Bug 256189

Summary:	New-Test [ wk2 Debug iOS, Monterey+ x86_64] ASSERTION FAILED: decontaminate()
Product:	WebKit	Reporter:	Robert Jenner <jenner>
Component:	Media	Assignee:	Nobody <webkit-unassigned>
Status:	NEW ---
Severity:	Normal	CC:	eric.carlson, webkit-bot-watchers-bugzilla, webkit-bug-importer
Priority:	P2	Keywords:	InRadar
Version:	WebKit Nightly Build
Hardware:	Unspecified
OS:	Unspecified
See Also:	https://bugs.webkit.org/show_bug.cgi?id=259394

Description Robert Jenner 2023-05-01 17:08:08 PDT

ipc/wait-for-video-output-will-change.html 

is a constant crash/assertion on Debug for iOS, and Monterey+ wk2 but only on Intel Macs.

HISTORY:
https://results.webkit.org/?suite=layout-tests&test=ipc%2Fwait-for-video-output-will-change.html

ASSERTION/CRASH TEXT:
ASSERTION FAILED: decontaminate()
./runtime/StructureID.h(132) : JSC::Structure *JSC::StructureID::decode() const
1   0x7d827d979 WTFCrash
2   0x7d9e669fb WTFCrashWithInfo(int, char const*, char const*, int)
3   0x7d9d79c3e JSC::StructureID::decode() const
4   0x7d9cc35f5 JSC::JSCell::structure() const
5   0x7d9cc36c6 JSC::JSCell::classInfo() const
6   0x7d8402609 JSC::JSCell::inherits(JSC::ClassInfo const*) const
7   0x7d9fd7790 JSC::ScriptExecutable const* JSC::jsCast<JSC::ScriptExecutable const*, JSC::ExecutableBase const>(JSC::ExecutableBase const*)
8   0x7d9fc1ef8 JSC::ExecutableBase::hasJITCodeForCall() const
9   0x7d9665d90 JSC::ExecutableBase::hasJITCodeFor(JSC::CodeSpecializationKind) const
10  0x7d963b2a3 void JSC::ScriptExecutable::prepareForExecution<JSC::FunctionExecutable>(JSC::VM&, JSC::JSFunction*, JSC::JSScope*, JSC::CodeSpecializationKind, JSC::CodeBlock*&)
11  0x7d9a7a213 JSC::Interpreter::executeCallImpl(JSC::VM&, JSC::JSObject*, JSC::CallData const&, JSC::JSValue, JSC::ArgList const&)
12  0x7d9a7a5c0 JSC::Interpreter::executeCall(JSC::JSObject*, JSC::CallData const&, JSC::JSValue, JSC::ArgList const&)
13  0x7d9d2065d JSC::call(JSC::JSGlobalObject*, JSC::JSValue, JSC::CallData const&, JSC::JSValue, JSC::ArgList const&)
14  0x7d9d20915 JSC::profiledCall(JSC::JSGlobalObject*, JSC::ProfilingReason, JSC::JSValue, JSC::CallData const&, JSC::JSValue, JSC::ArgList const&)
15  0x7d8c35f85 JSObjectCallAsFunction
16  0x7b3f541a5 WebKit::IPCTestingAPI::JSMessageListener::willSendMessage(IPC::Encoder const&, WTF::OptionSet<IPC::SendOption>)
17  0x7b4650acc IPC::Connection::sendMessage(WTF::UniqueRef<IPC::Encoder>&&, WTF::OptionSet<IPC::SendOption>, std::__1::optional<WTF::Thread::QOS>)
18  0x7b3cbc8d6 bool IPC::Connection::send<Messages::RemoteSampleBufferDisplayLayerManager::ReleaseLayer>(Messages::RemoteSampleBufferDisplayLayerManager::ReleaseLayer&&, unsigned long long, WTF::OptionSet<IPC::SendOption>, std::__1::optional<WTF::Thread::QOS>)
19  0x7b3cbc768 WebKit::SampleBufferDisplayLayer::~SampleBufferDisplayLayer()
20  0x7b3cbcb65 WebKit::SampleBufferDisplayLayer::~SampleBufferDisplayLayer()
21  0x7b3cbcbc9 WebKit::SampleBufferDisplayLayer::~SampleBufferDisplayLayer()
22  0x78d4bffdc std::__1::default_delete<WebCore::SampleBufferDisplayLayer>::operator()[abi:v15006](WebCore::SampleBufferDisplayLayer*) const
23  0x78d4bff5c std::__1::unique_ptr<WebCore::SampleBufferDisplayLayer, std::__1::default_delete<WebCore::SampleBufferDisplayLayer> >::reset[abi:v15006](WebCore::SampleBufferDisplayLayer*)
24  0x78d4a0ef1 std::__1::unique_ptr<WebCore::SampleBufferDisplayLayer, std::__1::default_delete<WebCore::SampleBufferDisplayLayer> >::operator=[abi:v15006](std::nullptr_t)
25  0x78d49f12c WebCore::MediaPlayerPrivateMediaStreamAVFObjC::destroyLayers()
26  0x78d4b5d65 WebCore::MediaPlayerPrivateMediaStreamAVFObjC::renderVideoWillBeDestroyed()
27  0x78fb8a8f5 WebCore::MediaPlayer::renderVideoWillBeDestroyed()
28  0x7902d2675 WebCore::RenderVideo::willBeDestroyed()
29  0x79024a2b5 WebCore::RenderObject::destroy()
30  0x79024a0f9 WebCore::RenderObjectDeleter::operator()(WebCore::RenderObject*) const
31  0x7901325ec std::__1::unique_ptr<WebCore::RenderObject, WebCore::RenderObjectDeleter>::reset[abi:v15006](WebCore::RenderObject*)
com.apple.WebKit.WebContent.Development terminated (pid 42962) for reason: crash
LEAK: 1 WebPageProxy

Comment 1 Radar WebKit Bug Importer 2023-05-01 17:08:43 PDT

<rdar://problem/108763436>

Comment 2 Robert Jenner 2023-05-01 17:47:56 PDT

I was able to reproduce this crash/assertion failure at Ventura Debug ToT running the test as follows:

run-webkit-tests ipc/wait-for-video-output-will-change.html  


This test was introduced at: https://commits.webkit.org/259548.221@safari-7615-branch and appears to have been crashing on Debug for iOS and Mac wk2 Intel only since it was introduced.

Comment 3 Robert Jenner 2023-05-01 17:50:23 PDT

(In reply to Robert Jenner from comment #2)
> I was able to reproduce this crash/assertion failure at Ventura Debug ToT
> running the test as follows:
> 
> run-webkit-tests ipc/wait-for-video-output-will-change.html  
> 
> 
> This test was introduced at:
> https://commits.webkit.org/259548.221@safari-7615-branch and appears to have
> been crashing on Debug for iOS and Mac wk2 Intel only since it was
> introduced.

Disregard the link mentioned above. It was introduced at:

https://commits.webkit.org/262541@main

Comment 4 EWS 2023-05-01 18:10:14 PDT

Test gardening commit 263566@main (3afe29b45647): <https://commits.webkit.org/263566@main>

Reviewed commits have been landed. Closing PR #13348 and removing active labels.