Bug 304387 – [WebXR] ASSERTION FAILED: heap.vm().currentThreadIsHoldingAPILock() in JSC::LocalAllocator::allocateSlowCase under WebCore::WebXRSystem::resolveRequestedFeatures

• Status: RESOLVED
• Resolution: FIXED
• Component: WebXR

[Fujii Hironori]

[WebXR] ASSERTION FAILED: heap.vm().currentThreadIsHoldingAPILock() in JSC::LocalAllocator::allocateSlowCase under WebCore::WebXRSystem::resolveRequestedFeatures

I tested with GTK Debug MiniBrowser 304634@main

1. Start monado-service
2. ./Tools/Scripts/run-minibrowser --gtk --debug
3. Load the test content
4. Click "click"
5. Accept "Permission Reuqest"
6. Click the reload button
7. Click "click"
7. ASSERTION FAILED

ASSERTION FAILED: heap.vm().currentThreadIsHoldingAPILock()
../../../Source/JavaScriptCore/heap/LocalAllocator.cpp(116) : void *JSC::LocalAllocator::allocateSlowCase(JSC::Heap &, size_t, GCDeferralContext *, AllocationFailureMode)
1   0x7f5160d9709a JSC::LocalAllocator::allocateSlowCase(JSC::Heap&, unsigned long, JSC::GCDeferralContext*, JSC::AllocationFailureMode)
2   0x7f515f8b46aa JSC::LocalAllocator::allocate(JSC::Heap&, unsigned long, JSC::GCDeferralContext*, JSC::AllocationFailureMode)::{lambda()#1}::operator()() const
3   0x7f515f8b455c JSC::HeapCell* JSC::FreeList::allocateWithCellSize<JSC::LocalAllocator::allocate(JSC::Heap&, unsigned long, JSC::GCDeferralContext*, JSC::AllocationFailureMode)::{lambda()#1}>(JSC::LocalAllocator::allocate(JSC::Heap&, unsigned long, JSC::GCDeferralContext*, JSC::AllocationFailureMode)::{lambda()#1} const&, unsigned long)
4   0x7f515f8b445e JSC::LocalAllocator::allocate(JSC::Heap&, unsigned long, JSC::GCDeferralContext*, JSC::AllocationFailureMode)
5   0x7f515f8b3eec JSC::GCClient::IsoSubspace::allocate(JSC::VM&, unsigned long, JSC::GCDeferralContext*, JSC::AllocationFailureMode)
6   0x7f515f8c9a03 void* JSC::tryAllocateCellHelper<JSC::JSString, (JSC::AllocationFailureMode)0>(JSC::VM&, unsigned long, JSC::GCDeferralContext*)
7   0x7f515f8c95d1 void* JSC::allocateCell<JSC::JSString>(JSC::VM&, unsigned long)
8   0x7f515f8c9166 JSC::JSString::create(JSC::VM&, WTF::Ref<WTF::StringImpl, WTF::RawPtrTraits<WTF::StringImpl>, WTF::DefaultRefDerefTraits<WTF::StringImpl> >&&)
9   0x7f516182151e JSC::jsStringWithCacheSlowCase(JSC::VM&, WTF::StringImpl&)
10  0x7f517086e573 JSC::jsStringWithCache(JSC::VM&, WTF::String const&)
11  0x7f5173be1829 WebCore::WebXRSystem::resolveRequestedFeatures(PlatformXR::SessionMode, WebCore::XRSessionInit const&, WTF::RefPtr<PlatformXR::Device, WTF::RawPtrTraits<PlatformXR::Device>, WTF::DefaultRefDerefTraits<PlatformXR::Device> >, JSC::JSGlobalObject&) const
12  0x7f5173be207c WebCore::WebXRSystem::resolveFeaturePermissions(PlatformXR::SessionMode, WebCore::XRSessionInit const&, WTF::RefPtr<PlatformXR::Device, WTF::RawPtrTraits<PlatformXR::Device>, WTF::DefaultRefDerefTraits<PlatformXR::Device> >, JSC::JSGlobalObject&, WTF::CompletionHandler<void (std::optional<WTF::Vector<PlatformXR::SessionFeature, 0ul, WTF::CrashOnOverflow, 16ul, WTF::FastMalloc> >&&)>&&) const
