Bug 66740 – Some compositing LayoutTests flakily crashing on Mac 10.6

• Status: RESOLVED
• Resolution: FIXED
• Component: Tools / Tests

[Peter Kasting]

The following layout test is flaky on Chromium Mac 10.6, mostly crashing.  See e.g. http://test-results.appspot.com/dashboards/flakiness_dashboard.html#tests=compositing%2Fgeometry%2Fancestor-overflow-change.html&showExpectations=true&group=%40ToT%20GPU%20Mesa%20-%20chromium.org .

compositing/geometry/ancestor-overflow-change.html

Here's the stack from one of the crashes.  More detail available at the above link.

Thread 0 Crashed:  Dispatch queue: com.apple.main-thread
0   com.apple.testnetscapeplugin  	0x1d2becac NPP_SetWindow + 282 (main.cpp:360)
1   DumpRenderTree                	0x6dff395b webkit::npapi::PluginInstance::NPP_SetWindow(_NPWindow*) + 421
2   DumpRenderTree                	0x6e027276 webkit::npapi::WebPluginDelegateImpl::WindowlessSetWindow() + 342
3   DumpRenderTree                	0x6e02783e webkit::npapi::WebPluginDelegateImpl::WindowlessUpdateGeometry(gfx::Rect const&, gfx::Rect const&) + 618
4   DumpRenderTree                	0x6e02317c webkit::npapi::WebPluginDelegateImpl::UpdateGeometry(gfx::Rect const&, gfx::Rect const&) + 124
5   DumpRenderTree                	0x6e032c0e webkit::npapi::WebPluginImpl::updateGeometry(WebKit::WebRect const&, WebKit::WebRect const&, WebKit::WebVector<WebKit::WebRect> const&, bool) + 806
6   DumpRenderTree                	0x6b7322fc WebKit::WebPluginContainerImpl::reportGeometry() + 304
7   DumpRenderTree                	0x6b732a50 WebKit::WebPluginContainerImpl::setFrameRect(WebCore::IntRect const&) + 78
8   DumpRenderTree                	0x6db65c86 WebCore::RenderWidget::setWidgetGeometry(WebCore::IntRect const&, WebCore::IntSize const&) + 330
9   DumpRenderTree                	0x6db65f05 WebCore::RenderWidget::updateWidgetPosition() + 433
10  DumpRenderTree                	0x6db53025 WebCore::RenderView::updateWidgetPositions() + 103
11  DumpRenderTree                	0x6d733d3a WebCore::FrameView::performPostLayoutTasks() + 522
12  DumpRenderTree                	0x6d7392c9 WebCore::FrameView::layout(bool) + 4017
13  DumpRenderTree                	0x6ccdc4b6 WebCore::Document::updateLayout() + 280
14  DumpRenderTree                	0x6cce0049 WebCore::Document::updateLayoutIgnorePendingStylesheets() + 235
15  DumpRenderTree                	0x6cd37ed0 WebCore::Element::innerText() + 60
16  DumpRenderTree                	0x6b6f966b WebKit::WebElement::innerText() + 67
17  DumpRenderTree                	0x6b649fa4 dumpDocumentText(WebKit::WebFrame*) + 150 (TestShell.cpp:343)
18  DumpRenderTree                	0x6b64a18b dumpFramesAsText(WebKit::WebFrame*, bool) + 380 (TestShell.cpp:357)
19  DumpRenderTree                	0x6b64a577 TestShell::dump() + 807 (TestShell.cpp:514)
20  DumpRenderTree                	0x6b64ab08 TestShell::testFinished() + 78 (TestShell.cpp:327)
21  DumpRenderTree                	0x6b62893a LayoutTestController::WorkQueue::processWorkSoon() + 174 (LayoutTestController.cpp:256)
22  DumpRenderTree                	0x6b6289d7 LayoutTestController::locationChangeDone() + 129 (LayoutTestController.cpp:628)
23  DumpRenderTree                	0x6b65bc66 WebViewHost::locationChangeDone(WebKit::WebFrame*) + 80 (WebViewHost.cpp:1366)
24  DumpRenderTree                	0x6b65bd35 WebViewHost::didFinishLoad(WebKit::WebFrame*) + 171 (WebViewHost.cpp:1014)
25  DumpRenderTree                	0x6b69d3ed WebKit::FrameLoaderClientImpl::dispatchDidFinishLoad() + 147
26  DumpRenderTree                	0x6d63a9c8 WebCore::FrameLoader::checkLoadCompleteForThisFrame() + 1926
27  DumpRenderTree                	0x6d63abdc WebCore::FrameLoader::checkLoadComplete() + 364
28  DumpRenderTree                	0x6d63ad13 WebCore::FrameLoader::finishedLoading() + 265
29  DumpRenderTree                	0x6d657813 WebCore::MainResourceLoader::didFinishLoading(double) + 359
30  DumpRenderTree                	0x6d671779 WebCore::ResourceLoader::didFinishLoading(WebCore::ResourceHandle*, double) + 199
