187247 2018-07-02 07:24:10 -0700 REGRESSION(r233381): Double WebResourceLoadStatisticsStore destructor invocation 2018-07-02 08:27:36 -0700 1 1 1 Unclassified WebKit WebKit2 WebKit Nightly Build Unspecified Unspecified RESOLVED FIXED InRadar P2 Normal --- 187200 1 zan zan bfulgham cdumez cgarcia commit-queue mcatanzaro webkit-bug-importer wilander oldest_to_newest 1438465 0 zan 2018-07-02 07:24:10 -0700 Since r233381, the WebResourceLoadStatisticsStore destructor dispatches a task on its statistics WorkQueue and waits for it completion, but in doing so increases its reference count just to drop it again after the dispatched WTF::Function<> is destroyed and that additional reference to WebResourceLoadStatisticsStore released, yet again dropping reference count to 0 and invoking the WebResourceLoadStatisticsStore destructor. http://trac.webkit.org/changeset/233381 Here's the backtrace, though the cause of the crash isn't obvious from it: Thread 1 (Thread 0x7fb2a7f83f80 (LWP 23168)): #0 0x00007fb2b5727085 in g_mutex_lock () at /home/buildbot/webkitgtk/gtk-linux-64-release-wayland-tests/build/WebKitBuild/DependenciesGTK/Source/glib-2.54.2/glib/gthread-posix.c:1336 #1 0x00007fb2b56dfe00 in g_source_destroy_internal () at /home/buildbot/webkitgtk/gtk-linux-64-release-wayland-tests/build/WebKitBuild/DependenciesGTK/Source/glib-2.54.2/glib/gmain.c:1236 #2 0x00005580712cfa0b in _ZN3WTF7RunLoop9TimerBaseD2Ev () #3 0x00007fb2b7d25953 in _ZN6WebKit30WebResourceLoadStatisticsStoreD2Ev () from /home/slave/webkitgtk/gtk-linux-64-release/build/WebKitBuild/Release/lib/libwebkit2gtk-4.0.so.37 #4 0x00007fb2b7d259e9 in _ZN6WebKit30WebResourceLoadStatisticsStoreD0Ev () from /home/slave/webkitgtk/gtk-linux-64-release/build/WebKitBuild/Release/lib/libwebkit2gtk-4.0.so.37 #5 0x000055807128ea2d in _ZN3WTF31dispatchFunctionsFromMainThreadEv () #6 0x00005580712cfb63 in _ZZN3WTF7RunLoop9TimerBaseC4ERS0_ENUlPvE_4_FUNES3_ () #7 0x00007fb2b56e281a in g_main_dispatch () at /home/buildbot/webkitgtk/gtk-linux-64-release-wayland-tests/build/WebKitBuild/DependenciesGTK/Source/glib-2.54.2/glib/gmain.c:3148 #8 g_main_context_dispatch () at /home/buildbot/webkitgtk/gtk-linux-64-release-wayland-tests/build/WebKitBuild/DependenciesGTK/Source/glib-2.54.2/glib/gmain.c:3813 #9 0x00007fb2b56e2ba8 in g_main_context_iterate () at /home/buildbot/webkitgtk/gtk-linux-64-release-wayland-tests/build/WebKitBuild/DependenciesGTK/Source/glib-2.54.2/glib/gmain.c:3886 #10 0x00007fb2b56e2c4c in g_main_context_iteration () at /home/buildbot/webkitgtk/gtk-linux-64-release-wayland-tests/build/WebKitBuild/DependenciesGTK/Source/glib-2.54.2/glib/gmain.c:3947 #11 0x00007fb2b5cb1035 in gtk_main_iteration () at /home/buildbot/webkitgtk/gtk-linux-64-release-wayland-tests/build/WebKitBuild/DependenciesGTK/Source/gtk+-3.22.11/gtk/gtkmain.c:1413 #12 0x000055807127f2d5 in _ZN3WTR15PlatformWebViewC2EPK25OpaqueWKPageConfigurationRKNS_11TestOptionsE () #13 0x0000558071263654 in _ZN3WTR14TestController24createWebViewWithOptionsERKNS_11TestOptionsE () #14 0x000055807126557b in _ZN3WTR14TestController32ensureViewSupportsOptionsForTestERKNS_14TestInvocationE () #15 0x0000558071265851 in _ZN3WTR14TestController20configureViewForTestERKNS_14TestInvocationE () #16 0x000055807126ad1b in _ZN3WTR14TestInvocation6invokeEv () #17 0x000055807125e41e in _ZN3WTR14TestController7runTestEPKc () #18 0x000055807125e62b in _ZN3WTR14TestController20runTestingServerLoopEv () #19 0x0000558071262408 in _ZN3WTR14TestControllerC2EiPPKc () #20 0x0000558071257596 in main () 1438470 1 344101 zan 2018-07-02 07:49:46 -0700 Created attachment 344101 Patch 1438476 2 344101 cdumez 2018-07-02 07:54:14 -0700 Comment on attachment 344101 Patch Please do not duplicate this code, just update the existing function to stop using postTask() and dispatch to the work queue instead. 1438478 3 zan 2018-07-02 08:03:18 -0700 (In reply to Chris Dumez from comment #2) > Comment on attachment 344101 [details] > Patch > > Please do not duplicate this code, just update the existing function to stop > using postTask() and dispatch to the work queue instead. applicationWillTerminate() still calls flushAndDestroyPersistentStore(). Is it fine to assume that the WebResourceLoadStatisticsStore reference through which applicationWillTerminate() will survive for the duration of this dispatch? 1438482 4 344104 zan 2018-07-02 08:14:19 -0700 Created attachment 344104 Patch 1438483 5 zan 2018-07-02 08:22:38 -0700 (In reply to Zan Dobersek from comment #3) > (In reply to Chris Dumez from comment #2) > > Comment on attachment 344101 [details] > > Patch > > > > Please do not duplicate this code, just update the existing function to stop > > using postTask() and dispatch to the work queue instead. > > applicationWillTerminate() still calls flushAndDestroyPersistentStore(). Is > it fine to assume that the WebResourceLoadStatisticsStore reference through > which applicationWillTerminate() will survive for the duration of this > dispatch? I guess it should be the caller's responsibility to ensure object's validity for the duration of the method call they invoked. 