Bug 259539

Summary: [ macOS Debug ] ASSERTION FAILED: m_wrapper and text failures on storage/indexeddb/cursor-update.html
Product: WebKit Reporter: Ben Schwartz <ben_schwartz>
Component: Website StorageAssignee: Sihui Liu <sihui_liu>
Status: RESOLVED FIXED    
Severity: Normal CC: ap, cdumez, sihui_liu, webkit-bot-watchers-bugzilla, webkit-bug-importer, ysuzuki
Priority: P2 Keywords: InRadar
Version: WebKit Nightly Build   
Hardware: Unspecified   
OS: Unspecified   

Description Ben Schwartz 2023-07-26 17:14:24 PDT 
storage/indexeddb/cursor-update.html

This test is a flaky crash/failure on debug builds of macOS.

HISTORY:

https://results.webkit.org/?limit=48638&platform=mac&style=debug

CRASH LOG:

ASSERTION FAILED: m_wrapper
/Volumes/Data/worker/Apple-Ventura-Debug-Build/build/Source/WebCore/bindings/js/JSEventListener.h(163) : JSC::JSObject *WebCore::JSEventListener::ensureJSFunction(WebCore::ScriptExecutionContext &) const
1   0x152b5eb68 WTFCrash
2   0x10673bcd0 WebCore::BaseAudioContext::currentSampleFrame() const
3   0x107d4bbdc WebCore::JSEventListener::ensureJSFunction(WebCore::ScriptExecutionContext&) const
4   0x106bb0fc4 WebCore::JSEventListener::handleEvent(WebCore::ScriptExecutionContext&, WebCore::Event&)
5   0x10755dc08 WebCore::EventTarget::innerInvokeEventListeners(WebCore::Event&, WTF::Vector<WTF::RefPtr<WebCore::RegisteredEventListener, WTF::RawPtrTraits<WebCore::RegisteredEventListener>, WTF::DefaultRefDerefTraits<WebCore::RegisteredEventListener>>, 1ul, WTF::CrashOnOverflow, 2ul, WTF::FastMalloc>, WebCore::EventTarget::EventInvokePhase)
6   0x10755d6b0 WebCore::EventTarget::fireEventListeners(WebCore::Event&, WebCore::EventTarget::EventInvokePhase)
7   0x107546eac WebCore::EventContext::handleLocalEvents(WebCore::Event&, WebCore::EventTarget::EventInvokePhase) const
8   0x1075480c8 WebCore::dispatchEventInDOM(WebCore::Event&, WebCore::EventPath const&)
9   0x1075484b4 void WebCore::dispatchEventWithType<WebCore::EventTarget>(WTF::Vector<WebCore::EventTarget*, 0ul, WTF::CrashOnOverflow, 16ul, WTF::FastMalloc> const&, WebCore::Event&)
10  0x107548358 WebCore::EventDispatcher::dispatchEvent(WTF::Vector<WebCore::EventTarget*, 0ul, WTF::CrashOnOverflow, 16ul, WTF::FastMalloc> const&, WebCore::Event&)
11  0x1061daa58 WebCore::IDBRequest::dispatchEvent(WebCore::Event&)
12  0x10738c584 WebCore::ActiveDOMObject::queueTaskToDispatchEventInternal(WebCore::EventTarget&, WebCore::TaskSource, WTF::Ref<WebCore::Event, WTF::RawPtrTraits<WebCore::Event>>&&)::$_5::operator()() const
13  0x10738c4a8 WTF::Detail::CallableWrapper<WebCore::ActiveDOMObject::queueTaskToDispatchEventInternal(WebCore::EventTarget&, WebCore::TaskSource, WTF::Ref<WebCore::Event, WTF::RawPtrTraits<WebCore::Event>>&&)::$_5, void>::call()
14  0x106bf9cdc WTF::Function<void ()>::operator()() const
15  0x10738cba0 WebCore::ActiveDOMObjectEventDispatchTask::execute()
16  0x10754a6b4 WebCore::EventLoop::run()
17  0x1076cef34 WebCore::WindowEventLoop::didReachTimeToRun()
18  0x1076d40ec decltype(*std::declval<WebCore::WindowEventLoop*&>().*std::declval<void (WebCore::WindowEventLoop::*&)()>()()) std::__1::__invoke[abi:v15006]<void (WebCore::WindowEventLoop::*&)(), WebCore::WindowEventLoop*&, void>(void (WebCore::WindowEventLoop::*&)(), WebCore::WindowEventLoop*&)
19  0x1076d406c std::__1::__bind_return<void (WebCore::WindowEventLoop::*)(), std::__1::tuple<WebCore::WindowEventLoop*>, std::__1::tuple<>, __is_valid_bind_return<void (WebCore::WindowEventLoop::*)(), std::__1::tuple<WebCore::WindowEventLoop*>, std::__1::tuple<>>::value>::type std::__1::__apply_functor[abi:v15006]<void (WebCore::WindowEventLoop::*)(), std::__1::tuple<WebCore::WindowEventLoop*>, 0ul, std::__1::tuple<>>(void (WebCore::WindowEventLoop::*&)(), std::__1::tuple<WebCore::WindowEventLoop*>&, std::__1::__tuple_indices<0ul>, std::__1::tuple<>&&)
20  0x1076d4024 std::__1::__bind_return<void (WebCore::WindowEventLoop::*)(), std::__1::tuple<WebCore::WindowEventLoop*>, std::__1::tuple<>, __is_valid_bind_return<void (WebCore::WindowEventLoop::*)(), std::__1::tuple<WebCore::WindowEventLoop*>, std::__1::tuple<>>::value>::type std::__1::__bind<void (WebCore::WindowEventLoop::*&)(), WebCore::WindowEventLoop*>::operator()[abi:v15006]<>()
21  0x1076d3fc8 WTF::Detail::CallableWrapper<std::__1::__bind<void (WebCore::WindowEventLoop::*&)(), WebCore::WindowEventLoop*>, void>::call()
22  0x106bf9cdc WTF::Function<void ()>::operator()() const
23  0x103ef5ffc WebCore::Timer::fired()
24  0x10857d8dc WebCore::ThreadTimers::sharedTimerFiredInternal()
25  0x108585db4 WebCore::ThreadTimers::setSharedTimer(WebCore::SharedTimer*)::$_0::operator()() const
26  0x108585d60 WTF::Detail::CallableWrapper<WebCore::ThreadTimers::setSharedTimer(WebCore::SharedTimer*)::$_0, void>::call()
27  0x106bf9cdc WTF::Function<void ()>::operator()() const
28  0x108529154 WebCore::MainThreadSharedTimer::fired()
29  0x108610508 WebCore::timerFired(__CFRunLoopTimer*, void*)
30  0x19620c3c8 __CFRUNLOOP_IS_CALLING_OUT_TO_A_TIMER_CALLBACK_FUNCTION__
31  0x19620c070 __CFRunLoopDoTimer
com.apple.WebKit.WebContent.Development terminated (pid 95738) for reason: crash
LEAK: 1 WebPageProxy

