Bug 89954 – [GTK] http/tests/xmlhttprequest/reentrant-cancel.html randomly crashing in debug bot

• Status: NEW
• Component: WebKitGTK

[Mario Sanchez Prada]

This test has been randomly crashing in the GTK 64bit debug bot after it got introduced in r120845.

As per the backtrace, it seems there's an issue while cancelling the SoupMessage:

Thread 1 (Thread 0x7fbf8586f900 (LWP 26081)):
#0  0x00007fbf7d1be405 in raise () from /lib/x86_64-linux-gnu/libc.so.6
#1  0x00007fbf7d1c1680 in abort () from /lib/x86_64-linux-gnu/libc.so.6
#2  0x00007fbf7d1f4dbb in ?? () from /lib/x86_64-linux-gnu/libc.so.6
#3  0x00007fbf7d1fe606 in ?? () from /lib/x86_64-linux-gnu/libc.so.6
#4  0x00007fbf7d20333c in free () from /lib/x86_64-linux-gnu/libc.so.6
#5  0x00007fbf7e8aa7ca in g_free () from /home/slave/webkitgtk/gtk-linux-64-debug/build/WebKitBuild/Dependencies/Root/lib64/libglib-2.0.so.0
#6  0x00007fbf858e877e in soup_message_headers_clear () from /home/slave/webkitgtk/gtk-linux-64-debug/build/WebKitBuild/Dependencies/Root/lib64/libsoup-2.4.so.1
#7  0x00007fbf858e8672 in soup_message_headers_free () from /home/slave/webkitgtk/gtk-linux-64-debug/build/WebKitBuild/Dependencies/Root/lib64/libsoup-2.4.so.1
#8  0x00007fbf858e406c in finalize () from /home/slave/webkitgtk/gtk-linux-64-debug/build/WebKitBuild/Dependencies/Root/lib64/libsoup-2.4.so.1
#9  0x00007fbf7e9b59c9 in g_object_unref () from /home/slave/webkitgtk/gtk-linux-64-debug/build/WebKitBuild/Dependencies/Root/lib64/libgobject-2.0.so.0
#10 0x00007fbf858ecb9d in soup_message_queue_item_unref () from /home/slave/webkitgtk/gtk-linux-64-debug/build/WebKitBuild/Dependencies/Root/lib64/libsoup-2.4.so.1
#11 0x00007fbf858fa293 in soup_session_cancel_message () from /home/slave/webkitgtk/gtk-linux-64-debug/build/WebKitBuild/Dependencies/Root/lib64/libsoup-2.4.so.1
#12 0x00007fbf813a8b1a in WebCore::ResourceHandle::cancel (this=0x109c6c80) at ../../Source/WebCore/platform/network/soup/ResourceHandleSoup.cpp:736
#13 0x00007fbf811e6032 in WebCore::ResourceLoader::cancel (this=0x108f1160, error=...) at ../../Source/WebCore/loader/ResourceLoader.cpp:374
#14 0x00007fbf811e5e9d in WebCore::ResourceLoader::cancel (this=0x108f1160) at ../../Source/WebCore/loader/ResourceLoader.cpp:338
#15 0x00007fbf811efab3 in WebCore::SubresourceLoader::cancelIfNotFinishing (this=0x108f1160) at ../../Source/WebCore/loader/SubresourceLoader.cpp:129
#16 0x00007fbf8116927d in WebCore::CachedRawResource::allClientsRemoved (this=0x10926c00) at ../../Source/WebCore/loader/cache/CachedRawResource.cpp:93
#17 0x00007fbf8116c12c in WebCore::CachedResource::removeClient (this=0x10926c00, client=0x10a6ef88) at ../../Source/WebCore/loader/cache/CachedResource.cpp:437
#18 0x00007fbf811903a0 in WebCore::DocumentThreadableLoader::~DocumentThreadableLoader (this=0x10a6ef60, __in_chrg=<optimized out>) at ../../Source/WebCore/loader/DocumentThreadableLoader.cpp:144
#19 0x00007fbf81192528 in WTF::RefCounted<WebCore::DocumentThreadableLoader>::deref (this=0x10a6ef68) at ../../Source/WTF/wtf/RefCounted.h:190