1438484 6 344104 cdumez 2018-07-02 08:26:05 -0700 Comment on attachment 344104 Patch r=me, thanks for fixing. 1438485 7 webkit-bug-importer 2018-07-02 08:26:40 -0700 <rdar://problem/41723801> 1438486 8 344104 zan 2018-07-02 08:27:31 -0700 Comment on attachment 344104 Patch Clearing flags on attachment: 344104 Committed r233423: <https://trac.webkit.org/changeset/233423> 1438487 9 zan 2018-07-02 08:27:36 -0700 All reviewed patches have been landed. Closing bug. 344101 2018-07-02 07:49:46 -0700 2018-07-02 08:14:16 -0700 Patch bug-187247-20180702164945.patch text/plain 2242 zan U3VidmVyc2lvbiBSZXZpc2lvbjogMjMzNDE1CmRpZmYgLS1naXQgYS9Tb3VyY2UvV2ViS2l0L0No YW5nZUxvZyBiL1NvdXJjZS9XZWJLaXQvQ2hhbmdlTG9nCmluZGV4IDQ4YTRiNDcxMDdiN2QyNDM2 YjcxYTE1NmIzMjU1ZmIyM2M4ZTU0YzcuLmQ1NmI5MDY5NzlhMWM5YWM3ZmYwODk0YjFlNGRmYTI0 ODlhYWJlODEgMTAwNjQ0Ci0tLSBhL1NvdXJjZS9XZWJLaXQvQ2hhbmdlTG9nCisrKyBiL1NvdXJj ZS9XZWJLaXQvQ2hhbmdlTG9nCkBAIC0xLDMgKzEsMTcgQEAKKzIwMTgtMDctMDIgIFphbiBEb2Jl cnNlayAgPHpkb2JlcnNla0BpZ2FsaWEuY29tPgorCisgICAgICAgIFJFR1JFU1NJT04ocjIzMzM4 MSk6IERvdWJsZSBXZWJSZXNvdXJjZUxvYWRTdGF0aXN0aWNzU3RvcmUgZGVzdHJ1Y3RvciBpbnZv Y2F0aW9uCisgICAgICAgIGh0dHBzOi8vYnVncy53ZWJraXQub3JnL3Nob3dfYnVnLmNnaT9pZD0x ODcyNDcKKworICAgICAgICBSZXZpZXdlZCBieSBOT0JPRFkgKE9PUFMhKS4KKworICAgICAgICAq IFVJUHJvY2Vzcy9XZWJSZXNvdXJjZUxvYWRTdGF0aXN0aWNzU3RvcmUuY3BwOgorICAgICAgICAo V2ViS2l0OjpXZWJSZXNvdXJjZUxvYWRTdGF0aXN0aWNzU3RvcmU6On5XZWJSZXNvdXJjZUxvYWRT dGF0aXN0aWNzU3RvcmUpOgorICAgICAgICBEaXNwYXRjaCB0aGUgZmx1c2gtYW5kLWRlc3Ryb3kg dGFzayBvbiB0aGUgc3RhdGlzdGljcyBxdWV1ZSB3aXRob3V0CisgICAgICAgIHRha2luZyBhIHJl ZmVyZW5jZSB0byB0aGUgb2JqZWN0IHRoYXQncyBjdXJyZW50bHkgYmVpbmcgZGVsZXRlZCwgYXMg dGhhdAorICAgICAgICB3aWxsIG9ubHkgZW5kIHVwIGludm9raW5nIGRlc3RydWN0b3IgZm9yIHRo ZSBzZWNvbmQgdGltZSBvbmNlIHRoZQorICAgICAgICByZWZlcmVuY2UgaXMgZGVzdHJveWVkIGFu ZCB0aGUgcmVmY291bnQgYWdhaW4gZHJvcHMgdG8gMC4KKwogMjAxOC0wNi0yMyAgRGFyaW4gQWRs ZXIgIDxkYXJpbkBhcHBsZS5jb20+CiAKICAgICAgICAgW0NvY29hXSBJbXByb3ZlIEFSQyBjb21w YXRpYmlsaXR5IG9mIG1vcmUgY29kZSBpbiBKYXZhU2NyaXB0Q29yZQpkaWZmIC0tZ2l0IGEvU291 