Bug 248750

Summary:	REGRESSION(257266@main): Various iOS layout tests asserting in RemoteImageBufferProxy::~RemoteImageBufferProxy()
Product:	WebKit	Reporter:	Simon Fraser (smfr) <simon.fraser>
Component:	WebKit Process Model	Assignee:	Kimmo Kinnunen <kkinnunen>
Status:	RESOLVED FIXED
Severity:	Normal	CC:	kkinnunen, mattwoodrow, sabouhallawa, simon.fraser, webkit-bug-importer
Priority:	P2	Keywords:	InRadar
Version:	WebKit Nightly Build
Hardware:	Unspecified
OS:	Unspecified

Description Simon Fraser (smfr) 2022-12-04 20:40:23 PST

This test run https://build.webkit.org/results/Apple-iOS-16-Simulator-Debug-WK2-Tests/257362@main%20(388)/results.html shows these tests asserting:

http/tests/security/showModalDialog-sync-cross-origin-page-load.html
imported/w3c/web-platform-tests/IndexedDB/database-names-by-origin.html
imported/w3c/web-platform-tests/content-security-policy/inheritance/window.html
imported/w3c/web-platform-tests/fetch/api/headers/header-values-normalize.any.html
imported/w3c/web-platform-tests/html/browsers/browsing-the-web/navigating-across-documents/failure-check-sequence.https.html
imported/w3c/web-platform-tests/html/browsers/browsing-the-web/navigating-across-documents/initial-empty-document/window-open-204.html
imported/w3c/web-platform-tests/html/browsers/the-window-object/closed-attribute.window.html
imported/w3c/web-platform-tests/html/browsers/the-window-object/open-close/open-features-negative-innerwidth-innerheight.html
imported/w3c/web-platform-tests/html/browsers/the-window-object/open-close/open-features-negative-screenx-screeny.html
imported/w3c/web-platform-tests/html/browsers/the-window-object/open-close/open-features-negative-top-left.html
imported/w3c/web-platform-tests/html/browsers/the-window-object/open-close/open-features-negative-width-height.html
imported/w3c/web-platform-tests/html/browsers/the-window-object/open-close/open-features-non-integer-innerheight.html
imported/w3c/web-platform-tests/html/browsers/the-window-object/open-close/open-features-non-integer-top.html
imported/w3c/web-platform-tests/mixed-content/imageset.https.sub.html
imported/w3c/web-platform-tests/service-workers/service-worker/http-to-https-redirect-and-register.https.html
imported/w3c/web-platform-tests/service-workers/service-worker/navigation-sets-cookie.https.html
imported/w3c/web-platform-tests/workers/modules/dedicated-worker-import-referrer.html
imported/w3c/web-platform-tests/workers/modules/shared-worker-import-referrer.html
imported/w3c/web-platform-tests/worklets/audio-worklet-csp.https.html
imported/w3c/web-platform-tests/worklets/audio-worklet-referrer.https.html
imported/w3c/web-platform-tests/worklets/paint-worklet-csp.https.html
imported/w3c/web-platform-tests/worklets/paint-worklet-referrer.https.html

Many of these are asserting here:

