Bug 53853 – Assertion failure in ~JSGlobalObject when loading apple.com HTML5 transitions demo page

• Status: RESOLVED
• Resolution: FIXED
• Component: WebCore JavaScript

[Adam Roben (:aroben)]

I went to these URLs, in this order (I think):

http://webkit.org/blog-files/3d-transforms/poster-circle.html
http://webkit.org/blog-files/3d-transforms/morphing-cubes.html
http://annevankesteren.nl/
http://www.apple.com/html5/showcase/transitions/

When the last one was loading, I hit this assertion in ~JSGlobalObject():

    ASSERT(JSLock::currentThreadIsHoldingLock());

Here's the backtrace:

>	JavaScriptCore.dll!JSC::JSGlobalObject::~JSGlobalObject()  Line 97 + 0x2a bytes	C++
 	WebKit.dll!WebCore::JSDOMGlobalObject::~JSDOMGlobalObject()  + 0x16 bytes	C++
 	WebKit.dll!WebCore::JSDOMWindowBase::~JSDOMWindowBase()  + 0x16 bytes	C++
 	WebKit.dll!WebCore::JSDOMWindow::~JSDOMWindow()  Line 1090 + 0x8 bytes	C++
 	WebKit.dll!WebCore::JSDOMWindow::`scalar deleting destructor'()  + 0x16 bytes	C++
 	JavaScriptCore.dll!JSC::MarkedSpace::sweep()  Line 268 + 0x10 bytes	C++
 	JavaScriptCore.dll!JSC::Heap::reset(JSC::Heap::SweepToggle sweepToggle=DoSweep)  Line 386	C++
 	JavaScriptCore.dll!JSC::Heap::collectAllGarbage()  Line 367	C++
 	JavaScriptCore.dll!JSC::Heap::reportExtraMemoryCostSlowCase(unsigned int cost=209083)  Line 96	C++
 	WebKit.dll!JSC::Heap::reportExtraMemoryCost(unsigned int cost=209083)  Line 169	C++
 	WebKit.dll!WebCore::HTMLImageLoader::notifyFinished(WebCore::CachedResource * __formal=0x0abaf7a0)  Line 85	C++
 	WebKit.dll!WebCore::CachedImage::checkNotify()  Line 316 + 0x13 bytes	C++
 	WebKit.dll!WebCore::CachedImage::data(WTF::PassRefPtr<WebCore::SharedBuffer> data={...}, bool allDataReceived=true)  Line 296	C++
 	WebKit.dll!WebCore::CachedResourceRequest::didFinishLoading(WebCore::SubresourceLoader * loader=0x064019f0)  Line 161	C++
 	WebKit.dll!WebCore::SubresourceLoader::didFinishLoading(double finishTime=0.00000000000000000)  Line 181 + 0x1f bytes	C++
 	WebKit.dll!WebCore::ResourceLoader::didFinishLoading(WebCore::ResourceHandle * __formal=0x06846960, double finishTime=0.00000000000000000)  Line 434 + 0x18 bytes	C++
 	WebKit.dll!WebCore::didFinishLoading(_CFURLConnection * conn=0x0696b1f0, const void * clientInfo=0x06846960)  Line 241 + 0x26 bytes	C++
 	CFNetwork.dll!URLConnectionClient::_clientDidFinishLoading()  + 0x2b bytes	C++
 	CFNetwork.dll!URLConnectionClient::ClientConnectionEventQueue::processAllEventsAndConsumePayload()  	C++
 	CFNetwork.dll!URLConnectionClient::processEvents()  + 0x21 bytes	C++
 	CFNetwork.dll!URLConnectionWndProc()  	C++
 	user32.dll!_InternalCallWinProc@20()  + 0x28 bytes	
 	user32.dll!_UserCallWinProcCheckWow@32()  + 0xb7 bytes	
 	user32.dll!_DispatchMessageWorker@8()  + 0xdc bytes	
 	user32.dll!_DispatchMessageW@4()  + 0xf bytes	
 	WebKit.dll!RunLoop::run()  Line 73 + 0xc bytes	C++
 	WebKit.dll!WebKit::WebProcessMain(const WebKit::CommandLine & commandLine={...})  Line 82	C++
 	WebKit.dll!WebKitMain(const WebKit::CommandLine & commandLine={...})  Line 48 + 0x9 bytes	C++
 	WebKit.dll!WebKitMain(HINSTANCE__ * hInstance=0x00400000, HINSTANCE__ * hPrevInstance=0x00000000, wchar_t * lpstrCmdLine=0x0002114c, int nCmdShow=10)  Line 172 + 0x9 bytes	C++
 	WebKit2WebProcess.exe!wWinMain(HINSTANCE__ * hInstance=0x00400000, HINSTANCE__ * hPrevInstance=0x00000000, wchar_t * lpstrCmdLine=0x0002114c, int nCmdShow=10)  Line 44 + 0x18 bytes	C++
 	WebKit2WebProcess.exe!__tmainCRTStartup()  Line 589 + 0x1c bytes	C
 	kernel32.dll!_BaseProcessStart@4()  + 0x23 bytes

[Adam Roben (:aroben)]

<rdar://problem/8964321>

[Alexey Proskuryakov]

I think that we're just trivially needing a JSLock(SilenceAssertionsOnly) in HTMLImageLoader::notifyFinished().

Same problem exists elsewhere, e.g. in XMLHttpRequest::dropProtection().

[Geoffrey Garen]

Created attachment 81521 [details]
Patch

[Geoffrey Garen]

Comment on attachment 81521 [details]
Patch

Marking cq+ so the bot can land this.

[Collabora GTK+ EWS bot]

Attachment 81521 [details] did not build on gtk:
Build output: http://queues.webkit.org/results/7705806

[Geoffrey Garen]

Created attachment 81526 [details]
Patch

[Geoffrey Garen]

Comment on attachment 81526 [details]
Patch

One more time, with the build (hopefully) fixed.

[Collabora GTK+ EWS bot]

Attachment 81526 [details] did not build on gtk:
Build output: http://queues.webkit.org/results/7711042

[Early Warning System Bot]

Attachment 81521 [details] did not build on qt:
Build output: http://queues.webkit.org/results/7711043

[Build Bot]

Attachment 81521 [details] did not build on win:
Build output: http://queues.webkit.org/results/7711047

[Geoffrey Garen]

Created attachment 81534 [details]
Patch

[Geoffrey Garen]

Comment on attachment 81534 [details]
Patch

This time for all the bananas.

[Collabora GTK+ EWS bot]

Attachment 81534 [details] did not build on gtk:
Build output: http://queues.webkit.org/results/7708523

[Darin Adler]

Comment on attachment 81534 [details]
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=81534&action=review

r=me, except I think you need to get the namespace stuff right so it doesn’t break the GTK build

> Source/WebCore/html/HTMLCanvasElement.cpp:416
> +        JSC::JSLock lock(SilenceAssertionsOnly);

If it’s JSC::JSLock, then it should also be JSC::SilenceAssertionsOnly, right?

[Geoffrey Garen]

Created attachment 81540 [details]
Patch

[Geoffrey Garen]

Committed r77853: <http://trac.webkit.org/changeset/77853>