Bug 187525

Summary: [High Sierra Debug Wk1] imported/w3c/web-platform-tests/WebCryptoAPI/wrapKey_unwrapKey/wrapKey_unwrapKey.https.worker.html is flaky
Product: WebKit Reporter: Dawei Fenton (:realdawei) <realdawei>
Component: Tools / TestsAssignee: Nobody <webkit-unassigned>
Status: RESOLVED DUPLICATE    
Severity: Normal CC: ap, cdumez, jiewen_tan, lforschler, ryanhaddad, tsavell
Priority: P2    
Version: WebKit Nightly Build   
Hardware: Unspecified   
OS: Unspecified   
Attachments:
Description Flags
Crash Log none

Dawei Fenton (:realdawei)
Reported 2018-07-10 09:29:31 PDT
The following layout test is a flaky crash on High Sierra Debug WK1 imported/w3c/web-platform-tests/WebCryptoAPI/wrapKey_unwrapKey/wrapKey_unwrapKey.https.worker.html Probable cause: Unknown, test is currently marked [Pass Failure] but has recently begun to occasionally crash. Flakiness Dashboard: https://webkit-test-results.webkit.org/dashboards/flakiness_dashboard.html#showAllRuns=true&tests=imported%2Fw3c%2Fweb-platform-tests%2FWebCryptoAPI%2FwrapKey_unwrapKey%2FwrapKey_unwrapKey.https.worker.html
Attachments
Crash Log (152.69 KB, text/plain)
2018-07-11 10:31 PDT, Dawei Fenton (:realdawei) 		no flags
Details
View All Add attachment proposed patch, testcase, etc.
Alexey Proskuryakov
Comment 1 2018-07-10 17:04:45 PDT
It hits an assertion: The string being removed is atomic in the string table of an other thread!
Dawei Fenton (:realdawei)
Comment 2 2018-07-11 10:31:53 PDT
Created attachment 344768 [details] Crash Log Application Specific Information: CRASHING TEST: https://localhost:9443/WebCryptoAPI/wrapKey_unwrapKey/wrapKey_unwrapKey.https.worker.html Thread 0:: Dispatch queue: com.apple.main-thread 0 com.apple.JavaScriptCore 0x000000011006e6b1 WTF::Atomic<unsigned char>::compareExchangeWeak(unsigned char, unsigned char, std::__1::memory_order) + 65 (Atomics.h:87) 1 com.apple.JavaScriptCore 0x000000011006e663 WTF::LockAlgorithm<unsigned char, (unsigned char)1, (unsigned char)2, WTF::EmptyLockHooks<unsigned char> >::lockFastAssumingZero(WTF::Atomic<unsigned char>&) + 51 (LockAlgorithm.h:54) 2 com.apple.JavaScriptCore 0x000000011006e5f9 WTF::Lock::lock() + 25 (Lock.h:59) 3 com.apple.JavaScriptCore 0x000000011006e5ca WTF::Locker<WTF::Lock>::lock() + 42 (Locker.h:113) 4 com.apple.JavaScriptCore 0x00000001100cc280 WTF::Locker<WTF::Lock>::Locker(WTF::Lock*) + 48 (Locker.h:55) 5 com.apple.JavaScriptCore 0x00000001100c6ffd WTF::Locker<WTF::Lock>::Locker(WTF::Lock*) + 29 (Locker.h:55) 6 com.apple.JavaScriptCore 0x00000001101ace4c JSC::ConcurrentJSLockerBase::ConcurrentJSLockerBase(WTF::Lock&) + 60 (ConcurrentJSLock.h:51) 7 com.apple.JavaScriptCore 0x00000001101acdc8 JSC::GCSafeConcurrentJSLocker::GCSafeConcurrentJSLocker(WTF::Lock&, JSC::Heap&) + 40 (ConcurrentJSLock.h:79) 8 com.apple.JavaScriptCore 0x00000001101ac545 JSC::GCSafeConcurrentJSLocker::GCSafeConcurrentJSLocker(WTF::Lock&, JSC::Heap&) + 37 (ConcurrentJSLock.h:81) 9 com.apple.JavaScriptCore 0x00000001101ac180 int JSC::Structure::add<(JSC::Structure::ShouldPin)1, JSC::JSObject::prepareToPutDirectWithoutTransition(JSC::VM&, JSC::PropertyName, unsigned