59459 2011-04-26 08:04:35 -0700 fast/canvas/webgl/bad-arguments-test.html et al crashing since r84893 2011-04-27 17:49:22 -0700 1 1 1 Unclassified WebKit WebGL 528+ (Nightly build) PC All RESOLVED FIXED P2 Normal --- 59487 59659 1 senorblanco abarth abarth adamk darin enne jamesr jennb kbr levin zmo oldest_to_newest 392465 0 senorblanco 2011-04-26 08:04:35 -0700 Many WebGL tests are crashing; seems to have started at http://trac.webkit.org/changeset/84893/ http://test-results.appspot.com/dashboards/flakiness_dashboard.html#group=%40ToT%20-%20chromium.org&tests=fast%2Fcanvas%2Fwebgl%2Fbad-arguments-test.html%2Cfast%2Fcanvas%2Fwebgl%2Fbuffer-bind-test.html%2Cfast%2Fcanvas%2Fwebgl%2Fbuffer-data-array-buffer.html%2Cfast%2Fcanvas%2Fwebgl%2Fcanvas-test.html%2Cfast%2Fcanvas%2Fwebgl%2Fconstants.html%2Cfast%2Fcanvas%2Fwebgl%2Fcontext-attributes-alpha-depth-stencil-antialias.html%2Cfast%2Fcanvas%2Fwebgl%2Fcontext-destroyed-crash.html%2Cfast%2Fcanvas%2Fwebgl%2Fcontext-lost-restored.html%2Cfast%2Fcanvas%2Fwebgl%2Fcontext-lost.html%2Cfast%2Fcanvas%2Fwebgl%2Fcopy-tex-image-and-sub-image-2d.html%2Cfast%2Fcanvas%2Fwebgl%2Fcss-webkit-canvas-repaint.html%2Cfast%2Fcanvas%2Fwebgl%2Fcss-webkit-canvas.html%2Cfast%2Fcanvas%2Fwebgl%2Fdraw-arrays-out-of-bounds.html%2Cfast%2Fcanvas%2Fwebgl%2Fdraw-elements-out-of-bounds.html%2Cfast%2Fcanvas%2Fwebgl%2Ferror-reporting.html%2Cfast%2Fcanvas%2Fwebgl%2Fframebuffer-object-attachment.html%2Cfast%2Fcanvas%2Fwebgl%2Fframebuffer-test.html%2Cfast%2Fcanvas%2Fwebgl%2Fget-active-test.html%2Cfast%2Fcanvas%2Fwebgl%2Fgl-bind-attrib-location-test.html%2Cfast%2Fcanvas%2Fwebgl%2Fgl-enable-enum-test.html 392481 1 abarth 2011-04-26 08:26:26 -0700 I'm pretty sure the change is correct. There are likely bugs elsewhere causing the problem. However, we can revert and investigate. 392485 2 91111 senorblanco 2011-04-26 08:34:00 -0700 Created attachment 91111 Patch 392486 3 kbr 2011-04-26 08:35:00 -0700 Something is clearly wrong with the OwnPtr cleanup in http://trac.webkit.org/changeset/84893/ . The only thing I can think of is that the assignment of OwnPtr<T> to OwnPtr<T> is broken. Looking at the OwnPtr and PassOwnPtr headers I do not see how this assignment is handled by these classes. There exists: OwnPtr& operator=(const PassOwnPtr<T>&); but I don't see a cast operator from OwnPtr<T> to PassOwnPtr<T>, nor a copy constructor on the PassOwnPtr class which takes OwnPtr. Therefore I think this assignment is performing a member-by-member assignment, and when the right hand side goes out of scope, the pointed-to object is deleted. I think the code requires a .release() on the pointer on the right-hand side. If this analysis is correct, then all of the strict OwnPtr cleanups made yesterday are broken and should be reverted. Additionally, the assignment operator "OwnPtr& operator=(const OwnPtr<T>&);" should explicitly be made private in OwnPtr. 