Bug 117756

Summary:

REGRESSION (r161429?): Frequent crashes on media/track/media-element-enqueue-event-crash.html

Product:

WebKit

Reporter:

WebKit Commit Bot <commit-queue>

Component:

JavaScriptCore

Assignee:

WebKit Commit Bot <commit-queue>

Status:

RESOLVED FIXED

Severity:

Normal

CC:

calvaris, eric.carlson, ggaren, glenn, jer.noble, mhahnenberg, philipj, sergio, svillar, webkit-bug-importer

Priority:

Keywords:

InRadar, Regression

Version:

528+ (Nightly build)

Hardware:

Unspecified

OS:

Unspecified

Bug Depends on:

Bug Blocks:

50856

Attachments:

Description	Flags
Archive of layout-test-results from webkit-cq-02	none
Patch	mhahnenberg: review+
Archive of layout-test-results from webkit-cq-02	none

WebKit Commit Bot

Reported 2013-06-18 14:24:06 PDT

This is an automatically generated bug from the commit-queue. media/track/media-element-enqueue-event-crash.html has been flaky on the commit-queue. media/track/media-element-enqueue-event-crash.html was authored by eric.carlson@apple.com. http://trac.webkit.org/browser/trunk/LayoutTests/media/track/media-element-enqueue-event-crash.html The commit-queue just saw media/track/media-element-enqueue-event-crash.html flake (DumpRenderTree crashed) while processing attachment 204936 [details] on bug 117747. Bot: webkit-cq-02 Port: <class 'webkitpy.common.config.ports.MacPort'> Platform: Mac OS X 10.8.3 The bots will update this with information from each new failure. If you believe this bug to be fixed or invalid, feel free to close. The bots will re-open if the flake re-occurs. If you would like to track this test fix with another bug, please close this bug as a duplicate. The bots will follow the duplicate chain when making future comments.

Attachments
Archive of layout-test-results from webkit-cq-02 (499.05 KB, application/zip) 2013-06-18 14:24 PDT, WebKit Commit Bot	no flags	Details
Patch (2.18 KB, patch) 2014-05-07 17:06 PDT, Geoffrey Garen	mhahnenberg: review+	Details Formatted Diff Diff
Archive of layout-test-results from webkit-cq-02 (900.05 KB, application/zip) 2017-03-07 21:18 PST, WebKit Commit Bot	no flags	Details
View All Add attachment proposed patch, testcase, etc.

WebKit Commit Bot

Comment 1 2013-06-18 14:24:10 PDT

Created attachment 204942 [details] Archive of layout-test-results from webkit-cq-02

Alexey Proskuryakov

Comment 2 2014-01-07 16:57:49 PST

I just had this test hit an assertion when running tests locally. Not sure if this is the same issue as originally seen by commit queue. ASSERT(node == m_head); Thread 0 Crashed:: Dispatch queue: com.apple.main-thread 0 com.apple.JavaScriptCore 0x0000000102df1b2a WTFCrash + 42 (Assertions.cpp:341) 1 com.apple.JavaScriptCore 0x0000000102c2d096 WTF::DoublyLinkedList<JSC::MarkedBlock>::remove(JSC::MarkedBlock*) + 198 (DoublyLinkedList.h:169) 2 com.apple.JavaScriptCore 0x0000000102c2cb4a JSC::MarkedAllocator::removeBlock(JSC::MarkedBlock*) + 154 (MarkedAllocator.cpp:153) 3 com.apple.JavaScriptCore 0x0000000102c30afd JSC::MarkedSpace::freeBlock(JSC::MarkedBlock*) + 45 (MarkedSpace.cpp:234) 4 com.apple.JavaScriptCore 0x0000000102c30bf7 JSC::MarkedSpace::freeOrShrinkBlock(JSC::MarkedBlock*) + 71 (MarkedSpace.cpp:250) 5 com.apple.JavaScriptCore 0x0000000102a9b264 JSC::IncrementalSweeper::sweepNextBlock() + 180 (IncrementalSweeper.cpp:130) 6 com.apple.JavaScriptCore 0x0000000102a9b12a JSC::IncrementalSweeper::doSweep(double) + 106 (IncrementalSweeper.cpp:108) 7 com.apple.JavaScriptCore 0x0000000102a9b0b2 JSC::IncrementalSweeper::doWork() + 34 (IncrementalSweeper.cpp:100) 8 com.apple.JavaScriptCore 0x0000000102a97222 JSC::HeapTimer::timerDidFire(__CFRunLoopTimer*, void*) + 338 (HeapTimer.cpp:98) 9 com.apple.CoreFoundation 0x00007fff8bbd3724 __CFRUNLOOP_IS_CALLING_OUT_TO_A_TIMER_CALLBACK_FUNCTION__ + 20