int, unsigned int, JSC::Structure*)::'lambda'(JSC::GCSafeConcurrentJSLocker const&, int, int)>(JSC::VM&, JSC::PropertyName, unsigned int, JSC::JSObject::prepareToPutDirectWithoutTransition(JSC::VM&, JSC::PropertyName, unsigned int, unsigned int, JSC::Structure*)::'lambda'(JSC::GCSafeConcurrentJSLocker const&, int, int) const&) + 112 (StructureInlines.h:378) 10 com.apple.JavaScriptCore 0x00000001101ac0fb int JSC::Structure::addPropertyWithoutTransition<JSC::JSObject::prepareToPutDirectWithoutTransition(JSC::VM&, JSC::PropertyName, unsigned int, unsigned int, JSC::Structure*)::'lambda'(JSC::GCSafeConcurrentJSLocker const&, int, int)>(JSC::VM&, JSC::PropertyName, unsigned int, JSC::JSObject::prepareToPutDirectWithoutTransition(JSC::VM&, JSC::PropertyName, unsigned int, unsigned int, JSC::Structure*)::'lambda'(JSC::GCSafeConcurrentJSLocker const&, int, int) const&) + 59 (StructureInlines.h:444) 11 com.apple.JavaScriptCore 0x00000001101aab7a JSC::JSObject::prepareToPutDirectWithoutTransition(JSC::VM&, JSC::PropertyName, unsigned int, unsigned int, JSC::Structure*) + 138 (JSObjectInlines.h:212) 12 com.apple.JavaScriptCore 0x00000001101a9c30 bool JSC::JSObject::putDirectInternal<(JSC::JSObject::PutMode)1>(JSC::VM&, JSC::PropertyName, JSC::JSValue, unsigned int, JSC::PutPropertySlot&) + 1040 (JSObjectInlines.h:306) 13 com.apple.JavaScriptCore 0x00000001101a8da0 JSC::JSObject::putDirect(JSC::VM&, JSC::PropertyName, JSC::JSValue, unsigned int) + 272 (JSObject.h:1502) 14 com.apple.JavaScriptCore 0x00000001113929e8 JSC::JSObject::putDirectNativeFunction(JSC::VM&, JSC::JSGlobalObject*, JSC::PropertyName const&, unsigned int, JSC::NativeFunction, JSC::Intrinsic, unsigned int) + 424 (JSObject.cpp:3078) 15 com.apple.WebCore 0x000000011cb7dbb7 JSC::reifyStaticProperty(JSC::VM&, JSC::ClassInfo const*, JSC::PropertyName const&, JSC::HashTableValue const&, JSC::JSObject&) + 743 (Lookup.h:342) 16 com.apple.WebCore 0x000000011d103a29 void JSC::reifyStaticProperties<206u>(JSC::VM&, JSC::ClassInfo const*, JSC::HashTableValue const (&) [206u], JSC::JSObject&) + 233 (Lookup.h:403) 17 com.apple.WebCore 0x000000011d102c58 WebCore::JSDocumentPrototype::finishCreation(JSC::VM&) + 104 (JSDocument.cpp:928) 18 com.apple.WebCore 0x000000011d103fe9 WebCore::JSDocumentPrototype::create(JSC::VM&, WebCore::JSDOMGlobalObject*, JSC::Structure*) + 121 (JSDocument.cpp:549) 19 com.apple.WebCore 0x000000011d103f60 WebCore::JSDocument::createPrototype(JSC::VM&, WebCore::JSDOMGlobalObject&) + 112 (JSDocument.cpp:1038) 20 com.apple.WebCore 0x000000011d12871d JSC::Structure* WebCore::getDOMStructure<WebCore::JSDocument>(JSC::VM&, WebCore::JSDOMGlobalObject&) + 109 (JSDOMWrapperCache.h:85) 21 com.apple.WebCore 0x000000011d10409d JSC::JSObject* WebCore::getDOMPrototype<WebCore::JSDocument>(JSC::VM&, WebCore::JSDOMGlobalObject&) + 29 (JSDOMWrapperCache.h:96) 22 com.apple.WebCore 0x000000011d102b9d WebCore::JSDocument::prototype(JSC::VM&, WebCore::JSDOMGlobalObject&) + 29 (JSDocument.cpp:1043) 23 com.apple.WebCore 0x000000011d2e1323 WebCore::JSHTMLDocument::createPrototype(JSC::VM&, WebCore::JSDOMGlobalObject&) + 