Bug 53853 - Assertion failure in ~JSGlobalObject when loading apple.com HTML5 transitions demo page
Summary: Assertion failure in ~JSGlobalObject when loading apple.com HTML5 transitions...
Status: RESOLVED FIXED
Alias: None
Product: WebKit
Classification: Unclassified
Component: WebCore JavaScript (show other bugs)
Version: 528+ (Nightly build)
Hardware: All All
: P2 Normal
Assignee: Nobody
URL: http://www.apple.com/html5/showcase/t...
Keywords: InRadar
Depends on:
Blocks:
 
Reported: 2011-02-05 07:10 PST by Adam Roben (:aroben)
Modified: 2011-02-07 15:37 PST (History)
9 users (show)

See Also:


Attachments
Patch (3.11 KB, patch)
2011-02-07 14:38 PST, Geoffrey Garen
no flags Details | Formatted Diff | Diff
Patch (3.59 KB, patch)
2011-02-07 14:48 PST, Geoffrey Garen
no flags Details | Formatted Diff | Diff
Patch (3.60 KB, patch)
2011-02-07 15:02 PST, Geoffrey Garen
no flags Details | Formatted Diff | Diff
Patch (3.62 KB, patch)
2011-02-07 15:20 PST, Geoffrey Garen
darin: review+
Details | Formatted Diff | Diff

Note You need to log in before you can comment on or make changes to this bug.
Description Adam Roben (:aroben) 2011-02-05 07:10:52 PST
I went to these URLs, in this order (I think):

http://webkit.org/blog-files/3d-transforms/poster-circle.html
http://webkit.org/blog-files/3d-transforms/morphing-cubes.html
http://annevankesteren.nl/
http://www.apple.com/html5/showcase/transitions/

When the last one was loading, I hit this assertion in ~JSGlobalObject():

    ASSERT(JSLock::currentThreadIsHoldingLock());

Here's the backtrace:

>	JavaScriptCore.dll!JSC::JSGlobalObject::~JSGlobalObject()  Line 97 + 0x2a bytes	C++
 	WebKit.dll!WebCore::JSDOMGlobalObject::~JSDOMGlobalObject()  + 0x16 bytes	C++
 	WebKit.dll!WebCore::JSDOMWindowBase::~JSDOMWindowBase()  + 0x16 bytes	C++
 	WebKit.dll!WebCore::JSDOMWindow::~JSDOMWindow()  Line 1090 + 0x8 bytes	C++
 	WebKit.dll!WebCore::JSDOMWindow::`scalar deleting destructor'()  + 0x16 bytes	C++
 	JavaScriptCore.dll!JSC::MarkedSpace::sweep()  Line 268 + 0x10 bytes	C++
 	JavaScriptCore.dll!JSC::Heap::reset(JSC::Heap::SweepToggle sweepToggle=DoSweep)  Line 386	C++
 	JavaScriptCore.dll!JSC::Heap::collectAllGarbage()  Line 367	C++
 	JavaScriptCore.dll!JSC::Heap::reportExtraMemoryCostSlowCase(unsigned int cost=209083)  Line 96	C++
 	WebKit.dll!JSC::Heap::reportExtraMemoryCost(unsigned int cost=209083)  Line 169	C++
 	WebKit.dll!WebCore::HTMLImageLoader::notifyFinished(WebCore::CachedResource * __formal=0x0abaf7a0)  Line 85	C++
 	WebKit.dll!WebCore::CachedImage::checkNotify()  Line 316 + 0x13 bytes	C++
 	WebKit.dll!WebCore::CachedImage::data(WTF::PassRefPtr<WebCore::SharedBuffer> data={...}, bool allDataReceived=true)  Line 296	C++
 	WebKit.dll!WebCore::CachedResourceRequest::didFinishLoading(WebCore::SubresourceLoader * loader=0x064019f0)  Line 161	C++
 	WebKit.dll!WebCore::SubresourceLoader::didFinishLoading(double finishTime=0.00000000000000000)  Line 181 + 0x1f bytes	C++
 	WebKit.dll!WebCore::ResourceLoader::didFinishLoading(WebCore::ResourceHandle * __formal=0x06846960, double finishTime=0.00000000000000000)  Line 434 + 0x18 bytes	C++
 	WebKit.dll!WebCore::didFinishLoading(_CFURLConnection * conn=0x0696b1f0, const void * clientInfo=0x06846960)  Line 241 + 0x26 bytes	C++
 	CFNetwork.dll!URLConnectionClient::_clientDidFinishLoading()  + 0x2b bytes	C++
 	CFNetwork.dll!URLConnectionClient::ClientConnectionEventQueue::processAllEventsAndConsumePayload()  	C++
 	CFNetwork.dll!URLConnectionClient::processEvents()  + 0x21 bytes	C++
 	CFNetwork.dll!URLConnectionWndProc()  	C++
 	user32.dll!_InternalCallWinProc@20()  + 0x28 bytes	
 	user32.dll!_UserCallWinProcCheckWow@32()  + 0xb7 bytes	
 	user32.dll!_DispatchMessageWorker@8()  + 0xdc bytes	
 	user32.dll!_DispatchMessageW@4()  + 0xf bytes	
 	WebKit.dll!RunLoop::run()  Line 73 + 0xc bytes	C++
 	WebKit.dll!WebKit::WebProcessMain(const WebKit::CommandLine & commandLine={...})  Line 82	C++
 	WebKit.dll!WebKitMain(const WebKit::CommandLine & commandLine={...})  Line 48 + 0x9 bytes	C++
 	WebKit.dll!WebKitMain(HINSTANCE__ * hInstance=0x00400000, HINSTANCE__ * hPrevInstance=0x00000000, wchar_t * lpstrCmdLine=0x0002114c, int nCmdShow=10)  Line 172 + 0x9 bytes	C++
 	WebKit2WebProcess.exe!wWinMain(HINSTANCE__ * hInstance=0x00400000, HINSTANCE__ * hPrevInstance=0x00000000, wchar_t * lpstrCmdLine=0x0002114c, int nCmdShow=10)  Line 44 + 0x18 bytes	C++
 	WebKit2WebProcess.exe!__tmainCRTStartup()  Line 589 + 0x1c bytes	C
 	kernel32.dll!_BaseProcessStart@4()  + 0x23 bytes
Comment 1 Adam Roben (:aroben) 2011-02-06 08:01:59 PST
<rdar://problem/8964321>
Comment 2 Alexey Proskuryakov 2011-02-07 01:26:56 PST
I think that we're just trivially needing a JSLock(SilenceAssertionsOnly) in HTMLImageLoader::notifyFinished().