CRASH LINK:

https://build.webkit.org/results/Apple-Ventura-Debug-AppleSilicon-WK2-Tests/266319@main%20(3182)/storage/indexeddb/cursor-update-crash-log.txt

TEXT DIFF (for failures):

@@ -43,163 +43,7 @@
 PASS event.target.source is objectStore
 event.target.result.update('myUpdatedValue' + counter++)
 event.target.source.continue()
-basicUpdateCursor()
-PASS event.target.source is objectStore
-event.target.result.update('myUpdatedValue' + counter++)
-event.target.source.continue()
-basicUpdateCursor()
-PASS event.target.source is objectStore
-PASS counter is 5
-trans.objectStore('basicStore').openCursor(keyRange)
-basicCheckCursor()
-PASS event.target.result.key is "myKey1"
-PASS event.target.result.value is "myUpdatedValue1"
-event.target.result.continue()
-basicCheckCursor()
-PASS event.target.result.key is "myKey2"
-PASS event.target.result.value is "myUpdatedValue2"
-event.target.result.continue()
-basicCheckCursor()
-PASS event.target.result.key is "myKey3"
-PASS event.target.result.value is "myUpdatedValue3"
-event.target.result.continue()
-basicCheckCursor()
-PASS event.target.result.key is "myKey4"
-PASS event.target.result.value is "myUpdatedValue4"
-event.target.result.continue()
-basicCheckCursor()
-PASS counter is 5
-trans.objectStore('autoIncrementStore').openCursor(keyRange)
-autoIncrementUpdateCursor()
-event.target.result.update('myUpdatedFoo' + counter++)
-event.target.source.continue()
-autoIncrementUpdateCursor()
-event.target.result.update('myUpdatedFoo' + counter++)
-event.target.source.continue()
-autoIncrementUpdateCursor()
-event.target.result.update('myUpdatedFoo' + counter++)
-event.target.source.continue()
-autoIncrementUpdateCursor()
-event.target.result.update('myUpdatedFoo' + counter++)
-event.target.source.continue()
-autoIncrementUpdateCursor()
-PASS counter is 5
-trans.objectStore('autoIncrementStore').openCursor(keyRange)
-autoIncrementCheckCursor()
-PASS event.target.result.key is counter
-PASS event.target.result.value is "myUpdatedFoo1"
-event.target.result.continue()
-autoIncrementCheckCursor()
-PASS event.target.result.key is counter
-PASS event.target.result.value is "myUpdatedFoo2"
-event.target.result.continue()
-autoIncrementCheckCursor()
-PASS event.target.result.key is counter
-PASS event.target.result.value is "myUpdatedFoo3"
-event.target.result.continue()
-autoIncrementCheckCursor()
-PASS event.target.result.key is counter
-PASS event.target.result.value is "myUpdatedFoo4"
-event.target.result.continue()
-autoIncrementCheckCursor()
-PASS counter is 5
-trans.objectStore('keyPathStore').openCursor(keyRange)
-keyPathUpdateCursor()
-Expecting exception from event.target.result.update({id: 100 + counter, number: 100 + counter})
-PASS Exception was thrown.
-PASS code is 0
-PASS ename is 'DataError'
-Exception message: Failed to execute 'update' on 'IDBCursor': The effective object store of this cursor uses in-line keys and evaluating the key path of the value parameter results in a different value than the cursor's effective key.
-event.target.result.update({id: counter, number: 100 + counter++})
-event.target.source.continue()
-keyPathUpdateCursor()
-Expecting exception from event.target.result.update({id: 100 + counter, number: 100 + counter})
-PASS Exception was thrown.
-PASS code is 0
-PASS ename is 'DataError'
-Exception message: Failed to execute 'update' on 'IDBCursor': The effective object store of this cursor uses in-line keys and evaluating the key path of the value parameter results in a different value than the cursor's effective key.
-event.target.result.update({id: counter, number: 100 + counter++})
-event.target.source.continue()
-keyPathUpdateCursor()
-Expecting exception from event.target.result.update({id: 100 + counter, number: 100 + counter})
-PASS Exception was thrown.
-PASS code is 0
-PASS ename is 'DataError'