67 (JSHTMLDocument.cpp:121) 24 com.apple.WebCore 0x000000011d32a62d JSC::Structure* WebCore::getDOMStructure<WebCore::JSHTMLDocument>(JSC::VM&, WebCore::JSDOMGlobalObject&) + 109 (JSDOMWrapperCache.h:85) 25 com.apple.WebCore 0x000000011e33a02d std::__1::enable_if<std::is_same<WebCore::HTMLDocument, WebCore::HTMLDocument>::value, WebCore::JSDOMWrapperConverterTraits<WebCore::HTMLDocument>::WrapperClass*>::type WebCore::createWrapper<WebCore::HTMLDocument, WebCore::HTMLDocument>(WebCore::JSDOMGlobalObject*, WTF::Ref<WebCore::HTMLDocument, WTF::DumbPtrTraits<WebCore::HTMLDocument> >&&) + 125 (JSDOMWrapperCache.h:187) 26 com.apple.WebCore 0x000000011e339e2d std::__1::enable_if<!(std::is_same<WebCore::HTMLDocument, WebCore::Document>::value), WebCore::JSDOMWrapperConverterTraits<WebCore::HTMLDocument>::WrapperClass*>::type WebCore::createWrapper<WebCore::HTMLDocument, WebCore::Document>(WebCore::JSDOMGlobalObject*, WTF::Ref<WebCore::Document, WTF::DumbPtrTraits<WebCore::Document> >&&) + 61 (JSDOMWrapperCache.h:194) 27 com.apple.WebCore 0x000000011e336697 WebCore::createNewDocumentWrapper(JSC::ExecState&, WebCore::JSDOMGlobalObject&, WTF::Ref<WebCore::Document, WTF::DumbPtrTraits<WebCore::Document> >&&) + 87 (JSDocumentCustom.cpp:39) 28 com.apple.WebCore 0x000000011e336630 WebCore::toJSNewlyCreated(JSC::ExecState*, WebCore::JSDOMGlobalObject*, WTF::Ref<WebCore::Document, WTF::DumbPtrTraits<WebCore::Document> >&&) + 64 (JSDocumentCustom.cpp:81) 29 com.apple.WebCore 0x000000011e3367aa WebCore::toJS(JSC::ExecState*, WebCore::JSDOMGlobalObject*, WebCore::Document&) + 122 (JSDocumentCustom.cpp:88) 30 com.apple.WebCore 0x000000011e3487d8 WebCore::createWrapperInline(JSC::ExecState*, WebCore::JSDOMGlobalObject*, WTF::Ref<WebCore::Node, WTF::DumbPtrTraits<WebCore::Node> >&&) + 664 (JSNodeCustom.cpp:155) 31 com.apple.WebCore 0x000000011e348530 WebCore::createWrapper(JSC::ExecState*, WebCore::JSDOMGlobalObject*, WTF::Ref<WebCore::Node, WTF::DumbPtrTraits<WebCore::Node> >&&) + 64 (JSNodeCustom.cpp:174) 32 com.apple.WebCore 0x000000011cd0e3be WebCore::toJS(JSC::ExecState*, WebCore::JSDOMGlobalObject*, WebCore::Node&) + 206 (JSNodeCustom.h:62) 33 com.apple.WebCore 0x000000011cd600b0 WebCore::toJS(JSC::ExecState*, WebCore::JSDOMGlobalObject*, WebCore::Node*) + 48 (JSNode.h:97) 34 com.apple.WebCore 0x000000011e3253af WebCore::JSDOMWindowBase::updateDocument() + 239 (JSDOMWindowBase.cpp:133) 35 com.apple.WebCore 0x000000011e3758f3 WebCore::ScriptController::updateDocument() + 179 (ScriptController.cpp:396) 36 com.apple.WebCore 0x000000011e7e3edb WebCore::Document::didBecomeCurrentDocumentInFrame() + 43 (Document.cpp:2240) 37 com.apple.WebCore 0x000000011f1998ff WebCore::Frame::setDocument(WTF::RefPtr<WebCore::Document, WTF::DumbPtrTraits<WebCore::Document> >&&) + 1055 (Frame.cpp:312) 38 com.apple.WebCore 0x000000011efc718d WebCore::DocumentWriter::begin(WebCore::URL const&, bool, WebCore::Document*) + 781 (DocumentWriter.cpp:173) 39 com.apple.WebCore 0x000000011ef8a61e WebCore::DocumentLoader::commitData(char const*, unsigned long) + 142 (DocumentLoader.cpp:998) 40 