RESOLVED FIXED 248750
REGRESSION(257266@main): Various iOS layout tests asserting in RemoteImageBufferProxy::~RemoteImageBufferProxy() 
https://bugs.webkit.org/show_bug.cgi?id=248750
Summary REGRESSION(257266@main): Various iOS layout tests asserting in RemoteImageBuf...
Simon Fraser (smfr)
Reported 2022-12-04 20:40:23 PST
This test run https://build.webkit.org/results/Apple-iOS-16-Simulator-Debug-WK2-Tests/257362@main%20(388)/results.html shows these tests asserting: http/tests/security/showModalDialog-sync-cross-origin-page-load.html imported/w3c/web-platform-tests/IndexedDB/database-names-by-origin.html imported/w3c/web-platform-tests/content-security-policy/inheritance/window.html imported/w3c/web-platform-tests/fetch/api/headers/header-values-normalize.any.html imported/w3c/web-platform-tests/html/browsers/browsing-the-web/navigating-across-documents/failure-check-sequence.https.html imported/w3c/web-platform-tests/html/browsers/browsing-the-web/navigating-across-documents/initial-empty-document/window-open-204.html imported/w3c/web-platform-tests/html/browsers/the-window-object/closed-attribute.window.html imported/w3c/web-platform-tests/html/browsers/the-window-object/open-close/open-features-negative-innerwidth-innerheight.html imported/w3c/web-platform-tests/html/browsers/the-window-object/open-close/open-features-negative-screenx-screeny.html imported/w3c/web-platform-tests/html/browsers/the-window-object/open-close/open-features-negative-top-left.html imported/w3c/web-platform-tests/html/browsers/the-window-object/open-close/open-features-negative-width-height.html imported/w3c/web-platform-tests/html/browsers/the-window-object/open-close/open-features-non-integer-innerheight.html imported/w3c/web-platform-tests/html/browsers/the-window-object/open-close/open-features-non-integer-top.html imported/w3c/web-platform-tests/mixed-content/imageset.https.sub.html imported/w3c/web-platform-tests/service-workers/service-worker/http-to-https-redirect-and-register.https.html imported/w3c/web-platform-tests/service-workers/service-worker/navigation-sets-cookie.https.html imported/w3c/web-platform-tests/workers/modules/dedicated-worker-import-referrer.html imported/w3c/web-platform-tests/workers/modules/shared-worker-import-referrer.html imported/w3c/web-platform-tests/worklets/audio-worklet-csp.https.html imported/w3c/web-platform-tests/worklets/audio-worklet-referrer.https.html imported/w3c/web-platform-tests/worklets/paint-worklet-csp.https.html imported/w3c/web-platform-tests/worklets/paint-worklet-referrer.https.html Many of these are asserting here: Thread 2 Crashed:: Dispatch queue: com.apple.WebKit.WebContent.RemoteLayerTreeDrawingArea.CommitQueue 0 com.apple.JavaScriptCore 0x140bf975e WTFCrash 1 com.apple.WebKit 0x121bdefba WTFCrashWithInfo(int, char const*, char const*, int) 2 com.apple.WebKit 0x123ba80ba WTF::WeakPtr<WebKit::RemoteRenderingBackendProxy, WTF::DefaultWeakPtrImpl>::operator->() const 3 com.apple.WebKit 0x123bca826 WebKit::RemoteImageBufferProxy::~RemoteImageBufferProxy() 4 com.apple.WebKit 0x123bcaae4 WebKit::RemoteImageBufferProxy::~RemoteImageBufferProxy() 5 com.apple.WebKit 0x123bcab08 WebKit::RemoteImageBufferProxy::~RemoteImageBufferProxy() 6 com.apple.WebKit 0x1225430ee WTF::ThreadSafeRefCounted<WebCore::ImageBuffer, (WTF::DestructionThread)0>::deref() const::'lambda'()::operator()() const 7 com.apple.WebKit 0x122543066 