Bug 209490

Summary: [ Mac wk2 ] http/tests/media/track-in-band-hls-metadata.html is flaky crashing.
Product: WebKit Reporter: Jason Lawrence <Lawrence.j>
Component: MediaAssignee: Jer Noble <jer.noble>
Status: RESOLVED FIXED    
Severity: Normal CC: cdumez, darin, eric.carlson, jer.noble, rniwa, webkit-bot-watchers-bugzilla, webkit-bug-importer
Priority: P2 Keywords: InRadar
Version: WebKit Nightly Build   
Hardware: Mac   
OS: macOS 10.14   
See Also: https://bugs.webkit.org/show_bug.cgi?id=203849
Attachments:
Description Flags
track-in-band-hls-metadata-crash-log
none
Patch
none
Patch
none
Patch none

Description Jason Lawrence 2020-03-24 13:01:28 PDT 
Created attachment 394398 [details]
track-in-band-hls-metadata-crash-log

http/tests/media/track-in-band-hls-metadata.html

Description:
This test is flaky crashing on Mac wk2. The crashes are apparent throughout the visible history.

History:
https://results.webkit.org/?suite=layout-tests&test=http%2Ftests%2Fmedia%2Ftrack-in-band-hls-metadata.html&limit=50000

Crash logs attached;
Thread 0 Crashed:: Dispatch queue: com.apple.main-thread
0   com.apple.WebCore             	0x00000005114ca14b WebCore::TaskDispatcher<WebCore::Timer>::dispatchOneTask() + 123 (GenericTaskQueue.cpp:110)
1   com.apple.WebCore             	0x00000005114ca04a WebCore::TaskDispatcher<WebCore::Timer>::sharedTimerFired() + 234
2   com.apple.WebCore             	0x00000005114ed023 WebCore::ThreadTimers::sharedTimerFiredInternal() + 163 (ThreadTimers.cpp:130)
3   com.apple.WebCore             	0x000000051151228f WebCore::timerFired(__CFRunLoopTimer*, void*) + 31 (MainThreadSharedTimerCF.cpp:75)
4   com.apple.CoreFoundation      	0x00007fff35d31804 __CFRUNLOOP_IS_CALLING_OUT_TO_A_TIMER_CALLBACK_FUNCTION__ + 20
5   com.apple.CoreFoundation      	0x00007fff35d313be __CFRunLoopDoTimer + 859
6   com.apple.CoreFoundation      	0x00007fff35d30e9e __CFRunLoopDoTimers + 317
Comment 1 Radar WebKit Bug Importer 2020-03-24 13:01:45 PDT 
<rdar://problem/60837555>
Comment 2 Jason Lawrence 2020-03-24 13:17:28 PDT 
Reverted r258931 for reason:

Expectations need to include the timeout that is set in mac.

Committed r258933: <https://trac.webkit.org/changeset/258933>
Comment 3 Jason Lawrence 2020-03-24 13:21:16 PDT 
I have marked the test as crashing while this issue is investigated.
https://trac.webkit.org/changeset/258934/webkit
Comment 4 Jason Lawrence 2020-03-24 13:52:54 PDT 
I am able to reproduce this issue with r258908 using the command below.

run-webkit-tests --iterations 888 --child-processes 50 --force -f -g http/tests/media/track-in-band-hls-metadata.html

[273/888] http/tests/media/track-in-band-hls-metadata.html failed unexpectedly (com.apple.WebKit.WebContent.Development crashed [pid=41268])
Comment 5 Ryosuke Niwa 2020-03-24 22:44:06 PDT 
Hm... this is very strange. TaskDispatcher<Timer> is getting fired but there is no task left?
Comment 6 Jer Noble 2020-04-06 09:56:15 PDT 
Created attachment 395576 [details]
Patch
Comment 7 Jer Noble 2020-04-06 10:09:26 PDT 
Created attachment 395580 [details]
Patch
Comment 8 Darin Adler 2020-04-06 10:17:45 PDT 
Comment on attachment 395580 [details]
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=395580&action=review

> Source/WebCore/ChangeLog:10
> +        executing tasks on the main thread, when a GenericTaskQueue is destoryed on a background thread,

destroyed

> Source/WebCore/ChangeLog:11
> +        move the TaskDispatcher into a task, and use the disptacher itself to destroy itself on the

dispatcher

> Source/WebCore/platform/GenericTaskQueue.h:81
> +        : m_dispatcher(makeUniqueRefWithoutFastMallocCheck<TaskDispatcher<T>>())

Isn’t the correct thing to make TaskDispatcher use WTF_MAKE_FAST_ALLOCATED, not to call the "WithoutFastMallocCheck" version?
Comment 9 Jer Noble 2020-04-06 11:02:44 PDT 
Created attachment 395588 [details]
Patch
Comment 10 Jer Noble 2020-04-06 11:05:10 PDT 
(In reply to Darin Adler from comment #8)
> Comment on attachment 395580 [details]
> Patch
> 
> View in context:
> https://bugs.webkit.org/attachment.cgi?id=395580&action=review
> 
> > Source/WebCore/ChangeLog:10
> > +        executing tasks on the main thread, when a GenericTaskQueue is destoryed on a background thread,
> 
> destroyed
> 
> > Source/WebCore/ChangeLog:11
> > +        move the TaskDispatcher into a task, and use the disptacher itself to destroy itself on the
> 
> dispatcher

Whoops. Transposed finger syndrome.

> > Source/WebCore/platform/GenericTaskQueue.h:81
> > +        : m_dispatcher(makeUniqueRefWithoutFastMallocCheck<TaskDispatcher<T>>())
> 
> Isn’t the correct thing to make TaskDispatcher use WTF_MAKE_FAST_ALLOCATED,
> not to call the "WithoutFastMallocCheck" version?

Yeah, you're right. Changed.
Comment 11 EWS 2020-04-06 13:48:34 PDT 
Committed r259593: <https://trac.webkit.org/changeset/259593>

All reviewed patches have been landed. Closing bug and clearing flags on attachment 395588 [details].