com.apple.WebCore 0x000000011ef8a0b5 WebCore::DocumentLoader::finishedLoading() + 405 (DocumentLoader.cpp:430) 41 com.apple.WebCore 0x000000011ef940c9 WebCore::DocumentLoader::maybeLoadEmpty() + 1241 (DocumentLoader.cpp:1672) 42 com.apple.WebCore 0x000000011ef94288 WebCore::DocumentLoader::startLoadingMainResource(WebCore::ShouldContinue) + 360 (DocumentLoader.cpp:1688) 43 com.apple.WebCore 0x000000011f0008bc WebCore::FrameLoader::continueLoadAfterNavigationPolicy(WebCore::ResourceRequest const&, WebCore::FormState*, WebCore::ShouldContinue, WebCore::AllowNavigationToInvalidURL)::$_14::operator()() const + 828 44 com.apple.WebCore 0x000000011f000559 WTF::Function<void ()>::CallableWrapper<WebCore::FrameLoader::continueLoadAfterNavigationPolicy(WebCore::ResourceRequest const&, WebCore::FormState*, WebCore::ShouldContinue, WebCore::AllowNavigationToInvalidURL)::$_14>::call() + 25 (Function.h:101) 45 com.apple.WebCore 0x000000011ca33d6b WTF::Function<void ()>::operator()() const + 139 (Function.h:56) 46 com.apple.WebCore 0x000000011dda7275 WTF::CompletionHandler<void ()>::operator()() const + 117 (CompletionHandler.h:60) 47 com.apple.WebCore 0x000000011efdf597 WebCore::FrameLoader::continueLoadAfterNavigationPolicy(WebCore::ResourceRequest const&, WebCore::FormState*, WebCore::ShouldContinue, WebCore::AllowNavigationToInvalidURL) + 1191 (FrameLoader.cpp:3355) 48 com.apple.WebCore 0x000000011effd7e5 WebCore::FrameLoader::loadWithDocumentLoader(WebCore::DocumentLoader*, WebCore::FrameLoadType, WTF::RefPtr<WebCore::FormState, WTF::DumbPtrTraits<WebCore::FormState> >&&, WebCore::AllowNavigationToInvalidURL, WebCore::ShouldTreatAsContinuingLoad, WTF::CompletionHandler<void ()>&&)::$_9::operator()(WebCore::ResourceRequest const&, WTF::WeakPtr<WebCore::FormState>&&, WebCore::ShouldContinue) const + 85 (FrameLoader.cpp:1600) 49 com.apple.WebCore 0x000000011effd6c5 WTF::Function<void (WebCore::ResourceRequest&&, WTF::WeakPtr<WebCore::FormState>&&, WebCore::ShouldContinue)>::CallableWrapper<WebCore::FrameLoader::loadWithDocumentLoader(WebCore::DocumentLoader*, WebCore::FrameLoadType, WTF::RefPtr<WebCore::FormState, WTF::DumbPtrTraits<WebCore::FormState> >&&, WebCore::AllowNavigationToInvalidURL, WebCore::ShouldTreatAsContinuingLoad, WTF::CompletionHandler<void ()>&&)::$_9>::call(WebCore::ResourceRequest&&, WTF::WeakPtr<WebCore::FormState>&&, WebCore::ShouldContinue) + 85 (Function.h:101) 50 com.apple.WebCore 0x000000011f040329 WTF::Function<void (WebCore::ResourceRequest&&, WTF::WeakPtr<WebCore::FormState>&&, WebCore::ShouldContinue)>::operator()(WebCore::ResourceRequest&&, WTF::WeakPtr<WebCore::FormState>&&, WebCore::ShouldContinue) const + 217 (Function.h:56) 51 com.apple.WebCore 0x000000011f030296 WTF::CompletionHandler<void (WebCore::ResourceRequest&&, WTF::WeakPtr<WebCore::FormState>&&, WebCore::ShouldContinue)>::operator()(WebCore::ResourceRequest&&, WTF::WeakPtr<WebCore::FormState>&&, WebCore::ShouldContinue) const + 166 (CompletionHandler.h:60) 52 com.apple.WebCore 0x000000011f02f82e WebCore::PolicyChecker::checkNavigationPolicy(WebCore::ResourceRequest&&, WebCore::ResourceResponse