 Thread 2 Crashed:: Dispatch queue: com.apple.WebKit.WebContent.RemoteLayerTreeDrawingArea.CommitQueue
0  com.apple.JavaScriptCore	       0x140bf975e WTFCrash
1  com.apple.WebKit        	       0x121bdefba WTFCrashWithInfo(int, char const*, char const*, int)
2  com.apple.WebKit        	       0x123ba80ba WTF::WeakPtr<WebKit::RemoteRenderingBackendProxy, WTF::DefaultWeakPtrImpl>::operator->() const
3  com.apple.WebKit        	       0x123bca826 WebKit::RemoteImageBufferProxy::~RemoteImageBufferProxy()
4  com.apple.WebKit        	       0x123bcaae4 WebKit::RemoteImageBufferProxy::~RemoteImageBufferProxy()
5  com.apple.WebKit        	       0x123bcab08 WebKit::RemoteImageBufferProxy::~RemoteImageBufferProxy()
6  com.apple.WebKit        	       0x1225430ee WTF::ThreadSafeRefCounted<WebCore::ImageBuffer, (WTF::DestructionThread)0>::deref() const::'lambda'()::operator()() const
7  com.apple.WebKit        	       0x122543066 WTF::ThreadSafeRefCounted<WebCore::ImageBuffer, (WTF::DestructionThread)0>::deref() const
8  com.apple.WebKit        	       0x123cbc8ec WTF::Ref<WebKit::RemoteImageBufferProxy, WTF::RawPtrTraits<WebKit::RemoteImageBufferProxy> >::~Ref()
9  com.apple.WebKit        	       0x123cbc894 WTF::Ref<WebKit::RemoteImageBufferProxy, WTF::RawPtrTraits<WebKit::RemoteImageBufferProxy> >::~Ref()
10  com.apple.WebKit        	       0x123cbc86c WebKit::ThreadSafeRemoteImageBufferFlusher::~ThreadSafeRemoteImageBufferFlusher()
11  com.apple.WebKit        	       0x123cbc824 WebKit::ThreadSafeRemoteImageBufferFlusher::~ThreadSafeRemoteImageBufferFlusher()
12  com.apple.WebKit        	       0x123ccd528 WebKit::ThreadSafeRemoteImageBufferFlusher::~ThreadSafeRemoteImageBufferFlusher()
13  com.apple.WebKit        	       0x1222fef5c std::__1::default_delete<WebCore::ThreadSafeImageBufferFlusher>::operator()(WebCore::ThreadSafeImageBufferFlusher*) const
14  com.apple.WebKit        	       0x1222feedc std::__1::unique_ptr<WebCore::ThreadSafeImageBufferFlusher, std::__1::default_delete<WebCore::ThreadSafeImageBufferFlusher> >::reset(WebCore::ThreadSafeImageBufferFlusher*)
15  com.apple.WebKit        	       0x1222fee78 std::__1::unique_ptr<WebCore::ThreadSafeImageBufferFlusher, std::__1::default_delete<WebCore::ThreadSafeImageBufferFlusher> >::~unique_ptr()
16  com.apple.WebKit        	       0x1222fee54 std::__1::unique_ptr<WebCore::ThreadSafeImageBufferFlusher, std::__1::default_delete<WebCore::ThreadSafeImageBufferFlusher> >::~unique_ptr()
17  com.apple.WebKit        	       0x1222fee1e WTF::VectorDestructor<true, std::__1::unique_ptr<WebCore::ThreadSafeImageBufferFlusher, std::__1::default_delete<WebCore::ThreadSafeImageBufferFlusher> > >::destruct(std::__1::unique_ptr<WebCore::ThreadSafeImageBufferFlusher, std::__1::default_delete<WebCore::ThreadSafeImageBufferFlusher> >*, std::__1::unique_ptr<WebCore::ThreadSafeImageBufferFlusher, std::__1::default_delete<WebCore::ThreadSafeImageBufferFlusher> >*)
18  com.apple.WebKit        	       0x1222fed5c WTF::VectorTypeOperations<std::__1::unique_ptr<WebCore::ThreadSafeImageBufferFlusher, std::__1::default_delete<WebCore::ThreadSafeImageBufferFlusher> > >::destruct(std::__1::unique_ptr<WebCore::ThreadSafeImageBufferFlusher, std::__1::default_delete<WebCore::ThreadSafeImageBufferFlusher> >*, std::__1::unique_ptr<WebCore::ThreadSafeImageBufferFlusher, std::__1::default_delete<WebCore::ThreadSafeImageBufferFlusher> >*)
19  com.apple.WebKit        	       0x1222fecee WTF::Vector<std::__1::unique_ptr<WebCore::ThreadSafeImageBufferFlusher, std::__1::default_delete<WebCore::ThreadSafeImageBufferFlusher> >, 0ul, WTF::CrashOnOverflow, 16ul, WTF::FastMalloc>::~Vector()
20  com.apple.WebKit        	       0x1222f4e54 WTF::Vector<std::__1::unique_ptr<WebCore::ThreadSafeImageBufferFlusher, std::__1::default_delete<WebCore::ThreadSafeImageBufferFlusher> >, 0ul, WTF::CrashOnOverflow, 16ul, WTF::FastMalloc>::~Vector()
21  com.apple.WebKit        	       0x1222fb9ac WebKit::RemoteLayerTreeDrawingArea::BackingStoreFlusher::~BackingStoreFlusher()
22  com.apple.WebKit        	       0x1222fb984 WebKit::RemoteLayerTreeDrawingArea::BackingStoreFlusher::~BackingStoreFlusher()
23  com.apple.WebKit        	       0x1222fb95a WTF::ThreadSafeRefCounted<WebKit::RemoteLayerTreeDrawingArea::BackingStoreFlusher, (WTF::DestructionThread)0>::deref() const::'lambda'()::operator()() const
24  com.apple.WebKit        	       0x1222fb926 WTF::ThreadSafeRefCounted<WebKit::RemoteLayerTreeDrawingArea::BackingStoreFlusher, (WTF::DestructionThread)0>::deref() const
25  com.apple.WebKit        	       0x1222fb8ae WTF::DefaultRefDerefTraits<WebKit::RemoteLayerTreeDrawingArea::BackingStoreFlusher>::derefIfNotNull(WebKit::RemoteLayerTreeDrawingArea::BackingStoreFlusher*)
26  com.apple.WebKit        	       0x1222fb878 WTF::RefPtr<WebKit::RemoteLayerTreeDrawingArea::BackingStoreFlusher, WTF::RawPtrTraits<WebKit::RemoteLayerTreeDrawingArea::BackingStoreFlusher>, WTF::DefaultRefDerefTraits<WebKit::RemoteLayerTreeDrawingArea::BackingStoreFlusher> >::~RefPtr()
27  com.apple.WebKit        	       0x1222f2754 WTF::RefPtr<WebKit::RemoteLayerTreeDrawingArea::BackingStoreFlusher, WTF::RawPtrTraits<WebKit::RemoteLayerTreeDrawingArea::BackingStoreFlusher>, WTF::DefaultRefDerefTraits<WebKit::RemoteLayerTreeDrawingArea::BackingStoreFlusher> >::~RefPtr()
28  com.apple.WebKit        	       0x1222f8be4 WebKit::RemoteLayerTreeDrawingArea::updateRendering()::$_3::~$_3()
29  com.apple.WebKit        	       0x1222f5064 WebKit::RemoteLayerTreeDrawingArea::updateRendering()::$_3::~$_3()
30  com.apple.WebKit        	       0x1222f5048 __destroy_helper_block_e8_32c66_ZTSKZN6WebKit26RemoteLayerTreeDrawingArea15updateRenderingEvE3$_3
31  libsystem_blocks.dylib  	       0x1048b520c _call_dispose_helpers_excp + 44 /Library/Caches/com.apple.xbs/Sources/libclosure_Sim/generic_helpers.c:30
32  libsystem_blocks.dylib  	       0x1048b5f90 _Block_release + 228 /Library/Caches/com.apple.xbs/Sources/libclosure_Sim/runtime.cpp:0
33  libdispatch.dylib       	       0x104b57a3a _dispatch_client_callout + 8 /Library/Caches/com.apple.xbs/Sources/libdispatch_Sim/src/object.m:560
34  libdispatch.dylib       	       0x104b5f346 _dispatch_lane_serial_drain + 948 /Library/Caches/com.apple.xbs/Sources/libdispatch_Sim/src/inline_internal.h:2632
35  libdispatch.dylib       	       0x104b5ffe2 _dispatch_lane_invoke + 398 /Library/Caches/com.apple.xbs/Sources/libdispatch_Sim/src/queue.c:3940
36  libdispatch.dylib       	       0x104b6cb46 _dispatch_workloop_worker_thread + 870 /Library/Caches/com.apple.xbs/Sources/libdispatch_Sim/src/queue.c:6846
37  libsystem_pthread.dylib 	       0x1060befd0 _pthread_wqthread + 326 /AppleInternal/Library/BuildRoots/a0876c02-1788-11ed-b9c4-96898e02b808/Library/Caches/com.apple.xbs/Sources/libpthread/src/pthread.c:2599
38  libsystem_pthread.dylib 	       0x1060bdf56 start_wqthread + 14