#20 0x00007fbf811923ce in WebCore::DocumentThreadableLoader::derefThreadableLoader (this=0x10a6ef60) at ../../Source/WebCore/loader/DocumentThreadableLoader.h:67
#21 0x00007fbf80f0062f in WebCore::ThreadableLoader::deref (this=0x10a6ef60) at ../../Source/WebCore/loader/ThreadableLoader.h:79
#22 0x00007fbf80f009b6 in WTF::derefIfNotNull<WebCore::ThreadableLoader> (ptr=0x10a6ef60) at ../../Source/WTF/wtf/PassRefPtr.h:52
#23 0x00007fbf80f00862 in WTF::RefPtr<WebCore::ThreadableLoader>::operator= (this=0x108d3c18, optr=0x0) at ../../Source/WTF/wtf/RefPtr.h:126
#24 0x00007fbf8181775c in WebCore::XMLHttpRequest::internalAbort (this=0x108d3b40) at ../../Source/WebCore/xml/XMLHttpRequest.cpp:782
#25 0x00007fbf81815d75 in WebCore::XMLHttpRequest::open (this=0x108d3b40, method="GET", url=..., async=true, ec=@0x7fffd05f99ec) at ../../Source/WebCore/xml/XMLHttpRequest.cpp:446
#26 0x00007fbf80b32f6b in WebCore::JSXMLHttpRequest::open (this=0x7fbf3408d6c0, exec=0x7fbf2fc00138) at ../../Source/WebCore/bindings/js/JSXMLHttpRequestCustom.cpp:102
#27 0x00007fbf81c1f44b in WebCore::jsXMLHttpRequestPrototypeFunctionOpen (exec=0x7fbf2fc00138) at DerivedSources/WebCore/JSXMLHttpRequest.cpp:536
#28 0x00007fbf36089265 in ?? ()
#29 0x00007fffd05f9bd0 in ?? ()
#30 0x00007fbf85348a78 in llint_op_call () from /home/slave/webkitgtk/gtk-linux-64-debug/build/WebKitBuild/Debug/.libs/libjavascriptcoregtk-3.0.so.0
#31 0x00007fffd05f9b50 in ?? ()
#32 0x00007fbf85180326 in JSC::Register::operator= (this=0x1803668, v=...) at ../../Source/JavaScriptCore/interpreter/Register.h:116
#33 0x00007fbf852f44bc in JSC::JITCode::execute (this=0x7fbf2fbbfb08, registerFile=0x1803668, callFrame=0x7fbf2fc000e0, globalData=0x1ee41f0) at ../../Source/JavaScriptCore/jit/JITCode.h:133
#34 0x00007fbf852f0d74 in JSC::Interpreter::executeCall (this=0x1803650, callFrame=0x7fbf3406eea0, function=0x7fbf2fbff1e0, callType=JSC::CallTypeJS, callData=..., thisValue=..., args=...) at ../../Source/JavaScriptCore/interpreter/Interpreter.cpp:1303
#35 0x00007fbf853c1c0e in JSC::call (exec=0x7fbf3406eea0, functionObject=..., callType=JSC::CallTypeJS, callData=..., thisValue=..., args=...) at ../../Source/JavaScriptCore/runtime/CallData.cpp:39
#36 0x00007fbf80abe882 in WebCore::JSMainThreadExecState::call (exec=0x7fbf3406eea0, functionObject=..., callType=JSC::CallTypeJS, callData=..., thisValue=..., args=...) at ../../Source/WebCore/bindings/js/JSMainThreadExecState.h:56
#37 0x00007fbf80aef3f1 in WebCore::JSEventListener::handleEvent (this=0x109aed70, scriptExecutionContext=0x10a63118, event=0x108005d0) at ../../Source/WebCore/bindings/js/JSEventListener.cpp:133
#38 0x00007fbf80dc870e in WebCore::EventTarget::fireEventListeners (this=0x1087a230, event=0x108005d0, d=0x1087a368, entry=WTF::Vector of length 1, capacity 1 = {...}) at ../../Source/WebCore/dom/EventTarget.cpp:231