-Exception message: Failed to execute 'update' on 'IDBCursor': The effective object store of this cursor uses in-line keys and evaluating the key path of the value parameter results in a different value than the cursor's effective key.
-event.target.result.update({id: counter, number: 100 + counter++})
-event.target.source.continue()
-keyPathUpdateCursor()
-Expecting exception from event.target.result.update({id: 100 + counter, number: 100 + counter})
-PASS Exception was thrown.
-PASS code is 0
-PASS ename is 'DataError'
-Exception message: Failed to execute 'update' on 'IDBCursor': The effective object store of this cursor uses in-line keys and evaluating the key path of the value parameter results in a different value than the cursor's effective key.
-event.target.result.update({id: counter, number: 100 + counter++})
-event.target.source.continue()
-keyPathUpdateCursor()
-PASS counter is 5
-trans.objectStore('keyPathStore').openCursor(keyRange)
-keyPathCheckCursor()
-PASS event.target.result.key is counter
-PASS event.target.result.value.id is counter
-PASS event.target.result.value.number is 101
-event.target.result.continue()
-keyPathCheckCursor()
-PASS event.target.result.key is counter
-PASS event.target.result.value.id is counter
-PASS event.target.result.value.number is 102
-event.target.result.continue()
-keyPathCheckCursor()
-PASS event.target.result.key is counter
-PASS event.target.result.value.id is counter
-PASS event.target.result.value.number is 103
-event.target.result.continue()
-keyPathCheckCursor()
-PASS event.target.result.key is counter
-PASS event.target.result.value.id is counter
-PASS event.target.result.value.number is 104
-event.target.result.continue()
-keyPathCheckCursor()
-PASS counter is 5
-trans.objectStore('keyPathStore').index('numberIndex').openKeyCursor(keyRange)
-keyCursor()
-PASS event.target.result.key is counter + 100
-PASS event.target.result.primaryKey is counter
-Expecting exception from event.target.result.update({id: counter, number: counter + 200})
-PASS Exception was thrown.
-PASS code is DOMException.INVALID_STATE_ERR
-PASS ename is 'InvalidStateError'
-Exception message: Failed to execute 'update' on 'IDBCursor': The cursor is a key cursor.
-event.target.result.continue();
-keyCursor()
-PASS event.target.result.key is counter + 100
-PASS event.target.result.primaryKey is counter
-Expecting exception from event.target.result.update({id: counter, number: counter + 200})
-PASS Exception was thrown.
-PASS code is DOMException.INVALID_STATE_ERR
-PASS ename is 'InvalidStateError'
-Exception message: Failed to execute 'update' on 'IDBCursor': The cursor is a key cursor.
-event.target.result.continue();
-keyCursor()
-PASS event.target.result.key is counter + 100
-PASS event.target.result.primaryKey is counter
-Expecting exception from event.target.result.update({id: counter, number: counter + 200})
-PASS Exception was thrown.
-PASS code is DOMException.INVALID_STATE_ERR
-PASS ename is 'InvalidStateError'
-Exception message: Failed to execute 'update' on 'IDBCursor': The cursor is a key cursor.
-event.target.result.continue();
-keyCursor()
-PASS event.target.result.key is counter + 100
-PASS event.target.result.primaryKey is counter
-Expecting exception from event.target.result.update({id: counter, number: counter + 200})
-PASS Exception was thrown.
-PASS code is DOMException.INVALID_STATE_ERR
-PASS ename is 'InvalidStateError'
-Exception message: Failed to execute 'update' on 'IDBCursor': The cursor is a key cursor.
-event.target.result.continue();
-keyCursor()
-PASS counter is 5
+FAIL event.target.source.continue() threw exception InvalidStateError: The object is in an invalid state.
 openBasicCursor()
 trans = db.transaction('basicStore')
 trans.objectStore('basicStore')
@@ -235,6 +79,7 @@
 attemptUpdate()
 transactionComplete()
 PASS successfullyParsed is true
+Some tests failed.
 