cmNlL1dlYktpdC9VSVByb2Nlc3MvV2ViUmVzb3VyY2VMb2FkU3RhdGlzdGljc1N0b3JlLmNwcCBi L1NvdXJjZS9XZWJLaXQvVUlQcm9jZXNzL1dlYlJlc291cmNlTG9hZFN0YXRpc3RpY3NTdG9yZS5j cHAKaW5kZXggYzRlODViYzM2NWI1NmY5YTYzZGRhNjgyMTQzM2ZhNmIzODJhNmUxOS4uODVhMmUx ZmNiZjZmNDVhZmJlMTRmNDVjY2VjMjcxMDk4ZmZmMWRlMyAxMDA2NDQKLS0tIGEvU291cmNlL1dl YktpdC9VSVByb2Nlc3MvV2ViUmVzb3VyY2VMb2FkU3RhdGlzdGljc1N0b3JlLmNwcAorKysgYi9T b3VyY2UvV2ViS2l0L1VJUHJvY2Vzcy9XZWJSZXNvdXJjZUxvYWRTdGF0aXN0aWNzU3RvcmUuY3Bw CkBAIC0xMzAsNyArMTMwLDE4IEBAIFdlYlJlc291cmNlTG9hZFN0YXRpc3RpY3NTdG9yZTo6fldl YlJlc291cmNlTG9hZFN0YXRpc3RpY3NTdG9yZSgpCiB7CiAgICAgQVNTRVJUKFJ1bkxvb3A6Omlz TWFpbigpKTsKIAotICAgIGZsdXNoQW5kRGVzdHJveVBlcnNpc3RlbnRTdG9yZSgpOworICAgIC8v IEZsdXNoIGFuZCBkZXN0cm95IHRoZSBwZXJzaXN0ZW50IHN0b3JlIG9iamVjdHMgb24gdGhlIGJh Y2tncm91bmQgcXVldWUsCisgICAgLy8gYnV0IHNpbmNlIHdlJ3JlIGFscmVhZHkgaW4gdGhlIGRl c3RydWN0b3IsIGRvIGl0IHdpdGhvdXQgdGFraW5nIGEgcmVmZXJlbmNlCisgICAgLy8gdG8gdGhp cyBvYmplY3QgKGFzIHdvdWxkIGJlIGRvbmUgd2hlbiBkaXNwYXRjaGluZyB2aWEgcG9zdFRhc2so KSkuCisgICAgaWYgKG1fcGVyc2lzdGVudFN0b3JhZ2UgfHwgbV9tZW1vcnlTdG9yZSkgeworICAg ICAgICBCaW5hcnlTZW1hcGhvcmUgc2VtYXBob3JlOworICAgICAgICBtX3N0YXRpc3RpY3NRdWV1 ZS0+ZGlzcGF0Y2goW3RoaXMsICZzZW1hcGhvcmVdIHsKKyAgICAgICAgICAgIG1fcGVyc2lzdGVu dFN0b3JhZ2UgPSBudWxscHRyOworICAgICAgICAgICAgbV9tZW1vcnlTdG9yZSA9IG51bGxwdHI7 CisgICAgICAgICAgICBzZW1hcGhvcmUuc2lnbmFsKCk7CisgICAgICAgIH0pOworICAgICAgICBz ZW1hcGhvcmUud2FpdChXYWxsVGltZTo6aW5maW5pdHkoKSk7CisgICAgfQogfQogCiBpbmxpbmUg dm9pZCBXZWJSZXNvdXJjZUxvYWRTdGF0aXN0aWNzU3RvcmU6OnBvc3RUYXNrKFdURjo6RnVuY3Rp b248dm9pZCgpPiYmIHRhc2spCg== 344104 2018-07-02 08:14:19 -0700 2018-07-02 08:27:31 -0700 Patch bug-187247-20180702171418.patch text/plain 2302 zan U3VidmVyc2lvbiBSZXZpc2lvbjogMjMzNDE1CmRpZmYgLS1naXQgYS9Tb3VyY2UvV2ViS2l0L0No YW5nZUxvZyBiL1NvdXJjZS9XZWJLaXQvQ2hhbmdlTG9nCmluZGV4IDQ4YTRiNDcxMDdiN2QyNDM2 YjcxYTE1NmIzMjU1ZmIyM2M4ZTU0YzcuLjhkZjhjZjQ4ZGI3OTcxY2JhYWUyNjRkMmE4ZjI5Zjc4 YTE0MmE4MjEgMTAwNjQ0Ci0tLSBhL1NvdXJjZS9XZWJLaXQvQ2hhbmdlTG9nCisrKyBiL1NvdXJj ZS9XZWJLaXQvQ2hhbmdlTG9nCkBAIC0xLDMgKzEsMTkgQEAKKzIwMTgtMDctMDIgIFphbiBEb2Jl cnNlayAgPHpkb2JlcnNla0BpZ2FsaWEuY29tPgorCisgICAgICAgIFJFR1JFU1NJT04ocjIzMzM4 MSk6IERvdWJsZSBXZWJSZXNvdXJjZUxvYWRTdGF0aXN0aWNzU3RvcmUgZGVzdHJ1Y3RvciBpbnZv Y2F0aW9uCisgICAgICAgIGh0dHBzOi8vYnVncy53ZWJraXQub3JnL3Nob3dfYnVnLmNnaT9pZD0x ODcyNDcKKworICAgICAgICBSZXZpZXdlZCBieSBOT0JPRFkgKE9PUFMhKS4KKworICAgICAgICAq