392488 4 91111 kbr 2011-04-26 08:35:25 -0700 Comment on attachment 91111 Patch Yes, let's revert this change until we understand what's going on. 392490 5 senorblanco 2011-04-26 08:37:08 -0700 Committed r84916: <http://trac.webkit.org/changeset/84916> 91111 2011-04-26 08:34:00 -0700 2011-04-26 08:35:25 -0700 Patch bug-59459-20110426113359.patch text/plain 2021 senorblanco SW5kZXg6IFNvdXJjZS9XZWJLaXQvY2hyb21pdW0vQ2hhbmdlTG9nCj09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT0KLS0tIFNv dXJjZS9XZWJLaXQvY2hyb21pdW0vQ2hhbmdlTG9nCShyZXZpc2lvbiA4NDkxNCkKKysrIFNvdXJj ZS9XZWJLaXQvY2hyb21pdW0vQ2hhbmdlTG9nCSh3b3JraW5nIGNvcHkpCkBAIC0xLDMgKzEsMTQg QEAKKzIwMTEtMDQtMjYgIFN0ZXBoZW4gV2hpdGUgIDxzZW5vcmJsYW5jb0BjaHJvbWl1bS5vcmc+ CisKKyAgICAgICAgUmV2aWV3ZWQgYnkgTk9CT0RZIChPT1BTISkuCisKKyAgICAgICAgUGFydGlh bCByZXZlcnQgb2YgaHR0cDovL3RyYWMud2Via2l0Lm9yZy9jaGFuZ2VzZXQvODQ4OTMsIHNpbmNl IGl0CisgICAgICAgIHRyaWdnZXJlZCBhIGxhcmdlIG51bWJlciBvZiBsYXlvdXQgdGVzdCBmYWls dXJlcy4KKyAgICAgICAgaHR0cHM6Ly9idWdzLndlYmtpdC5vcmcvc2hvd19idWcuY2dpP2lkPTU5 NDU5CisKKyAgICAgICAgKiBzcmMvR3JhcGhpY3NDb250ZXh0M0RDaHJvbWl1bS5jcHA6CisgICAg ICAgIChXZWJDb3JlOjpHcmFwaGljc0NvbnRleHQzREludGVybmFsOjppbml0aWFsaXplKToKKwog MjAxMS0wNC0yNiAgSGFucyBXZW5uYm9yZyAgPGhhbnNAY2hyb21pdW0ub3JnPgogCiAgICAgICAg IFJldmlld2VkIGJ5IFRvbnkgR2VudGlsY29yZS4KSW5kZXg6IFNvdXJjZS9XZWJLaXQvY2hyb21p dW0vc3JjL0dyYXBoaWNzQ29udGV4dDNEQ2hyb21pdW0uY3BwCj09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT0KLS0tIFNvdXJj ZS9XZWJLaXQvY2hyb21pdW0vc3JjL0dyYXBoaWNzQ29udGV4dDNEQ2hyb21pdW0uY3BwCShyZXZp c2lvbiA4NDkxNCkKKysrIFNvdXJjZS9XZWJLaXQvY2hyb21pdW0vc3JjL0dyYXBoaWNzQ29udGV4 dDNEQ2hyb21pdW0uY3BwCSh3b3JraW5nIGNvcHkpCkBAIC0xMDksNyArMTA5LDcgQEAgYm9vbCBH cmFwaGljc0NvbnRleHQzREludGVybmFsOjppbml0aWFsaQogICAgIHdlYkF0dHJpYnV0ZXMuYW50 aWFsaWFzID0gYXR0cnMuYW50aWFsaWFzOwogICAgIHdlYkF0dHJpYnV0ZXMucHJlbXVsdGlwbGll ZEFscGhhID0gYXR0cnMucHJlbXVsdGlwbGllZEFscGhhOwogICAgIHdlYkF0dHJpYnV0ZXMuY2Fu UmVjb3ZlckZyb21Db250ZXh0TG9zcyA9IGF0dHJzLmNhblJlY292ZXJGcm9tQ29udGV4dExvc3M7 Ci0gICAgT3duUHRyPFdlYktpdDo6V2ViR3JhcGhpY3NDb250ZXh0M0Q+IHdlYkNvbnRleHQgPSBh ZG9wdFB0cihXZWJLaXQ6OndlYktpdENsaWVudCgpLT5jcmVhdGVHcmFwaGljc0NvbnRleHQzRCgp KTsKKyAgICBXZWJLaXQ6OldlYkdyYXBoaWNzQ29udGV4dDNEKiB3ZWJDb250ZXh0ID0gV2ViS2l0 Ojp3ZWJLaXRDbGllbnQoKS0+Y3JlYXRlR3JhcGhpY3NDb250ZXh0M0QoKTsKICAgICBpZiAoIXdl YkNvbnRleHQpCiAgICAgICAgIHJldHVybiBmYWxzZTsKIApAQCAtMTIwLDkgKzEyMCwxMSBAQCBi b29sIEdyYXBoaWNzQ29udGV4dDNESW50ZXJuYWw6OmluaXRpYWxpCiAKICAgICBpZiAoIW1fd2Vi Vmlld0ltcGwpCiAgICAgICAgIHJldHVybiBmYWxzZTsKLSAgICBpZiAoIXdlYkNvbnRleHQtPmlu aXRpYWxpemUod2ViQXR0cmlidXRlcywgbV93ZWJWaWV3SW1wbCwgcmVuZGVyRGlyZWN0bHlUb0hv c3RXaW5kb3cpKQorICAgIGlmICghd2ViQ29udGV4dC0+aW5pdGlhbGl6ZSh3ZWJBdHRyaWJ1dGVz LCBtX3dlYlZpZXdJbXBsLCByZW5kZXJEaXJlY3RseVRvSG9zdFdpbmRvdykpIHsKKyAgICAgICAg ZGVsZXRlIHdlYkNvbnRleHQ7CiAgICAgICAgIHJldHVybiBmYWxzZTsKLSAgICBtX2ltcGwgPSB3 ZWJDb250ZXh0OworICAgIH0KKyAgICBtX2ltcGwuc2V0KHdlYkNvbnRleHQpOwogCiAjaWYgVVNF KEFDQ0VMRVJBVEVEX0NPTVBPU0lUSU5HKQogICAgIG1fY29tcG9zaXRpbmdMYXllciA9IFdlYkdM TGF5ZXJDaHJvbWl1bTo6Y3JlYXRlKDApOwo=