Bug 261555

Summary:	jquery/attributes.html is flaky fail with StreamClientConnection ASSERTION FAILED: !m_connection->isValid()
Product:	WebKit	Reporter:	Kimmo Kinnunen <kkinnunen>
Component:	WebKit2	Assignee:	Kimmo Kinnunen <kkinnunen>
Status:	RESOLVED FIXED
Severity:	Normal	CC:	ap, bfulgham, brandonstewart, kkinnunen, webkit-bug-importer, wilander
Priority:	P2	Keywords:	InRadar
Version:	WebKit Local Build
Hardware:	Unspecified
OS:	Unspecified

Description Kimmo Kinnunen 2023-09-14 07:53:27 PDT

jquery/attributes.html is flaky fail with StreamClientConnection  ASSERTION FAILED: !m_connection->isValid()

Due to IPC JS tests testing stream, the destructor is not aware that the object will be really destructed in the scavenger thread.

No crash log found for com.apple.WebKit.WebContent.Development:20910.

stdout:

stderr:
ASSERTION FAILED: !m_connection->isValid()
/Volumes/Data/worker/macOS-AppleSilicon-Ventura-Debug-Build-EWS/build/Source/WebKit/Platform/IPC/StreamClientConnection.cpp(90) : IPC::StreamClientConnection::~StreamClientConnection()
1   0x1377d0df8 WTFCrash
2   0x1185ef6c0 std::__1::span<unsigned char const, 18446744073709551615ul>::span[abi:v15006]<unsigned char const*>(unsigned char const*, unsigned long)
3   0x11b4c9558 IPC::StreamClientConnection::~StreamClientConnection()
4   0x11b4c963c IPC::StreamClientConnection::~StreamClientConnection()
5   0x119f215bc WTF::ThreadSafeRefCounted<IPC::StreamClientConnection, (WTF::DestructionThread)0>::deref() const::'lambda'()::operator()() const
6   0x119f21578 WTF::ThreadSafeRefCounted<IPC::StreamClientConnection, (WTF::DestructionThread)0>::deref() const
7   0x11ac2456c WTF::DefaultRefDerefTraits<IPC::StreamClientConnection>::derefIfNotNull(IPC::StreamClientConnection*)
8   0x11ac24530 WTF::RefPtr<IPC::StreamClientConnection, WTF::RawPtrTraits<IPC::StreamClientConnection>, WTF::DefaultRefDerefTraits<IPC::StreamClientConnection>>::~RefPtr()
9   0x119f20b94 WTF::RefPtr<IPC::StreamClientConnection, WTF::RawPtrTraits<IPC::StreamClientConnection>, WTF::DefaultRefDerefTraits<IPC::StreamClientConnection>>::~RefPtr()
10  0x11ac251d4 WebKit::IPCTestingAPI::JSIPCStreamClientConnection::~JSIPCStreamClientConnection()
11  0x11ac25174 WebKit::IPCTestingAPI::JSIPCStreamClientConnection::~JSIPCStreamClientConnection()
12  0x11ac25140 std::__1::default_delete<WebKit::IPCTestingAPI::JSIPCStreamClientConnection>::operator()[abi:v15006](WebKit::IPCTestingAPI::JSIPCStreamClientConnection*) const
13  0x11abda1e4 WTF::RefCounted<WebKit::IPCTestingAPI::JSIPCStreamClientConnection, std::__1::default_delete<WebKit::IPCTestingAPI::JSIPCStreamClientConnection>>::deref() const
14  0x11abda0e8 WebKit::IPCTestingAPI::JSIPCStreamClientConnection::finalize(OpaqueJSValue*)
15  0x138124718 JSC::JSCallbackObject<JSC::JSNonFinalObject>::~JSCallbackObject()
16  0x1381245f4 JSC::JSCallbackObject<JSC::JSNonFinalObject>::~JSCallbackObject()
17  0x13811b08c JSC::JSCallbackObject<JSC::JSNonFinalObject>::destroy(JSC::JSCell*)
18  0x138e3d3b0 JSC::IsoHeapCellType::operator()(JSC::VM&, JSC::JSCell*) const
19  0x138e3f52c void JSC::MarkedBlock::Handle::specializedSweep<false, (JSC::MarkedBlock::Handle::EmptyMode)0, (JSC::MarkedBlock::Handle::SweepMode)0, (JSC::MarkedBlock::Handle::SweepDestructionMode)0, (JSC::MarkedBlock::Handle::ScribbleMode)0, (JSC::MarkedBlock::Handle::NewlyAllocatedMode)0, (JSC::MarkedBlock::Handle::MarksMode)0, JSC::IsoHeapCellType>(JSC::FreeList*, JSC::MarkedBlock::Handle::EmptyMode, JSC::MarkedBlock::Handle::SweepMode, JSC::MarkedBlock::Handle::SweepDestructionMode, JSC::MarkedBlock::Handle::ScribbleMode, JSC::MarkedBlock::Handle::NewlyAllocatedMode, JSC::MarkedBlock::Handle::MarksMode, JSC::IsoHeapCellType const&)::'lambda'(void*)::operator()(void*) const
20  0x138e3f5ac void JSC::MarkedBlock::Handle::specializedSweep<false, (JSC::MarkedBlock::Handle::EmptyMode)0, (JSC::MarkedBlock::Handle::SweepMode)0, (JSC::MarkedBlock::Handle::SweepDestructionMode)0, (JSC::MarkedBlock::Handle::ScribbleMode)0, (JSC::MarkedBlock::Handle::NewlyAllocatedMode)0, (JSC::MarkedBlock::Handle::MarksMode)0, JSC::IsoHeapCellType>(JSC::FreeList*, JSC::MarkedBlock::Handle::EmptyMode, JSC::MarkedBlock::Handle::SweepMode, JSC::MarkedBlock::Handle::SweepDestructionMode, JSC::MarkedBlock::Handle::ScribbleMode, JSC::MarkedBlock::Handle::NewlyAllocatedMode, JSC::MarkedBlock::Handle::MarksMode, JSC::IsoHeapCellType const&)::'lambda'(unsigned long)::operator()(unsigned long) const
21  0x138e38778 void JSC::MarkedBlock::Handle::specializedSweep<false, (JSC::MarkedBlock::Handle::EmptyMode)0, (JSC::MarkedBlock::Handle::SweepMode)0, (JSC::MarkedBlock::Handle::SweepDestructionMode)0, (JSC::MarkedBlock::Handle::ScribbleMode)0, (JSC::MarkedBlock::Handle::NewlyAllocatedMode)0, (JSC::MarkedBlock::Handle::MarksMode)0, JSC::IsoHeapCellType>(JSC::FreeList*, JSC::MarkedBlock::Handle::EmptyMode, JSC::MarkedBlock::Handle::SweepMode, JSC::MarkedBlock::Handle::SweepDestructionMode, JSC::MarkedBlock::Handle::ScribbleMode, JSC::MarkedBlock::Handle::NewlyAllocatedMode, JSC::MarkedBlock::Handle::MarksMode, JSC::IsoHeapCellType const&)
22  0x138e2d818 void JSC::MarkedBlock::Handle::finishSweepKnowingHeapCellType<JSC::IsoHeapCellType>(JSC::FreeList*, JSC::IsoHeapCellType const&)
23  0x138e2d6c8 JSC::IsoHeapCellType::finishSweep(JSC::MarkedBlock::Handle&, JSC::FreeList*) const
24  0x138e721dc JSC::Subspace::finishSweep(JSC::MarkedBlock::Handle&, JSC::FreeList*)
25  0x138e4b1b0 JSC::MarkedBlock::Handle::sweep(JSC::FreeList*)
26  0x138e3129c JSC::LocalAllocator::tryAllocateIn(JSC::MarkedBlock::Handle*, unsigned long)
27  0x138e30f60 JSC::LocalAllocator::tryAllocateWithoutCollecting(unsigned long)
28  0x138e30aa0 JSC::LocalAllocator::allocateSlowCase(JSC::Heap&, unsigned long, JSC::GCDeferralContext*, JSC::AllocationFailureMode)
29  0x137e42d40 JSC::LocalAllocator::allocate(JSC::Heap&, unsigned long, JSC::GCDeferralContext*, JSC::AllocationFailureMode)::'lambda'()::operator()() const
30  0x137e5d448 JSC::HeapCell* JSC::FreeList::allocateWithCellSize<JSC::LocalAllocator::allocate(JSC::Heap&, unsigned long, JSC::GCDeferralContext*, JSC::AllocationFailureMode)::'lambda'()>(JSC::LocalAllocator::allocate(JSC::Heap&, unsigned long, JSC::GCDeferralContext*, JSC::AllocationFailureMode)::'lambda'() const&, unsigned long)
31  0x137e6ffd4 JSC::LocalAllocator::allocate(JSC::Heap&, unsigned long, JSC::GCDeferralContext*, JSC::AllocationFailureMode)
com.apple.WebKit.WebContent.Development terminated (pid 20910) for reason: crash
LEAK: 2 WebPageProxy

