique_ptr<WebCore::Supplement<WebCore::Navigator>, std::__1::default_delete<WebCore::Supplement<WebCore::Navigator> > > >*) 25 0x13a549396 WTF::HashTable<char const*, WTF::KeyValuePair<char const*, std::__1::unique_ptr<WebCore::Supplement<WebCore::Navigator>, std::__1::default_delete<WebCore::Supplement<WebCore::Navigator> > > >, WTF::KeyValuePairKeyExtractor<WTF::KeyValuePair<char const*, std::__1::unique_ptr<WebCore::Supplement<WebCore::Navigator>, std::__1::default_delete<WebCore::Supplement<WebCore::Navigator> > > > >, WTF::PtrHash<char const*>, WTF::HashMap<char const*, std::__1::unique_ptr<WebCore::Supplement<WebCore::Navigator>, std::__1::default_delete<WebCore::Supplement<WebCore::Navigator> > >, WTF::PtrHash<char const*>, WTF::HashTraits<char const*>, WTF::HashTraits<std::__1::unique_ptr<WebCore::Supplement<WebCore::Navigator>, std::__1::default_delete<WebCore::Supplement<WebCore::Navigator> > > >, WTF::HashTableTraits>::KeyValuePairTraits, WTF::HashTraits<char const*> >::~HashTable() 26 0x13a549355 WTF::HashTable<char const*, WTF::KeyValuePair<char const*, std::__1::unique_ptr<WebCore::Supplement<WebCore::Navigator>, std::__1::default_delete<WebCore::Supplement<WebCore::Navigator> > > >, WTF::KeyValuePairKeyExtractor<WTF::KeyValuePair<char const*, std::__1::unique_ptr<WebCore::Supplement<WebCore::Navigator>, std::__1::default_delete<WebCore::Supplement<WebCore::Navigator> > > > >, WTF::PtrHash<char const*>, WTF::HashMap<char const*, std::__1::unique_ptr<WebCore::Supplement<WebCore::Navigator>, std::__1::default_delete<WebCore::Supplement<WebCore::Navigator> > >, WTF::PtrHash<char const*>, WTF::HashTraits<char const*>, WTF::HashTraits<std::__1::unique_ptr<WebCore::Supplement<WebCore::Navigator>, std::__1::default_delete<WebCore::Supplement<WebCore::Navigator> > > >, WTF::HashTableTraits>::KeyValuePairTraits, WTF::HashTraits<char const*> >::~HashTable() 27 0x13a549335 WTF::HashMap<char const*, std::__1::unique_ptr<WebCore::Supplement<WebCore::Navigator>, std::__1::default_delete<WebCore::Supplement<WebCore::Navigator> > >, WTF::PtrHash<char const*>, WTF::HashTraits<char const*>, WTF::HashTraits<std::__1::unique_ptr<WebCore::Supplement<WebCore::Navigator>, std::__1::default_delete<WebCore::Supplement<WebCore::Navigator> > > >, WTF::HashTableTraits>::~HashMap() 28 0x13a548ef5 WTF::HashMap<char const*, std::__1::unique_ptr<WebCore::Supplement<WebCore::Navigator>, std::__1::default_delete<WebCore::Supplement<WebCore::Navigator> > >, WTF::PtrHash<char const*>, WTF::HashTraits<char const*>, WTF::HashTraits<std::__1::unique_ptr<WebCore::Supplement<WebCore::Navigator>, std::__1::default_delete<WebCore::Supplement<WebCore::Navigator> > > >, WTF::HashTableTraits>::~HashMap() 29 0x13a52e82f WebCore::Supplementable<WebCore::Navigator>::~Supplementable() 30 0x13a52e75f WebCore::Navigator::~Navigator() 31 0x13a52e8c5 WebCore::Navigator::~Navigator()

Attachments
Crash log (128.24 KB, text/plain) 2021-08-31 09:03 PDT, ayumi_kojima	no flags	Details
Patch (12.74 KB, patch) 2021-08-31 11:15 PDT, Sihui Liu	ews-feeder: commit-queue-	Details Formatted Diff Diff
Patch (14.19 KB, patch) 2021-08-31 11:50 PDT, Sihui Liu	no flags	Details Formatted Diff Diff
Update test expectation (2.31 KB, patch) 2021-08-31 14:57 PDT, Sihui Liu	no flags	Details Formatted Diff Diff
Patch (2.43 KB, patch) 2021-09-01 10:03 PDT, Sihui Liu	no flags	Details Formatted Diff Diff
Show Obsolete (2) View All Add attachment proposed patch, testcase, etc.