Alexey Proskuryakov

Comment 3 2014-01-08 10:22:32 PST

This test started to crash super frequently on Mac bots (debug and release) yesterday. http://webkit-test-results.appspot.com/dashboards/flakiness_dashboard.html#showAllRuns=true&tests=media%2Ftrack%2Fmedia-element-enqueue-event-crash.html

Eric Carlson

Comment 4 2014-01-08 11:00:08 PST

(In reply to comment #2) > I just had this test hit an assertion when running tests locally. Not sure if this is the same issue as originally seen by commit queue. > > ASSERT(node == m_head); > This is not the same crash originally seen by the commit queue. This is asserting because a list node without a previous element is not the list head: template<typename T> inline void DoublyLinkedList<T>::remove(T* node) { if (node->prev()) { ASSERT(node != m_head); node->prev()->setNext(node->next()); } else { --> ASSERT(node == m_head); m_head = node->next(); }

Eric Carlson

Comment 5 2014-01-08 11:08:11 PST

I don't know much about about how the GC works but r161429 looks like it could be related - it changed the way sweeping behaves and was committed at 2014-01-07 09:36:02 PST, .

Alexey Proskuryakov

Comment 6 2014-01-08 12:00:34 PST

Indeed, the crashes started right after r161429. Let's track the new JSC crash here, old flakiness seems to be gone (there is one earlier crash recorded by flakiness dashboard, but in a revision that was all broken).

Radar WebKit Bug Importer

Comment 7 2014-01-08 12:02:20 PST

<rdar://problem/15774608>

Alexey Proskuryakov

Comment 8 2014-01-09 10:28:00 PST

In release mode, the crashes are in a different place each time. Debug assertions all seem to be in DoublyLinkedList as posted above. Skipped in <http://trac.webkit.org/r161560>.