#39 0x00007fbf80dc8554 in WebCore::EventTarget::fireEventListeners (this=0x1087a230, event=0x108005d0) at ../../Source/WebCore/dom/EventTarget.cpp:198
#40 0x00007fbf80e420dd in WebCore::WindowEventContext::handleLocalEvents (this=0x7fffd05fa210, event=0x108005d0) at ../../Source/WebCore/dom/WindowEventContext.cpp:60
#41 0x00007fbf80dbb7a8 in WebCore::EventDispatcher::dispatchEvent (this=0x7fffd05fa340, event=...) at ../../Source/WebCore/dom/EventDispatcher.cpp:301
#42 0x00007fbf80db9422 in WebCore::EventDispatchMediator::dispatchEvent (this=0x10897ea0, dispatcher=0x7fffd05fa340) at ../../Source/WebCore/dom/EventDispatchMediator.cpp:51
#43 0x00007fbf80dba47c in WebCore::EventDispatcher::dispatchEvent (node=0x1090c6f0, mediator=...) at ../../Source/WebCore/dom/EventDispatcher.cpp:128
#44 0x00007fbf80e0e950 in WebCore::ScopedEventQueue::dispatchEvent (this=0x31bfc10, mediator=...) at ../../Source/WebCore/dom/ScopedEventQueue.cpp:84
#45 0x00007fbf80e0e7d8 in WebCore::ScopedEventQueue::enqueueEventDispatchMediator (this=0x31bfc10, mediator=...) at ../../Source/WebCore/dom/ScopedEventQueue.cpp:68
#46 0x00007fbf80dba638 in WebCore::EventDispatcher::dispatchScopedEvent (node=0x1090c6f0, mediator=...) at ../../Source/WebCore/dom/EventDispatcher.cpp:157
#47 0x00007fbf80de6702 in WebCore::Node::dispatchScopedEventDispatchMediator (this=0x1090c6f0, eventDispatchMediator=...) at ../../Source/WebCore/dom/Node.cpp:2561
#48 0x00007fbf80de66b1 in WebCore::Node::dispatchScopedEvent (this=0x1090c6f0, event=...) at ../../Source/WebCore/dom/Node.cpp:2556
#49 0x00007fbf80de69cc in WebCore::Node::dispatchSubtreeModifiedEvent (this=0x1090c6f0) at ../../Source/WebCore/dom/Node.cpp:2589
#50 0x00007fbf80d37b12 in WebCore::ContainerNode::appendChild (this=0x1090c6f0, newChild=..., ec=@0x7fffd05fa69c, shouldLazyAttach=true) at ../../Source/WebCore/dom/ContainerNode.cpp:570
#51 0x00007fbf80ddf26a in WebCore::Node::appendChild (this=0x1090c6f0, newChild=..., ec=@0x7fffd05fa69c, shouldLazyAttach=true) at ../../Source/WebCore/dom/Node.cpp:605
#52 0x00007fbf80b0e94b in WebCore::JSNode::appendChild (this=0x7fbf3408d5c0, exec=0x7fbf2fc00088) at ../../Source/WebCore/bindings/js/JSNodeCustom.cpp:184
#53 0x00007fbf81b315f9 in WebCore::jsNodePrototypeFunctionAppendChild (exec=0x7fbf2fc00088) at DerivedSources/WebCore/JSNode.cpp:497
#54 0x00007fbf36089265 in ?? ()
#55 0x00007fffd05fa7d0 in ?? ()
#56 0x00007fbf85348a78 in llint_op_call () from /home/slave/webkitgtk/gtk-linux-64-debug/build/WebKitBuild/Debug/.libs/libjavascriptcoregtk-3.0.so.0
#57 0x00007fffd05fa750 in ?? ()
#58 0x00007fbf85180326 in JSC::Register::operator= (this=0x1803668, v=...) at ../../Source/JavaScriptCore/interpreter/Register.h:116
#59 0x00007fbf852f44bc in JSC::JITCode::execute (this=0x7fbf2fbbfbe8, registerFile=0x1803668, callFrame=0x7fbf2fc00040, globalData=0x1ee41f0) at ../../Source/JavaScriptCore/jit/JITCode.h:133
#60 0x00007fbf852f0d74 in JSC::Interpreter::executeCall (this=0x1803650, callFrame=0x7fbf3406eea0, function=0x7fbf2fbff240, callType=JSC::CallTypeJS, callData=..., thisValue=..., args=...) at ../../Source/JavaScriptCore/interpreter/Interpreter.cpp:1303