WTF::ThreadSafeRefCounted<WebCore::ImageBuffer, (WTF::DestructionThread)0>::deref() const 8 com.apple.WebKit 0x123cbc8ec WTF::Ref<WebKit::RemoteImageBufferProxy, WTF::RawPtrTraits<WebKit::RemoteImageBufferProxy> >::~Ref() 9 com.apple.WebKit 0x123cbc894 WTF::Ref<WebKit::RemoteImageBufferProxy, WTF::RawPtrTraits<WebKit::RemoteImageBufferProxy> >::~Ref() 10 com.apple.WebKit 0x123cbc86c WebKit::ThreadSafeRemoteImageBufferFlusher::~ThreadSafeRemoteImageBufferFlusher() 11 com.apple.WebKit 0x123cbc824 WebKit::ThreadSafeRemoteImageBufferFlusher::~ThreadSafeRemoteImageBufferFlusher() 12 com.apple.WebKit 0x123ccd528 WebKit::ThreadSafeRemoteImageBufferFlusher::~ThreadSafeRemoteImageBufferFlusher() 13 com.apple.WebKit 0x1222fef5c std::__1::default_delete<WebCore::ThreadSafeImageBufferFlusher>::operator()(WebCore::ThreadSafeImageBufferFlusher*) const 14 com.apple.WebKit 0x1222feedc std::__1::unique_ptr<WebCore::ThreadSafeImageBufferFlusher, std::__1::default_delete<WebCore::ThreadSafeImageBufferFlusher> >::reset(WebCore::ThreadSafeImageBufferFlusher*) 15 com.apple.WebKit 0x1222fee78 std::__1::unique_ptr<WebCore::ThreadSafeImageBufferFlusher, std::__1::default_delete<WebCore::ThreadSafeImageBufferFlusher> >::~unique_ptr() 16 com.apple.WebKit 0x1222fee54 std::__1::unique_ptr<WebCore::ThreadSafeImageBufferFlusher, std::__1::default_delete<WebCore::ThreadSafeImageBufferFlusher> >::~unique_ptr() 17 com.apple.WebKit 0x1222fee1e WTF::VectorDestructor<true, std::__1::unique_ptr<WebCore::ThreadSafeImageBufferFlusher, std::__1::default_delete<WebCore::ThreadSafeImageBufferFlusher> > >::destruct(std::__1::unique_ptr<WebCore::ThreadSafeImageBufferFlusher, std::__1::default_delete<WebCore::ThreadSafeImageBufferFlusher> >*, std::__1::unique_ptr<WebCore::ThreadSafeImageBufferFlusher, std::__1::default_delete<WebCore::ThreadSafeImageBufferFlusher> >*) 18 com.apple.WebKit 0x1222fed5c WTF::VectorTypeOperations<std::__1::unique_ptr<WebCore::ThreadSafeImageBufferFlusher, std::__1::default_delete<WebCore::ThreadSafeImageBufferFlusher> > >::destruct(std::__1::unique_ptr<WebCore::ThreadSafeImageBufferFlusher, std::__1::default_delete<WebCore::ThreadSafeImageBufferFlusher> >*, std::__1::unique_ptr<WebCore::ThreadSafeImageBufferFlusher, std::__1::default_delete<WebCore::ThreadSafeImageBufferFlusher> >*) 19 com.apple.WebKit 0x1222fecee WTF::Vector<std::__1::unique_ptr<WebCore::ThreadSafeImageBufferFlusher, std::__1::default_delete<WebCore::ThreadSafeImageBufferFlusher> >, 0ul, WTF::CrashOnOverflow, 16ul, WTF::FastMalloc>::~Vector() 20 com.apple.WebKit 0x1222f4e54 WTF::Vector<std::__1::unique_ptr<WebCore::ThreadSafeImageBufferFlusher, std::__1::default_delete<WebCore::ThreadSafeImageBufferFlusher> >, 0ul, WTF::CrashOnOverflow, 16ul, WTF::FastMalloc>::~Vector() 21 com.apple.WebKit 0x1222fb9ac WebKit::RemoteLayerTreeDrawingArea::BackingStoreFlusher::~BackingStoreFlusher() 22 com.apple.WebKit 0x1222fb984 WebKit::RemoteLayerTreeDrawingArea::BackingStoreFlusher::~BackingStoreFlusher() 23 com.apple.WebKit 0x1222fb95a WTF::ThreadSafeRefCounted<WebKit::RemoteLayerTreeDrawingArea::BackingStoreFlusher, (WTF::DestructionThread)0>::deref() const::'lambda'()::operator()() const 24 com.apple.WebKit 0x1222fb926 WTF::ThreadSafeRefCounted<WebKit::RemoteLayerTreeDrawingArea::BackingStoreFlusher, (WTF::DestructionThread)0>::deref() const 25 com.apple.WebKit 0x1222fb8ae WTF::DefaultRefDerefTraits<WebKit::RemoteLayerTreeDrawingArea::BackingStoreFlusher>::derefIfNotNull(WebKit::RemoteLayerTreeDrawingArea::BackingStoreFlusher*) 