Comment 1 Radar WebKit Bug Importer 2023-09-14 07:53:41 PDT

<rdar://problem/115494068>

Comment 2 Kimmo Kinnunen 2023-09-14 07:54:23 PDT

https://ews-build.webkit.org/#/builders/17/builds/14751

Comment 3 Alexey Proskuryakov 2023-09-14 18:37:11 PDT

This comes from a preceding test, likely one of the below. Tearing down the document should also tear down IPCTestingAPI, without waiting for GC.

02:29:30.715 11708 worker/4 ipc/restrictedendpoints/allow-access-attachmentElement.html passed
02:29:31.370 11708 worker/4 ipc/restrictedendpoints/allow-access-modelElement.html passed
02:29:32.006 11708 worker/4 ipc/restrictedendpoints/allow-access-testOnlyIPC.html passed
02:29:34.587 11708 worker/4 ipc/restrictedendpoints/allow-access-webGPU.html passed

Comment 4 Kimmo Kinnunen 2023-09-15 00:25:41 PDT

Pull request: https://github.com/WebKit/WebKit/pull/17805

Comment 5 EWS 2023-09-18 10:30:58 PDT

Committed 268086@main (c0a9a955b480): <https://commits.webkit.org/268086@main>

Reviewed commits have been landed. Closing PR #17805 and removing active labels.