31  DumpRenderTree                	0x6b6ca454 WebCore::ResourceHandleInternal::didFinishLoading(WebKit::WebURLLoader*, double) + 248
32  DumpRenderTree                	0x6e07a00a webkit_glue::WebURLLoaderImpl::Context::OnCompletedRequest(net::URLRequestStatus const&, std::string const&, base::Time const&) + 832
33  DumpRenderTree                	0x6e160d19 (anonymous namespace)::RequestProxy::NotifyCompletedRequest(net::URLRequestStatus const&, std::string const&, base::Time const&) + 107
34  DumpRenderTree                	0x6e16161e void DispatchToMethod<(anonymous namespace)::RequestProxy, void ((anonymous namespace)::RequestProxy::*)(net::URLRequestStatus const&, std::string const&, base::Time const&), net::URLRequestStatus, std::string, base::Time>((anonymous namespace)::RequestProxy*, void ((anonymous namespace)::RequestProxy::*)(net::URLRequestStatus const&, std::string const&, base::Time const&), Tuple3<net::URLRequestStatus, std::string, base::Time> const&) + 121
35  DumpRenderTree                	0x6e16168a RunnableMethod<(anonymous namespace)::RequestProxy, void ((anonymous namespace)::RequestProxy::*)(net::URLRequestStatus const&, std::string const&, base::Time const&), Tuple3<net::URLRequestStatus, std::string, base::Time> >::Run() + 80
36  DumpRenderTree                	0x6bde5c74 base::subtle::TaskClosureAdapter::Run() + 58
37  DumpRenderTree                	0x6bdec91e base::internal::Invoker1<false, base::internal::InvokerStorage1<void (base::subtle::TaskClosureAdapter::*)(), base::subtle::TaskClosureAdapter*>, void (base::subtle::TaskClosureAdapter::*)()>::DoInvoke(base::internal::InvokerStorageBase*) + 122
38  DumpRenderTree                	0x6bd740dc base::Callback<void ()()>::Run() const + 62
39  DumpRenderTree                	0x6bd7014f MessageLoop::RunTask(MessageLoop::PendingTask const&) + 413
40  DumpRenderTree                	0x6bd702a5 MessageLoop::DeferOrRunPendingTask(MessageLoop::PendingTask const&) + 85
41  DumpRenderTree                	0x6bd705e1 MessageLoop::DoWork() + 271
42  DumpRenderTree                	0x6bd12fd1 base::MessagePumpCFRunLoopBase::RunWork() + 105
43  DumpRenderTree                	0x6bd131e5 base::MessagePumpCFRunLoopBase::RunWorkSource(void*) + 51
44  com.apple.CoreFoundation      	0x944694cb __CFRunLoopDoSources0 + 1563
45  com.apple.CoreFoundation      	0x94466f8f __CFRunLoopRun + 1071
46  com.apple.CoreFoundation      	0x94466464 CFRunLoopRunSpecific + 452
47  com.apple.CoreFoundation      	0x94466291 CFRunLoopRunInMode + 97
48  com.apple.HIToolbox           	0x98a72e04 RunCurrentEventLoopInMode + 392
49  com.apple.HIToolbox           	0x98a72bb9 ReceiveNextEventCommon + 354
50  com.apple.HIToolbox           	0x98a72a3e BlockUntilNextEventMatchingListInMode + 81
51  com.apple.AppKit              	0x9923778d _DPSNextEvent + 847
52  com.apple.AppKit              	0x99236fce -[NSApplication nextEventMatchingMask:untilDate:inMode:dequeue:] + 156
53  com.apple.AppKit              	0x991f9247 -[NSApplication run] + 821
54  DumpRenderTree                	0x6bd127a4 base::MessagePumpNSApplication::DoRun(base::MessagePump::Delegate*) + 304
55  DumpRenderTree                	0x6bd12cc7 base::MessagePumpCFRunLoopBase::Run(base::MessagePump::Delegate*) + 177
56  DumpRenderTree                	0x6bd717c1 MessageLoop::RunInternal() + 245
57  DumpRenderTree                	0x6bd7180b MessageLoop::RunHandler() + 45
58  DumpRenderTree                	0x6bd718d7 MessageLoop::Run() + 63
59  DumpRenderTree                	0x6b88d3e4 webkit_support::RunMessageLoop() + 41
60  DumpRenderTree                	0x6b654218 TestShell::waitTestFinished() + 364 (TestShellMac.mm:121)
61  DumpRenderTree                	0x6b64b620 TestShell::runFileTest(TestParams const&) + 684 (TestShell.cpp:236)
62  DumpRenderTree                	0x6b613823 runTest(TestShell&, TestParams&, std::string const&, bool) + 1069 (DumpRenderTree.cpp:125)
63  DumpRenderTree                	0x6b6142ef main + 2705 (DumpRenderTree.cpp:248)
64  DumpRenderTree                	0x6b5fb9f2 start + 54