Sergio Villar Senin

Comment 9 2014-04-04 03:02:52 PDT

This is also asserting in WebKitGTK debug bots STDERR: ASSERTION FAILED: !m_deletionHasBegun || !m_referencingNodeCount STDERR: ../../Source/WebCore/dom/Document.h(280) : void WebCore::Document::decrementReferencingNodeCount() STDERR: 1 0x7f5d1fc16e2d /home/slave/webkitgtk/gtk-linux-64-debug/build/WebKitBuild/Debug/lib/libjavascriptcoregtk-3.0.so.0(WTFCrash+0x1e) [0x7f5d1fc16e2d] STDERR: 2 0x7f5d1a1451b6 /home/slave/webkitgtk/gtk-linux-64-debug/build/WebKitBuild/Debug/lib/libwebkit2gtk-3.0.so.25(_ZN7WebCore8Document29decrementReferencingNodeCountEv+0x4a) [0x7f5d1a1451b6] STDERR: 3 0x7f5d1a1d3109 /home/slave/webkitgtk/gtk-linux-64-debug/build/WebKitBuild/Debug/lib/libwebkit2gtk-3.0.so.25(_ZN7WebCore4NodeD1Ev+0x179) [0x7f5d1a1d3109] STDERR: 4 0x7f5d1a0ff0e0 /home/slave/webkitgtk/gtk-linux-64-debug/build/WebKitBuild/Debug/lib/libwebkit2gtk-3.0.so.25(_ZN7WebCore13CharacterDataD1Ev+0x3a) [0x7f5d1a0ff0e0] STDERR: 5 0x7f5d1a221b57 /home/slave/webkitgtk/gtk-linux-64-debug/build/WebKitBuild/Debug/lib/libwebkit2gtk-3.0.so.25(_ZN7WebCore4TextD1Ev+0x5f) [0x7f5d1a221b57] STDERR: 6 0x7f5d1a221b86 /home/slave/webkitgtk/gtk-linux-64-debug/build/WebKitBuild/Debug/lib/libwebkit2gtk-3.0.so.25(_ZN7WebCore4TextD0Ev+0x18) [0x7f5d1a221b86] STDERR: 7 0x7f5d1a11a737 /home/slave/webkitgtk/gtk-linux-64-debug/build/WebKitBuild/Debug/lib/libwebkit2gtk-3.0.so.25(_ZN7WebCore33removeDetachedChildrenInContainerINS_4NodeENS_13ContainerNodeEEEvRT0_+0xe8) [0x7f5d1a11a737] STDERR: 8 0x7f5d1a113e7c /home/slave/webkitgtk/gtk-linux-64-debug/build/WebKitBuild/Debug/lib/libwebkit2gtk-3.0.so.25(_ZN7WebCore13ContainerNode22removeDetachedChildrenEv+0x62) [0x7f5d1a113e7c] STDERR: 9 0x7f5d1a114229 /home/slave/webkitgtk/gtk-linux-64-debug/build/WebKitBuild/Debug/lib/libwebkit2gtk-3.0.so.25(_ZN7WebCore13ContainerNodeD1Ev+0x5b) [0x7f5d1a114229] STDERR: 10 0x7f5d1a189319 /home/slave/webkitgtk/gtk-linux-64-debug/build/WebKitBuild/Debug/lib/libwebkit2gtk-3.0.so.25(_ZN7WebCore7ElementD1Ev+0x18f) [0x7f5d1a189319] STDERR: 11 0x7f5d1a2176fc /home/slave/webkitgtk/gtk-linux-64-debug/build/WebKitBuild/Debug/lib/libwebkit2gtk-3.0.so.25(_ZN7WebCore13StyledElementD1Ev+0x5a) [0x7f5d1a2176fc] STDERR: 12 0x7f5d1a3251ca /home/slave/webkitgtk/gtk-linux-64-debug/build/WebKitBuild/Debug/lib/libwebkit2gtk-3.0.so.25(_ZN7WebCore11HTMLElementD1Ev+0x2a) [0x7f5d1a3251ca] STDERR: 13 0x7f5d1a36643a /home/slave/webkitgtk/gtk-linux-64-debug/build/WebKitBuild/Debug/lib/libwebkit2gtk-3.0.so.25(_ZN7WebCore16HTMLMediaElementD1Ev+0x686) [0x7f5d1a36643a] STDERR: 14 0x7f5d1a3ba796 /home/slave/webkitgtk/gtk-linux-64-debug/build/WebKitBuild/Debug/lib/libwebkit2gtk-3.0.so.25(_ZN7WebCore16HTMLVideoElementD1Ev+0x126) [0x7f5d1a3ba796] STDERR: 15 0x7f5d1a3ba826 /home/slave/webkitgtk/gtk-linux-64-debug/build/WebKitBuild/Debug/lib/libwebkit2gtk-3.0.so.25(_ZN7WebCore16HTMLVideoElementD0Ev+0x18) [0x7f5d1a3ba826] STDERR: 16 0x7f5d1a1da0d8 /home/slave/webkitgtk/gtk-linux-64-debug/build/WebKitBuild/Debug/lib/libwebkit2gtk-3.0.so.25(_ZN7WebCore4Node14removedLastRefEv+0x58) [0x7f5d1a1da0d8] STDERR: 17 0x7f5d19afd0bd /home/slave/webkitgtk/gtk-linux-64-debug/build/WebKitBuild/Debug/lib/libwebkit2gtk-3.0.so.25(_ZN7WebCore10TreeSharedINS_4NodeEE5derefEv+0x159) [0x7f5d19afd0bd] STDERR: 18 0x7f5d1a1d43fe /home/slave/webkitgtk/gtk-linux-64-debug/build/WebKitBuild/Debug/lib/libwebkit2gtk-3.0.so.25(_ZN7WebCore4Node16derefEventTargetEv+0x1c) [0x7f5d1a1d43fe] STDERR: 19 0x7f5d19d77381 /home/slave/webkitgtk/gtk-linux-64-debug/build/WebKitBuild/Debug/lib/libwebkit2gtk-3.0.so.25(_ZN7WebCore11EventTarget5derefEv+0x23) [0x7f5d19d77381] STDERR: 20 0x7f5d19d79818 /home/slave/webkitgtk/gtk-linux-64-debug/build/WebKitBuild/Debug/lib/libwebkit2gtk-3.0.so.25(_ZN3WTF14derefIfNotNullIN7WebCore11EventTargetEEEvPT_+0x28) [0x7f5d19d79818] STDERR: 21 0x7f5d19da372b /home/slave/webkitgtk/gtk-linux-64-debug/build/WebKitBuild/Debug/lib/libwebkit2gtk-3.0.so.25(_ZN3WTF6RefPtrIN7WebCore11EventTargetEED1Ev+0x1b) [0x7f5d19da372b] STDERR: 22 0x7f5d1a19ee12 /home/slave/webkitgtk/gtk-linux-64-debug/build/WebKitBuild/Debug/lib/libwebkit2gtk-3.0.so.25(_ZN7WebCore5EventD1Ev+0x3e) [0x7f5d1a19ee12] STDERR: 23 0x7f5d1a19ee72 /home/slave/webkitgtk/gtk-linux-64-debug/build/WebKitBuild/Debug/lib/libwebkit2gtk-3.0.so.25(_ZN7WebCore5EventD0Ev+0x18) [0x7f5d1a19ee72] STDERR: 24 0x7f5d19b87306 /home/slave/webkitgtk/gtk-linux-64-debug/build/WebKitBuild/Debug/lib/libwebkit2gtk-3.0.so.25(_ZN3WTF10RefCountedIN7WebCore5EventEE5derefEv+0x48) [0x7f5d19b87306] STDERR: 25 0x7f5d1b115a18 /home/slave/webkitgtk/gtk-linux-64-debug/build/WebKitBuild/Debug/lib/libwebkit2gtk-3.0.so.25(_ZN7WebCore7JSEvent11releaseImplEv+0x20) [0x7f5d1b115a18] STDERR: 26 0x7f5d1b115934 /home/slave/webkitgtk/gtk-linux-64-debug/build/WebKitBuild/Debug/lib/libwebkit2gtk-3.0.so.25(_ZN7WebCore12JSEventOwner8finalizeEN3JSC6HandleINS1_7UnknownEEEPv+0x6a) [0x7f5d1b115934] STDERR: 27 0x7f5d1f94c15d /home/slave/webkitgtk/gtk-linux-64-debug/build/WebKitBuild/Debug/lib/libjavascriptcoregtk-3.0.so.0(_ZN3JSC9WeakBlock8finalizeEPNS_8WeakImplE+0xb5) [0x7f5d1f94c15d] STDERR: 28 0x7f5d1f94bb7f /home/slave/webkitgtk/gtk-linux-64-debug/build/WebKitBuild/Debug/lib/libjavascriptcoregtk-3.0.so.0(_ZN3JSC9WeakBlock5sweepEv+0x89) [0x7f5d1f94bb7f] STDERR: 29 0x7f5d1f94c4b8 /home/slave/webkitgtk/gtk-linux-64-debug/build/WebKitBuild/Debug/lib/libjavascriptcoregtk-3.0.so.0(_ZN3JSC7WeakSet5sweepEv+0x2e) [0x7f5d1f94c4b8] STDERR: 30 0x7f5d1f94327a /home/slave/webkitgtk/gtk-linux-64-debug/build/WebKitBuild/Debug/lib/libjavascriptcoregtk-3.0.so.0(_ZN3JSC11MarkedBlock5sweepENS0_9SweepModeE+0x66) [0x7f5d1f94327a] STDERR: 31 0x7f5d1f946199 /home/slave/webkitgtk/gtk-linux-64-debug/build/WebKitBuild/Debug/lib/libjavascriptcoregtk-3.0.so.0(_ZN3JSC5SweepclEPNS_11MarkedBlockE+0x21) [0x7f5d1f946199]

Geoffrey Garen

Comment 10 2014-05-07 17:06:05 PDT

Created attachment 231030 [details] Patch

Mark Hahnenberg

Comment 11 2014-05-07 17:06:42 PDT

Comment on attachment 231030 [details] Patch r=me

Geoffrey Garen

Comment 12 2014-05-07 17:07:33 PDT

Committed r168453: <http://trac.webkit.org/changeset/168453>

WebKit Commit Bot

Comment 13 2017-03-07 21:18:01 PST

The commit-queue just saw media/track/media-element-enqueue-event-crash.html flake (text diff) while processing attachment 303766 [details] on bug 169336. Bot: webkit-cq-02 Port: <class 'webkitpy.common.config.ports.MacPort'> Platform: Mac OS X 10.11.6

WebKit Commit Bot

Comment 14 2017-03-07 21:18:05 PST

Created attachment 303776 [details] Archive of layout-test-results from webkit-cq-02

Note You need to log in before you can comment on or make changes to this bug.