#61 0x00007fbf853c1c0e in JSC::call (exec=0x7fbf3406eea0, functionObject=..., callType=JSC::CallTypeJS, callData=..., thisValue=..., args=...) at ../../Source/JavaScriptCore/runtime/CallData.cpp:39
#62 0x00007fbf80abe882 in WebCore::JSMainThreadExecState::call (exec=0x7fbf3406eea0, functionObject=..., callType=JSC::CallTypeJS, callData=..., thisValue=..., args=...) at ../../Source/WebCore/bindings/js/JSMainThreadExecState.h:56
#63 0x00007fbf80aef3f1 in WebCore::JSEventListener::handleEvent (this=0x10a812a0, scriptExecutionContext=0x10a63118, event=0x109c6870) at ../../Source/WebCore/bindings/js/JSEventListener.cpp:133
#64 0x00007fbf80dc870e in WebCore::EventTarget::fireEventListeners (this=0x10a62ff0, event=0x109c6870, d=0x10a81350, entry=WTF::Vector of length 1, capacity 1 = {...}) at ../../Source/WebCore/dom/EventTarget.cpp:231
#65 0x00007fbf80dc8554 in WebCore::EventTarget::fireEventListeners (this=0x10a62ff0, event=0x109c6870) at ../../Source/WebCore/dom/EventTarget.cpp:198
#66 0x00007fbf80de665f in WebCore::Node::handleLocalEvents (this=0x10a62ff0, event=0x109c6870) at ../../Source/WebCore/dom/Node.cpp:2551
#67 0x00007fbf80db9051 in WebCore::EventContext::handleLocalEvents (this=0x108984e0, event=0x109c6870) at ../../Source/WebCore/dom/EventContext.cpp:54
#68 0x00007fbf80dbb5f9 in WebCore::EventDispatcher::dispatchEvent (this=0x7fffd05faf70, event=...) at ../../Source/WebCore/dom/EventDispatcher.cpp:282
#69 0x00007fbf80db9422 in WebCore::EventDispatchMediator::dispatchEvent (this=0x109b6030, dispatcher=0x7fffd05faf70) at ../../Source/WebCore/dom/EventDispatchMediator.cpp:51
#70 0x00007fbf80dba47c in WebCore::EventDispatcher::dispatchEvent (node=0x10a62ff0, mediator=...) at ../../Source/WebCore/dom/EventDispatcher.cpp:128
#71 0x00007fbf80de675a in WebCore::Node::dispatchEvent (this=0x10a62ff0, event=...) at ../../Source/WebCore/dom/Node.cpp:2566
#72 0x00007fbf80d6047e in WebCore::Document::finishedParsing (this=0x10a62ff0) at ../../Source/WebCore/dom/Document.cpp:4785
#73 0x00007fbf810119f9 in WebCore::HTMLTreeBuilder::finished (this=0x10a6f730) at ../../Source/WebCore/html/parser/HTMLTreeBuilder.cpp:2805
#74 0x00007fbf80fe5c94 in WebCore::HTMLDocumentParser::end (this=0x109324a0) at ../../Source/WebCore/html/parser/HTMLDocumentParser.cpp:381
#75 0x00007fbf80fe5d9b in WebCore::HTMLDocumentParser::attemptToRunDeferredScriptsAndEnd (this=0x109324a0) at ../../Source/WebCore/html/parser/HTMLDocumentParser.cpp:390
#76 0x00007fbf80fe4e48 in WebCore::HTMLDocumentParser::prepareToStopParsing (this=0x109324a0) at ../../Source/WebCore/html/parser/HTMLDocumentParser.cpp:153
#77 0x00007fbf80fe5de0 in WebCore::HTMLDocumentParser::attemptToEnd (this=0x109324a0) at ../../Source/WebCore/html/parser/HTMLDocumentParser.cpp:402
#78 0x00007fbf80fe5e99 in WebCore::HTMLDocumentParser::finish (this=0x109324a0) at ../../Source/WebCore/html/parser/HTMLDocumentParser.cpp:429