[Peter Kasting]

Another test with a very similar stack (see http://test-results.appspot.com/dashboards/flakiness_dashboard.html#showExpectations=true&group=%40ToT%20GPU%20Mesa%20-%20chromium.org&tests=compositing%2Fscaling%2Ftiled-layer-recursion.html ):

compositing/scaling/tiled-layer-recursion.html

Top of stack is:


Thread 0 Crashed:  Dispatch queue: com.apple.main-thread
0   com.apple.testnetscapeplugin  	0x1d2becac NPP_SetWindow + 282 (main.cpp:360)
1   DumpRenderTree                	0x6dff395b webkit::npapi::PluginInstance::NPP_SetWindow(_NPWindow*) + 421
2   DumpRenderTree                	0x6e027276 webkit::npapi::WebPluginDelegateImpl::WindowlessSetWindow() + 342
3   DumpRenderTree                	0x6e02783e webkit::npapi::WebPluginDelegateImpl::WindowlessUpdateGeometry(gfx::Rect const&, gfx::Rect const&) + 618
4   DumpRenderTree                	0x6e02317c webkit::npapi::WebPluginDelegateImpl::UpdateGeometry(gfx::Rect const&, gfx::Rect const&) + 124
5   DumpRenderTree                	0x6e032c0e webkit::npapi::WebPluginImpl::updateGeometry(WebKit::WebRect const&, WebKit::WebRect const&, WebKit::WebVector<WebKit::WebRect> const&, bool) + 806
6   DumpRenderTree                	0x6b7322fc WebKit::WebPluginContainerImpl::reportGeometry() + 304

[Peter Kasting]

Two more flakily crashing tests with the same stack:

platform/chromium/compositing/force-compositing-mode/overflow-iframe-leave-compositing.html
platform/chromium/compositing/force-compositing-mode/overflow-hidden-iframe-layer.html

[Peter Kasting]

A bunch more failing cases:

plugins/invalidate_rect.html
compositing/geometry/fixed-in-composited.html
compositing/geometry/limit-layer-bounds-transformed-overflow.html
compositing/iframes/connect-compositing-iframe-delayed.html
compositing/iframes/connect-compositing-iframe3.html
compositing/iframes/iframe-resize.html
compositing/iframes/repaint-after-losing-scrollbars.html
platform/chromium/compositing/layout-width-change.html

Looks like this is a widespread problem.

Also, compositing/geometry/limit-layer-bounds-transformed-overflow.html is flakily crashing on Linux as well.  Here's the stack for that.  Maybe this is the same root cause?:

ASSERTION FAILED: m_ptr
third_party/WebKit/Source/JavaScriptCore/wtf/OwnPtr.h(62) : typename WTF::RemovePointer<T>::Type& WTF::OwnPtr<T>::operator*() const [with T = WebCore::CCLayerTilingData]
[8250:8250:10973662710745:ERROR:process_util_posix.cc(134)] Received signal 11

[James Robinson]

I think the CCLayerTilingData crash is fixed by http://trac.webkit.org/changeset/93640.  I'll try looking in to the mac plugin crashes tomorrow, they are very strange (the tests that are crashing don't have plugins in the html).

[Peter Kasting]

Another:

compositing/overflow/fixed-position-ancestor-clip.html

[Peter Kasting]

More:

compositing/iframes/become-composited-nested-iframes.html
compositing/iframes/overlapped-iframe.html
compositing/iframes/overlapped-nested-iframes.html

[Peter Kasting]

Wow, strange.  fast/ruby/text-emphasis.html failed with the same stack -- during the normal (non-GPU) section of the run.  That's the first time I've seen this stack outside the GPU runs.

[James Robinson]

I think I see it, we're missing a dumb null check.  I think the reason you are seeing it on so many different tests is because it's fallout from a previous test that causing the subsequent test to crash.  Let me post a patch and we can see how much it helps.

[James Robinson]

Created attachment 105064 [details]
Patch

[James Robinson]

Committed r93737: <http://trac.webkit.org/changeset/93737>