Same problem exists elsewhere, e.g. in XMLHttpRequest::dropProtection().
Comment 3 Geoffrey Garen 2011-02-07 14:38:29 PST
Created attachment 81521 [details]
Patch
Comment 4 Geoffrey Garen 2011-02-07 14:40:07 PST
Comment on attachment 81521 [details]
Patch

Marking cq+ so the bot can land this.
Comment 5 Collabora GTK+ EWS bot 2011-02-07 14:42:03 PST
Attachment 81521 [details] did not build on gtk:
Build output: http://queues.webkit.org/results/7705806
Comment 6 Geoffrey Garen 2011-02-07 14:48:57 PST
Created attachment 81526 [details]
Patch
Comment 7 Geoffrey Garen 2011-02-07 14:49:19 PST
Comment on attachment 81526 [details]
Patch

One more time, with the build (hopefully) fixed.
Comment 8 Collabora GTK+ EWS bot 2011-02-07 14:51:38 PST
Attachment 81526 [details] did not build on gtk:
Build output: http://queues.webkit.org/results/7711042
Comment 9 Early Warning System Bot 2011-02-07 14:52:34 PST
Attachment 81521 [details] did not build on qt:
Build output: http://queues.webkit.org/results/7711043
Comment 10 Build Bot 2011-02-07 15:00:19 PST
Attachment 81521 [details] did not build on win:
Build output: http://queues.webkit.org/results/7711047
Comment 11 Geoffrey Garen 2011-02-07 15:02:53 PST
Created attachment 81534 [details]
Patch
Comment 12 Geoffrey Garen 2011-02-07 15:04:43 PST
Comment on attachment 81534 [details]
Patch

This time for all the bananas.
Comment 13 Collabora GTK+ EWS bot 2011-02-07 15:12:49 PST
Attachment 81534 [details] did not build on gtk:
Build output: http://queues.webkit.org/results/7708523
Comment 14 Darin Adler 2011-02-07 15:19:44 PST
Comment on attachment 81534 [details]
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=81534&action=review

r=me, except I think you need to get the namespace stuff right so it doesn’t break the GTK build

> Source/WebCore/html/HTMLCanvasElement.cpp:416
> +        JSC::JSLock lock(SilenceAssertionsOnly);

If it’s JSC::JSLock, then it should also be JSC::SilenceAssertionsOnly, right?
Comment 15 Geoffrey Garen 2011-02-07 15:20:57 PST
Created attachment 81540 [details]
Patch
Comment 16 Geoffrey Garen 2011-02-07 15:37:30 PST
Committed r77853: <http://trac.webkit.org/changeset/77853>