#79 0x00007fbf81193cc8 in WebCore::DocumentWriter::end (this=0x1099c470) at ../../Source/WebCore/loader/DocumentWriter.cpp:241
#80 0x00007fbf81187795 in WebCore::DocumentLoader::finishedLoading (this=0x1099c3b0) at ../../Source/WebCore/loader/DocumentLoader.cpp:299
#81 0x00007fbf811d99f7 in WebCore::MainResourceLoader::didFinishLoading (this=0x109c7990, finishTime=0) at ../../Source/WebCore/loader/MainResourceLoader.cpp:544
#82 0x00007fbf811e640b in WebCore::ResourceLoader::didFinishLoading (this=0x109c7990, finishTime=0) at ../../Source/WebCore/loader/ResourceLoader.cpp:435
#83 0x00007fbf813a93ce in WebCore::readCallback (source=0x4a202b0, asyncResult=0x108974b0, data=0x109b6500) at ../../Source/WebCore/platform/network/soup/ResourceHandleSoup.cpp:864
#84 0x00007fbf7ea5ca3c in async_ready_callback_wrapper () from /home/slave/webkitgtk/gtk-linux-64-debug/build/WebKitBuild/Dependencies/Root/lib64/libgio-2.0.so.0
#85 0x00007fbf7ea785f6 in g_simple_async_result_complete () from /home/slave/webkitgtk/gtk-linux-64-debug/build/WebKitBuild/Dependencies/Root/lib64/libgio-2.0.so.0
#86 0x00007fbf7ea78642 in complete_in_idle_cb () from /home/slave/webkitgtk/gtk-linux-64-debug/build/WebKitBuild/Dependencies/Root/lib64/libgio-2.0.so.0
#87 0x00007fbf7e8a4ad2 in g_idle_dispatch () from /home/slave/webkitgtk/gtk-linux-64-debug/build/WebKitBuild/Dependencies/Root/lib64/libglib-2.0.so.0
#88 0x00007fbf7e8a2359 in g_main_dispatch () from /home/slave/webkitgtk/gtk-linux-64-debug/build/WebKitBuild/Dependencies/Root/lib64/libglib-2.0.so.0
#89 0x00007fbf7e8a3003 in g_main_context_dispatch () from /home/slave/webkitgtk/gtk-linux-64-debug/build/WebKitBuild/Dependencies/Root/lib64/libglib-2.0.so.0
#90 0x00007fbf7e8a31ed in g_main_context_iterate () from /home/slave/webkitgtk/gtk-linux-64-debug/build/WebKitBuild/Dependencies/Root/lib64/libglib-2.0.so.0
#91 0x00007fbf7e8a3623 in g_main_loop_run () from /home/slave/webkitgtk/gtk-linux-64-debug/build/WebKitBuild/Dependencies/Root/lib64/libglib-2.0.so.0
#92 0x00007fbf7f198843 in gtk_main () from /home/slave/webkitgtk/gtk-linux-64-debug/build/WebKitBuild/Dependencies/Root/lib64/libgtk-3.so.0
#93 0x000000000045fb28 in runTest (testPathOrURL=...) at ../../Tools/DumpRenderTree/gtk/DumpRenderTree.cpp:706
#94 0x000000000045f191 in runTestingServerLoop () at ../../Tools/DumpRenderTree/gtk/DumpRenderTree.cpp:491
#95 0x00000000004621f2 in main (argc=2, argv=0x7fffd05fbf68) at ../../Tools/DumpRenderTree/gtk/DumpRenderTree.cpp:1396


Updating test expectations for now and adding to CC people that might be interested.

[Martin Robinson]

Dan might be interested as this is a crash in libsoup.

[Dan Winship]

any stderr?

That's a pretty weird place to be crashing all of a sudden... I'm guessing something else must be double-freeing just before this code runs, but it doesn't make the allocator crash right away.

Do the bots run with MALLOC_CHECK_ set? If not, maybe they should...