Bug 7274 - Assertion failure in TimerBase::checkHeapIndex() (Timer.cpp:199) !timerHeap->isEmpty()
Summary: Assertion failure in TimerBase::checkHeapIndex() (Timer.cpp:199) !timerHeap->...
Status: RESOLVED FIXED
Alias: None
Product: WebKit
Classification: Unclassified
Component: WebKit Misc. (show other bugs)
Version: 420+
Hardware: Macintosh OS X 10.4
: P2 Major
Assignee: Darin Adler
URL: http://www.apple.com/itunes/1billion/
Keywords:
: 7256 7292 7307 (view as bug list)
Depends on:
Blocks:
 
Reported: 2006-02-15 07:37 PST by mitz
Modified: 2006-02-20 10:19 PST (History)
4 users (show)

See Also:


Attachments
Proposed patch (1.23 KB, patch)
2006-02-15 15:59 PST, mitz
darin: review+
Details | Formatted Diff | Diff

Note You need to log in before you can comment on or make changes to this bug.
Description mitz 2006-02-15 07:37:52 PST
ASSERTION FAILED: !timerHeap->isEmpty() (WebCore/platform/Timer.cpp:199 void WebCore::TimerBase::checkHeapIndex() const)

#0  0x01c26d20 in WebCore::TimerBase::checkHeapIndex (this=0x1438e3c0) at WebCore/platform/Timer.cpp:199
#1  0x01ada2c0 in WebCore::TimerBase::heapDecreaseKey (this=0x1438e3c0) at WebCore/platform/Timer.cpp:217
#2  0x01c277a4 in WebCore::TimerBase::heapPop (this=0x1438e3c0) at WebCore/platform/Timer.cpp:260
#3  0x01c27840 in WebCore::TimerBase::heapIncreaseKey (this=0x1438e3c0) at WebCore/platform/Timer.cpp:241
#4  0x01ada6bc in WebCore::TimerBase::setNextFireTime (this=0x1438e3c0, newTime=1140015679.7352819) at WebCore/platform/Timer.cpp:294
#5  0x01ada7f0 in WebCore::TimerBase::fireTimers (fireTime=1140015679.7352819, firingTimers=@0xbfffe4c0) at WebCore/platform/Timer.cpp:330
#6  0x01ada8c4 in WebCore::TimerBase::sharedTimerFired () at WebCore/platform/Timer.cpp:350
#7  0x01ad9d40 in WebCore::timerFired () at WebCore/platform/mac/SharedTimerMac.cpp:44
#8  0x90770aec in __CFRunLoopDoTimer ()

The  timer in question had an m_heapIndex of -1 and an oldTime of 2.1174059774237895e-203 in setNextFireTime. (newTime was 1140015679.7352819).
Comment 1 mitz 2006-02-15 08:30:18 PST
And another one:
ASSERTION FAILED: (*timerHeap)[m_heapIndex] == this (WebCore/platform/Timer.cpp:202 void WebCore::TimerBase::checkHeapIndex() const)

This time m_heapIndex was 0, timerHeap->size() was 4, but none of the timers in the heap was ==this. oldTime was 6.6921152619080891e-203 and newTime was 1140019944.457437.

Where are those oldTime values coming from?
Comment 2 Darin Adler 2006-02-15 10:15:05 PST
oldTime of 6.6921152619080891e-203 is completely bogus. We should never see a time like this. The value of oldTime is the old value of m_nextFireTime.
Comment 3 mitz 2006-02-15 10:21:42 PST
Memory smashing? I set a breakpoint on where m_nextFireTime is assigned a value and it was never assigned a non-zero value smaller than 100, yet it did end up having such a value.

The third symptom, again pointing in that direction, is crashing on calling a pure virtual function -- TimerBase::fired() --

(gdb) p *timer
$28 = {
  <Noncopyable> = {<No data fields>}, 
  members of TimerBase: 
  _vptr$TimerBase = 0x0, 
  m_nextFireTime = 2.2833798994238128e-314, 
  m_repeatInterval = 2.2893483626215314e-314, 
  m_heapIndex = 1
}
Comment 4 Darin Adler 2006-02-15 10:29:22 PST
_vptr$TimerBase = 0x0 means that this is not a good object -- that is a pointer to the vtable and should never be 0.
Comment 5 Alexey Proskuryakov 2006-02-15 13:22:15 PST
For me, this is easily reproducible with the following steps:
1. Go to http://www.squarefree.com/bookmarklets/webdevel.html
2. Click on "shell" - a new window appears
3. Press Cmd+W to close it

Repeat steps 2 and 3 a few times. Sometimes it's an assertion failure, sometimes a quit with "pure virtual method called/terminate called without an active exception".
Comment 6 Darin Adler 2006-02-15 13:31:52 PST
I'll look at this as soon as I can.
Comment 7 mitz 2006-02-15 15:36:17 PST
I think I figured this out: when a timer is fired in TimerBase::fireTimers it can cause not only itself -- but also a subsequent element in the firingTimers array -- to be deleted. I have observed this in the debugger.
Comment 8 mitz 2006-02-15 15:59:17 PST
Created attachment 6515 [details]
Proposed patch

I don't know how to make a layout test for this bug.
Comment 9 Darin Adler 2006-02-15 16:36:51 PST
Comment on attachment 6515 [details]
Proposed patch

All I can say is ... wow! Thanks. r=me
Comment 10 mitz 2006-02-16 14:52:11 PST
*** Bug 7307 has been marked as a duplicate of this bug. ***
Comment 11 mitz 2006-02-18 09:52:58 PST
*** Bug 7256 has been marked as a duplicate of this bug. ***
Comment 12 Eric Seidel (no email) 2006-02-20 10:19:52 PST
*** Bug 7292 has been marked as a duplicate of this bug. ***