Bug 192673

Summary: REGRESSION: Crashes in MarkedBlock::aboutToMarkSlow on imported/w3c/web-platform-tests/FileAPI/idlharness.worker.html and other tests
Product: WebKit Reporter: WebKit Commit Bot <commit-queue>
Component: JavaScriptCoreAssignee: WebKit Commit Bot <commit-queue>
Status: RESOLVED DUPLICATE    
Severity: Normal CC: ap, fpizlo, jlewis3, keith_miller, lforschler, mark.lam, ryanhaddad, tsavell, webkit-bug-importer, ysuzuki
Priority: P2 Keywords: InRadar
Version: WebKit Nightly Build   
Hardware: Unspecified   
OS: Unspecified   
Bug Depends on:    
Bug Blocks: 50856    
Attachments:
Description Flags
Archive of layout-test-results from webkit-cq-02 none

WebKit Commit Bot
Reported 2018-12-13 11:56:05 PST
This is an automatically generated bug from the commit-queue. imported/w3c/web-platform-tests/FileAPI/idlharness.worker.html has been flaky on the commit-queue. imported/w3c/web-platform-tests/FileAPI/idlharness.worker.html was authored by . https://trac.webkit.org/browser/trunk/LayoutTests/imported/w3c/web-platform-tests/FileAPI/idlharness.worker.html The commit-queue just saw imported/w3c/web-platform-tests/FileAPI/idlharness.worker.html flake (DumpRenderTree crashed) while processing attachment 357239 [details] on bug 192639. Bot: webkit-cq-02 Port: <class 'webkitpy.common.config.ports.MacPort'> Platform: Mac OS X 10.12.6 The bots will update this with information from each new failure. If you believe this bug to be fixed or invalid, feel free to close. The bots will re-open if the flake re-occurs. If you would like to track this test fix with another bug, please close this bug as a duplicate. The bots will follow the duplicate chain when making future comments.
Attachments
Archive of layout-test-results from webkit-cq-02 (2.45 MB, application/zip)
2018-12-13 11:56 PST, WebKit Commit Bot 		no flags
Details
View All Add attachment proposed patch, testcase, etc.
WebKit Commit Bot
Comment 1 2018-12-13 11:56:06 PST
Created attachment 357242 [details] Archive of layout-test-results from webkit-cq-02
Alexey Proskuryakov
Comment 2 2018-12-14 10:59:05 PST
Thread 0 Crashed:: Dispatch queue: com.apple.main-thread 0 com.apple.JavaScriptCore 0x00000001038e1a6e JSC::MarkedBlock::aboutToMarkSlow(unsigned int) + 94 (atomic:882) 1 com.apple.JavaScriptCore 0x0000000103c3cd0a JSC::JSImmutableButterfly::visitChildren(JSC::JSCell*, JSC::SlotVisitor&) + 298 (MarkedBlock.h:559) 2 com.apple.JavaScriptCore 0x00000001038edb34 JSC::SlotVisitor::drain(WTF::MonotonicTime)::$_3::operator()(JSC::MarkStackArray&) const + 324 (SlotVisitor.cpp:397) 3 com.apple.JavaScriptCore 0x00000001038ead02 JSC::SlotVisitor::drain(WTF::MonotonicTime) + 210 (SlotVisitorInlines.h:190) 4 com.apple.JavaScriptCore 0x00000001038eb949 JSC::SlotVisitor::drainInParallel(WTF::MonotonicTime) + 57 (SlotVisitor.cpp:703) 5 com.apple.JavaScriptCore 0x00000001038c470b JSC::Heap::runFixpointPhase(JSC::GCConductor) + 2027 (SlotVisitor.h:283) 6 com.apple.JavaScriptCore 0x00000001038c3408 JSC::Heap::runCurrentPhase(JSC::GCConductor, JSC::CurrentThreadState*) + 200 (Heap.cpp:1175) 7 com.apple.JavaScriptCore 0x00000001038cc5fb WTF::ScopedLambdaFunctor<void (JSC::CurrentThreadState&), JSC::Heap::collectInMutatorThread()::$_0>::implFunction(void*, JSC::CurrentThreadState&) + 27 (Heap.cpp:1791) 8 com.apple.JavaScriptCore 0x00000001038deba5 JSC::callWithCurrentThreadState(WTF::ScopedLambda<void (JSC::CurrentThreadState&)> const&) + 117 (MachineStackMarker.cpp:226) 9 com.apple.JavaScriptCore 0x00000001038c6ccd JSC::Heap::collectInMutatorThread() + 93 (CollectingScope.h:43) 10 com.apple.JavaScriptCore 0x00000001038c6b95 JSC::Heap::stopIfNecessarySlow(unsigned int) + 53 (Heap.cpp:1771) 11 com.apple.JavaScriptCore 0x00000001038c6a8f JSC::Heap::stopIfNecessarySlow() + 47 (Heap.cpp:1745) 12 com.apple.JavaScriptCore 0x00000001038c06a4 JSC::Heap::collectIfNecessaryOrDefer(JSC::GCDeferralContext*) + 132 (Heap.cpp:2566) 13 com.apple.JavaScriptCore 0x00000001038ddff9 JSC::LocalAllocator::allocateSlowCase(JSC::GCDeferralContext*, JSC::AllocationFailureMode) + 281 (LocalAllocator.cpp:128) 14 com.apple.JavaScriptCore 0x00000001035e9d6d JSC::JSString::createHasOtherOwner(JSC::VM&, WTF::Ref<WTF::StringImpl, WTF::DumbPtrTraits<WTF::StringImpl> >&&) + 269 (LocalAllocatorInlines.h:37)
Keith Miller
Comment 3 2018-12-14 11:10:18 PST
hmm, looks like a GC bug. Do we know roughly when this started?
Alexey Proskuryakov
Comment 4 2018-12-14 11:40:45 PST
This started yesterday. Seems somewhat frequent actually, and impacts other worker tests too, see e.g. <https://build.webkit.org/results/Apple%20Sierra%20Debug%20WK1%20(Tests)/r239187%20(10710)/results.html>
Radar WebKit Bug Importer
Comment 5 2018-12-14 11:41:31 PST
<rdar://problem/46736880>
Alexey Proskuryakov
Comment 6 2018-12-14 11:42:44 PST
Maybe we should roll back https://trac.webkit.org/r239153 to see if that was the culprit? Timing wise, it seems likely.
Keith Miller
Comment 7 2018-12-14 13:22:31 PST
(In reply to Alexey Proskuryakov from comment #6) > Maybe we should roll back https://trac.webkit.org/r239153 to see if that was > the culprit? Timing wise, it seems likely. Seems reasonable, we can always reland later.
Ryan Haddad
Comment 8 2018-12-14 13:40:39 PST
Rolling out in https://bugs.webkit.org/show_bug.cgi?id=192715. Duping this to the original Bugzilla for the change. *** This bug has been marked as a duplicate of bug 190047 ***
Note You need to log in before you can comment on or make changes to this bug.