13  0x7f5173bf3cb8 WebCore::WebXRSystem::requestSession(WebCore::Document&, PlatformXR::SessionMode, WebCore::XRSessionInit const&, WebCore::DOMPromiseDeferred<WebCore::IDLInterface<WebCore::WebXRSession> >&&)::$_0::operator()(WTF::ThreadSafeWeakPtr<PlatformXR::Device, WTF::NoTaggingTraits<PlatformXR::Device> >)
14  0x7f5173bf3a92 WTF::Detail::CallableWrapper<WebCore::WebXRSystem::requestSession(WebCore::Document&, PlatformXR::SessionMode, WebCore::XRSessionInit const&, WebCore::DOMPromiseDeferred<WebCore::IDLInterface<WebCore::WebXRSession> >&&)::$_0, void, WTF::ThreadSafeWeakPtr<PlatformXR::Device, WTF::NoTaggingTraits<PlatformXR::Device> > >::call(WTF::ThreadSafeWeakPtr<PlatformXR::Device, WTF::NoTaggingTraits<PlatformXR::Device> >)
15  0x7f5173bf15f5 WTF::Function<void (WTF::ThreadSafeWeakPtr<PlatformXR::Device, WTF::NoTaggingTraits<PlatformXR::Device> >)>::operator()(WTF::ThreadSafeWeakPtr<PlatformXR::Device, WTF::NoTaggingTraits<PlatformXR::Device> >) const
16  0x7f5173be0f3b WTF::CompletionHandler<void (WTF::ThreadSafeWeakPtr<PlatformXR::Device, WTF::NoTaggingTraits<PlatformXR::Device> >)>::operator()(WTF::ThreadSafeWeakPtr<PlatformXR::Device, WTF::NoTaggingTraits<PlatformXR::Device> >)
17  0x7f5173bf1db8 WebCore::WebXRSystem::obtainCurrentDevice(PlatformXR::SessionMode, WTF::Vector<JSC::JSValue, 0ul, WTF::CrashOnOverflow, 16ul, WTF::FastMalloc> const&, WTF::Vector<JSC::JSValue, 0ul, WTF::CrashOnOverflow, 16ul, WTF::FastMalloc> const&, WTF::CompletionHandler<void (WTF::ThreadSafeWeakPtr<PlatformXR::Device, WTF::NoTaggingTraits<PlatformXR::Device> >)>&&)::$_0::operator()()
18  0x7f5173bf1d79 WTF::Detail::CallableWrapper<WebCore::WebXRSystem::obtainCurrentDevice(PlatformXR::SessionMode, WTF::Vector<JSC::JSValue, 0ul, WTF::CrashOnOverflow, 16ul, WTF::FastMalloc> const&, WTF::Vector<JSC::JSValue, 0ul, WTF::CrashOnOverflow, 16ul, WTF::FastMalloc> const&, WTF::CompletionHandler<void (WTF::ThreadSafeWeakPtr<PlatformXR::Device, WTF::NoTaggingTraits<PlatformXR::Device> >)>&&)::$_0, void>::call()
19  0x7f516da2a0f7 WTF::Function<void ()>::operator()() const
20  0x7f516de777b2 WTF::CompletionHandler<void ()>::operator()()
21  0x7f516ec270e9 WTF::Detail::CallableWrapper<WTF::CompletionHandler<void ()>, void>::call()
22  0x7f516077b0d7 WTF::Function<void ()>::operator()() const
23  0x7f5162533de1 WTF::RunLoop::performWork()
24  0x7f5162745b69 WTF::RunLoop::RunLoop()::$_0::operator()(void*) const
25  0x7f5162745b49 WTF::RunLoop::RunLoop()::$_0::__invoke(void*)
26  0x7f5162745802 WTF::RunLoop::$_3::operator()(_GSource*, int (*)(void*), void*) const
27  0x7f51627430a9 WTF::RunLoop::$_3::__invoke(_GSource*, int (*)(void*), void*)
28  0x7f51630f249e ???
29  0x7f51630f2710 g_main_context_dispatch
30  0x7f5162743bb7 WTF::RunLoop::runGLibMainLoopIteration(WTF::RunLoop::MayBlock)
31  0x7f5162743fe0 WTF::RunLoop::runGLibMainLoop()

[Fujii Hironori]

Created attachment 477778 [details]
test case

[Radar WebKit Bug Importer]

<rdar://problem/167161463>

[Fujii Hironori]

Pull request: https://github.com/WebKit/WebKit/pull/55929

[EWS]

Committed 305130@main (e0fa2d4c905e): <https://commits.webkit.org/305130@main>

Reviewed commits have been landed. Closing PR #55929 and removing active labels.