const&, WebCore::DocumentLoader*, WTF::RefPtr<WebCore::FormState, WTF::DumbPtrTraits<WebCore::FormState> >&&, WTF::CompletionHandler<void (WebCore::ResourceRequest&&, WTF::WeakPtr<WebCore::FormState>&&, WebCore::ShouldContinue)>&&, WebCore::PolicyDecisionMode) + 510 (PolicyChecker.cpp:112) 53 com.apple.WebCore 0x000000011efded41 WebCore::FrameLoader::loadWithDocumentLoader(WebCore::DocumentLoader*, WebCore::FrameLoadType, WTF::RefPtr<WebCore::FormState, WTF::DumbPtrTraits<WebCore::FormState> >&&, WebCore::AllowNavigationToInvalidURL, WebCore::ShouldTreatAsContinuingLoad, WTF::CompletionHandler<void ()>&&) + 2369 (FrameLoader.cpp:1598) 54 com.apple.WebCore 0x000000011efdafdf WebCore::FrameLoader::load(WebCore::DocumentLoader*) + 559 (FrameLoader.cpp:1519) 55 com.apple.WebCore 0x000000011efddfc8 WebCore::FrameLoader::load(WebCore::FrameLoadRequest&&) + 1080 (FrameLoader.cpp:1465) 56 com.apple.WebKitLegacy 0x000000011adf3246 -[WebFrame loadRequest:] + 678 (WebFrame.mm:2489) 57 DumpRenderTree 0x000000010f72a9d0 runTest(std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> > const&) + 8704 (DumpRenderTree.mm:2082) 58 DumpRenderTree 0x000000010f728721 runTestingServerLoop() + 417 (DumpRenderTree.mm:1166) 59 DumpRenderTree 0x000000010f727bde dumpRenderTree(int, char const**) + 1646 (DumpRenderTree.mm:1268) 60 DumpRenderTree 0x000000010f72ae6f DumpRenderTreeMain(int, char const**) + 111 (DumpRenderTree.mm:1387) 61 DumpRenderTree 0x000000010f7b3382 main + 34 (DumpRenderTreeMain.mm:34) 62 libdyld.dylib 0x00007fff7b4ef015 start + 1
Ryan Haddad
Comment 3 2018-07-11 10:39:59 PDT
This run shows an example of the assertion failure Alexey pointed out: https://build.webkit.org/results/Apple%20High%20Sierra%20Debug%20WK2%20(Tests)/r233716%20(4055)/results.html ASSERTION FAILED: The string being removed is atomic in the string table of an other thread! iterator != atomicStringTable.end() /Volumes/Data/slave/highsierra-debug/build/Source/WTF/wtf/text/AtomicStringImpl.cpp(489) : static void WTF::AtomicStringImpl::remove(WTF::AtomicStringImpl *) 1 0x64f797e19 WTFCrash 2 0x64f7a07fb WTF::AtomicStringImpl::remove(WTF::AtomicStringImpl*) 3 0x64f81f5d4 WTF::StringImpl::~StringImpl() 4 0x64f81f805 WTF::StringImpl::~StringImpl() 5 0x64f81f825 WTF::StringImpl::destroy(WTF::StringImpl*) 6 0x64f79b6bf WTF::StringImpl::deref() ...
Jiewen Tan
Comment 4 2018-07-11 10:41:52 PDT
The issue is noted and will be tracked in Bug 187501.
Ryan Haddad
Comment 5 2018-07-11 16:25:41 PDT
(In reply to Jiewen Tan from comment #4) > The issue is noted and will be tracked in Bug 187501. Should this be duped there?
Jiewen Tan
Comment 6 2018-07-12 10:47:16 PDT
(In reply to Ryan Haddad from comment #5) > (In reply to Jiewen Tan from comment #4) > > The issue is noted and will be tracked in Bug 187501. > > Should this be duped there? I will gather all similar bugs once I have a working patch and dupe them to that bug.
Jiewen Tan
Comment 7 2018-07-13 13:29:14 PDT
*** This bug has been marked as a duplicate of bug 187501 ***
Note You need to log in before you can comment on or make changes to this bug.