Radar WebKit Bug Importer

Comment 1 2021-08-31 09:02:32 PDT

<rdar://problem/82581552>

ayumi_kojima

Comment 2 2021-08-31 09:03:24 PDT

Created attachment 436890 [details] Crash log

ayumi_kojima

Comment 3 2021-08-31 09:08:31 PDT

The crash is not seen in the open source directory: https://results.webkit.org/?suite=layout-tests&suite=layout-tests&suite=layout-tests&suite=layout-tests&suite=layout-tests&suite=layout-tests&suite=layout-tests&suite=layout-tests&suite=layout-tests&suite=layout-tests&suite=layout-tests&test=fast%2Fmulticol%2Fblock-axis-vertical-lr.html&test=fast%2Fmisc%2Ftest-observegc.html&test=fast%2Fmulticol%2Fbreak-properties.html&test=fast%2Fmulticol%2Fcolumn-count-with-rules.html&test=fast%2Fmulticol%2Fassert-with-nested-columns-and-spanner.html&test=fast%2Fmulticol%2Fcolumn-span-parent-continuation-crash.html&test=fast%2Frepaint%2Ffixed-move-after-keyboard-scroll.html&test=fast%2Fvisual-viewport%2Fviewport-dimensions-iframe.html&test=fast%2Fparser%2Fbroken-comment-4.html&test=fast%2Fshapes%2Fparsing%2Fparsing-shape-image-threshold.html&test=fast%2Frepaint%2Ferase-overflow.html

ayumi_kojima

Comment 4 2021-08-31 09:10:03 PDT

Seems like the assertion started showing up at this build https://ews-build.webkit.org/#/builders/56/builds/14057

ayumi_kojima

Comment 5 2021-08-31 09:14:14 PDT

fast/repaint/fixed-in-page-scale.html is a pre-existing failure on EWS with the same assertion

ayumi_kojima

Comment 6 2021-08-31 09:25:06 PDT

Marked test expectation to speed up EWS https://trac.webkit.org/changeset/281807/webkit

Ryan Haddad

Comment 7 2021-08-31 09:52:43 PDT

Since this crash is happening under WebCore::NavigatorPermissions, it is almost certainly related to https://commits.webkit.org/241108@main

Sihui Liu

Comment 8 2021-08-31 11:15:18 PDT

Created attachment 436917 [details] Patch

Chris Dumez

Comment 9 2021-08-31 11:38:09 PDT

Comment on attachment 436917 [details] Patch View in context: https://bugs.webkit.org/attachment.cgi?id=436917&action=review r=me with nit. > Source/WebCore/Modules/permissions/PermissionController.h:53 > PermissionState query(ClientOrigin&&, PermissionDescriptor&&) final { return PermissionState::Denied; } We should make the constructor private: DummyPermissionController() = default;

Sihui Liu

Comment 10 2021-08-31 11:50:19 PDT

Created attachment 436920 [details] Patch

EWS

Comment 11 2021-08-31 13:38:00 PDT

Committed r281818 (241154@main): <https://commits.webkit.org/241154@main> All reviewed patches have been landed. Closing bug and clearing flags on attachment 436920 [details].

Sihui Liu

Comment 12 2021-08-31 14:57:14 PDT

Created attachment 436949 [details] Update test expectation

Sihui Liu

Comment 13 2021-09-01 10:03:44 PDT

Reopening to attach new patch.

Sihui Liu

Comment 14 2021-09-01 10:03:45 PDT

Created attachment 437038 [details] Patch

EWS

Comment 15 2021-09-01 10:56:06 PDT

Committed r281859 (241189@main): <https://commits.webkit.org/241189@main> All reviewed patches have been landed. Closing bug and clearing flags on attachment 437038 [details].

Note You need to log in before you can comment on or make changes to this bug.

Status RESOLVED

Resolution FIXED

Priority P2

Severity Normal

Classification Unclassified

Version WebKit Nightly Build

Hardware Mac (Intel)

OS Unspecified

Product WebKit

Component New Bugs

Assignee

Sihui Liu

Reported

2021-08-31 09:01 PDT

Modified

2021-09-01 10:56 PDT History

CC List

7 users Show

URL

Keywords InRadar

Depends on

Blocks