Comment 1 Radar WebKit Bug Importer 2022-12-04 20:40:47 PST

<rdar://problem/102967237>

Comment 2 Simon Fraser (smfr) 2022-12-04 20:41:55 PST

ASSERTION FAILED: !m_impl || !m_shouldEnableAssertions || m_impl->wasConstructedOnMainThread() == isMainThread()
/Volumes/Data/worker/Apple-iOS-16-Simulator-Debug-Build/build/WebKitBuild/Debug-iphonesimulator/usr/local/include/wtf/WeakPtr.h(135) : T *WTF::WeakPtr<WebKit::RemoteRenderingBackendProxy>::operator->() const [T = WebKit::RemoteRenderingBackendProxy, WeakPtrImpl = WTF::DefaultWeakPtrImpl]
1   0x801214759 WTFCrash
2   0x7e21f9fbb WTFCrashWithInfo(int, char const*, char const*, int)
3   0x7e41c30ba WTF::WeakPtr<WebKit::RemoteRenderingBackendProxy, WTF::DefaultWeakPtrImpl>::operator->() const
4   0x7e41e5826 WebKit::RemoteImageBufferProxy::~RemoteImageBufferProxy()
5   0x7e41e5ae5 WebKit::RemoteImageBufferProxy::~RemoteImageBufferProxy()
6   0x7e41e5b09 WebKit::RemoteImageBufferProxy::~RemoteImageBufferProxy()

Comment 3 Kimmo Kinnunen 2022-12-05 03:31:43 PST

Pull request: https://github.com/WebKit/WebKit/pull/7143

Comment 4 EWS 2022-12-07 00:20:02 PST

Committed 257460@main (5df080eee4f3): <https://commits.webkit.org/257460@main>

Reviewed commits have been landed. Closing PR #7143 and removing active labels.