IFVJUHJvY2Vzcy9XZWJSZXNvdXJjZUxvYWRTdGF0aXN0aWNzU3RvcmUuY3BwOgorICAgICAgICAo V2ViS2l0OjpXZWJSZXNvdXJjZUxvYWRTdGF0aXN0aWNzU3RvcmU6OmZsdXNoQW5kRGVzdHJveVBl cnNpc3RlbnRTdG9yZSk6CisgICAgICAgIERvbid0IGNhbGwgcG9zdFRhc2soKSB0byBkaXNwYXRj aCB0aGlzIHRhc2ssIGFzIHRoYXQga2VlcHMgYSByZWZlcmVuY2UKKyAgICAgICAgdG8gdGhpcyBX ZWJSZXNvdXJjZUxvYWRTdGF0aXN0aWNzU3RvcmUgb2JqZWN0IGFuZCB0aHVzIGNhdXNlcyBwcm9i bGVtcworICAgICAgICB3aGVuIGludm9rZWQgZnJvbSB0aGUgZGVzdHJ1Y3RvciBpbiB0aGUgZm9y bSBvZiBhIHNlY29uZCBkZXN0cnVjdG9yCisgICAgICAgIGludm9jYXRpb24gdGhhdCBlbmRzIHVw IGNyYXNoaW5nIHRoZSBwcm9jZXNzLiBCbG9ja2luZyBuYXR1cmUgb2YgdGhpcworICAgICAgICBj YWxsIHNob3VsZCBiZSBlbm91Z2ggdG8gYXZvaWQgV2ViUmVzb3VyY2VMb2FkU3RhdGlzdGljc1N0 b3JlIGxpZmV0aW1lCisgICAgICAgIGlzc3Vlcy4KKwogMjAxOC0wNi0yMyAgRGFyaW4gQWRsZXIg IDxkYXJpbkBhcHBsZS5jb20+CiAKICAgICAgICAgW0NvY29hXSBJbXByb3ZlIEFSQyBjb21wYXRp YmlsaXR5IG9mIG1vcmUgY29kZSBpbiBKYXZhU2NyaXB0Q29yZQpkaWZmIC0tZ2l0IGEvU291cmNl L1dlYktpdC9VSVByb2Nlc3MvV2ViUmVzb3VyY2VMb2FkU3RhdGlzdGljc1N0b3JlLmNwcCBiL1Nv dXJjZS9XZWJLaXQvVUlQcm9jZXNzL1dlYlJlc291cmNlTG9hZFN0YXRpc3RpY3NTdG9yZS5jcHAK aW5kZXggYzRlODViYzM2NWI1NmY5YTYzZGRhNjgyMTQzM2ZhNmIzODJhNmUxOS4uZmVhNjVlMzc0 NTdkYzgwZWQ5ZTZhNTcwNTRkMWQ1OGQ4NDc0MjQ0ZiAxMDA2NDQKLS0tIGEvU291cmNlL1dlYktp dC9VSVByb2Nlc3MvV2ViUmVzb3VyY2VMb2FkU3RhdGlzdGljc1N0b3JlLmNwcAorKysgYi9Tb3Vy Y2UvV2ViS2l0L1VJUHJvY2Vzcy9XZWJSZXNvdXJjZUxvYWRTdGF0aXN0aWNzU3RvcmUuY3BwCkBA IC0xNTcsOSArMTU3LDExIEBAIHZvaWQgV2ViUmVzb3VyY2VMb2FkU3RhdGlzdGljc1N0b3JlOjpm bHVzaEFuZERlc3Ryb3lQZXJzaXN0ZW50U3RvcmUoKQogICAgICAgICByZXR1cm47CiAKICAgICAv LyBNYWtlIHN1cmUgd2UgZGVzdHJveSB0aGUgcGVyc2lzdGVudCBzdG9yZSBvbiB0aGUgYmFja2dy b3VuZCBxdWV1ZSBhbmQgd2FpdCBmb3IgaXQgdG8gZGllCi0gICAgLy8gc3luY2hyb25vdXNseSBz aW5jZSBpdCBoYXMgYSBDKysgcmVmZXJlbmNlIHRvIHVzLgorICAgIC8vIHN5bmNocm9ub3VzbHkg c2luY2UgaXQgaGFzIGEgQysrIHJlZmVyZW5jZSB0byB1cy4gQmxvY2tpbmcgbmF0dXJlIG9mIHRo aXMgdGFzayBhbGxvd3MgdXMKKyAgICAvLyB0byBub3QgbWFpbnRhaW4gYSBXZWJSZXNvdXJjZUxv YWRTdGF0aXN0aWNzU3RvcmUgcmVmZXJlbmNlIGZvciB0aGUgZHVyYXRpb24gb2YgZGlzcGF0Y2gs CisgICAgLy8gYXZvaWRpbmcgZG91YmxlLWRlbGV0aW9uIGlzc3VlcyB3aGVuIHRoaXMgaXMgaW52 b2tlZCBmcm9tIHRoZSBkZXN0cnVjdG9yLgogICAgIEJpbmFyeVNlbWFwaG9yZSBzZW1hcGhvcmU7 Ci0gICAgcG9zdFRhc2soWyZzZW1hcGhvcmUsIHRoaXNdIHsKKyAgICBtX3N0YXRpc3RpY3NRdWV1 ZS0+ZGlzcGF0Y2goWyZzZW1hcGhvcmUsIHRoaXNdIHsKICAgICAgICAgbV9wZXJzaXN0ZW50U3Rv cmFnZSA9IG51bGxwdHI7CiAgICAgICAgIG1fbWVtb3J5U3RvcmUgPSBudWxscHRyOwogICAgICAg ICBzZW1hcGhvcmUuc2lnbmFsKCk7Cg==