26 com.apple.WebKit 0x1222fb878 WTF::RefPtr<WebKit::RemoteLayerTreeDrawingArea::BackingStoreFlusher, WTF::RawPtrTraits<WebKit::RemoteLayerTreeDrawingArea::BackingStoreFlusher>, WTF::DefaultRefDerefTraits<WebKit::RemoteLayerTreeDrawingArea::BackingStoreFlusher> >::~RefPtr() 27 com.apple.WebKit 0x1222f2754 WTF::RefPtr<WebKit::RemoteLayerTreeDrawingArea::BackingStoreFlusher, WTF::RawPtrTraits<WebKit::RemoteLayerTreeDrawingArea::BackingStoreFlusher>, WTF::DefaultRefDerefTraits<WebKit::RemoteLayerTreeDrawingArea::BackingStoreFlusher> >::~RefPtr() 28 com.apple.WebKit 0x1222f8be4 WebKit::RemoteLayerTreeDrawingArea::updateRendering()::$_3::~$_3() 29 com.apple.WebKit 0x1222f5064 WebKit::RemoteLayerTreeDrawingArea::updateRendering()::$_3::~$_3() 30 com.apple.WebKit 0x1222f5048 __destroy_helper_block_e8_32c66_ZTSKZN6WebKit26RemoteLayerTreeDrawingArea15updateRenderingEvE3$_3 31 libsystem_blocks.dylib 0x1048b520c _call_dispose_helpers_excp + 44 /Library/Caches/com.apple.xbs/Sources/libclosure_Sim/generic_helpers.c:30 32 libsystem_blocks.dylib 0x1048b5f90 _Block_release + 228 /Library/Caches/com.apple.xbs/Sources/libclosure_Sim/runtime.cpp:0 33 libdispatch.dylib 0x104b57a3a _dispatch_client_callout + 8 /Library/Caches/com.apple.xbs/Sources/libdispatch_Sim/src/object.m:560 34 libdispatch.dylib 0x104b5f346 _dispatch_lane_serial_drain + 948 /Library/Caches/com.apple.xbs/Sources/libdispatch_Sim/src/inline_internal.h:2632 35 libdispatch.dylib 0x104b5ffe2 _dispatch_lane_invoke + 398 /Library/Caches/com.apple.xbs/Sources/libdispatch_Sim/src/queue.c:3940 36 libdispatch.dylib 0x104b6cb46 _dispatch_workloop_worker_thread + 870 /Library/Caches/com.apple.xbs/Sources/libdispatch_Sim/src/queue.c:6846 37 libsystem_pthread.dylib 0x1060befd0 _pthread_wqthread + 326 /AppleInternal/Library/BuildRoots/a0876c02-1788-11ed-b9c4-96898e02b808/Library/Caches/com.apple.xbs/Sources/libpthread/src/pthread.c:2599 38 libsystem_pthread.dylib 0x1060bdf56 start_wqthread + 14
Attachments
Add attachment proposed patch, testcase, etc.
Radar WebKit Bug Importer
Comment 1 2022-12-04 20:40:47 PST
<rdar://problem/102967237>
Simon Fraser (smfr)
Comment 2 2022-12-04 20:41:55 PST
ASSERTION FAILED: !m_impl || !m_shouldEnableAssertions || m_impl->wasConstructedOnMainThread() == isMainThread() /Volumes/Data/worker/Apple-iOS-16-Simulator-Debug-Build/build/WebKitBuild/Debug-iphonesimulator/usr/local/include/wtf/WeakPtr.h(135) : T *WTF::WeakPtr<WebKit::RemoteRenderingBackendProxy>::operator->() const [T = WebKit::RemoteRenderingBackendProxy, WeakPtrImpl = WTF::DefaultWeakPtrImpl] 1 0x801214759 WTFCrash 2 0x7e21f9fbb WTFCrashWithInfo(int, char const*, char const*, int) 3 0x7e41c30ba WTF::WeakPtr<WebKit::RemoteRenderingBackendProxy, WTF::DefaultWeakPtrImpl>::operator->() const 4 0x7e41e5826 WebKit::RemoteImageBufferProxy::~RemoteImageBufferProxy() 5 0x7e41e5ae5 WebKit::RemoteImageBufferProxy::~RemoteImageBufferProxy() 6 0x7e41e5b09 WebKit::RemoteImageBufferProxy::~RemoteImageBufferProxy()
Kimmo Kinnunen
Comment 3 2022-12-05 03:31:43 PST
Pull request: https://github.com/WebKit/WebKit/pull/7143
EWS
Comment 4 2022-12-07 00:20:02 PST
Committed 257460@main (5df080eee4f3): <https://commits.webkit.org/257460@main> Reviewed commits have been landed. Closing PR #7143 and removing active labels.
Note You need to log in before you can comment on or make changes to this bug.