 TEST COMPLETE

DIFF URL (for failures):

https://build.webkit.org/results/Apple-Ventura-Debug-WK2-Tests/266173@main%20(2677)/storage/indexeddb/cursor-update-pretty-diff.html
Comment 1 Radar WebKit Bug Importer 2023-07-26 17:14:37 PDT 
<rdar://problem/112943647>
Comment 2 Ben Schwartz 2023-07-26 17:32:26 PDT 
I have marked this test as a flaky crash/failure while this issue is investigated. (Link: https://github.com/WebKit/WebKit/pull/16120)
Comment 3 EWS 2023-07-26 17:33:45 PDT 
Test gardening commit 266343@main (e902e79b92dd): <https://commits.webkit.org/266343@main>

Reviewed commits have been landed. Closing PR #16120 and removing active labels.
Comment 4 Alexey Proskuryakov 2023-07-26 19:51:24 PDT 
It's somewhat surprising that an assertion failure here isn't turning into flaky failures in release, as it means that event handlers aren't executed.
Comment 5 Sihui Liu 2023-09-11 20:50:39 PDT 
Pull request: https://github.com/WebKit/WebKit/pull/17686
Comment 6 EWS 2023-09-27 10:49:33 PDT 
Committed 268521@main (cf4b2dd3b585): <https://commits.webkit.org/268521@main>

Reviewed commits have been landed. Closing PR #17686 and removing active labels.
Comment 7 Sihui Liu 2023-09-28 10:54:31 PDT 
Re-opening for pull request https://github.com/WebKit/WebKit/pull/18365
Comment 8 EWS 2023-09-28 10:59:37 PDT 
Test gardening commit 268596@main (c07d4237640d): <https://commits.webkit.org/268596@main>

Reviewed commits have been landed. Closing PR #18365 and removing active labels.