The failure is due to a CRASH() call (search for 0xfbadbeef in the attached log).

(here's the actual log)

Deleted: failure_dailymotion.log 96.7 KB

failure_dailymotion.log 96.7 KB View Download

Output from the failure:

[11804:1287:0629/160112:ERROR:vt_video_encode_accelerator_mac.cc(550)]  VTCompressionSessionCreate failed: -12908
[11804:1287:0629/160112:ERROR:gles2_cmd_decoder.cc(10688)] [.DisplayCompositor-0x7fb08e860600]GL ERROR :GL_INVALID_OPERATION : glScheduleCALayerCHROMIUM: failed to schedule CALayer
[11804:1287:0629/160112:ERROR:gles2_cmd_decoder.cc(10688)] [.DisplayCompositor-0x7fb08e860600]GL ERROR :GL_INVALID_OPERATION : glScheduleCALayerCHROMIUM: failed to schedule CALayer
[11804:1287:0629/160112:ERROR:gles2_cmd_decoder.cc(10688)] [.DisplayCompositor-0x7fb08e860600]GL ERROR :GL_INVALID_OPERATION : glScheduleCALayerCHROMIUM: failed to schedule CALayer
[...]
[11804:1287:0629/160112:ERROR:gles2_cmd_decoder.cc(10688)] [.DisplayCompositor-0x7fb08e860600]GL ERROR :GL_INVALID_OPERATION : glScheduleCALayerCHROMIUM: failed to schedule CALayer
[11804:1287:0629/160112:ERROR:gles2_cmd_decoder.cc(10688)] [.DisplayCompositor-0x7fb08e860600]GL ERROR :GL_INVALID_OPERATION : glScheduleCALayerCHROMIUM: failed to schedule CALayer
[11804:1287:0629/160112:ERROR:gles2_cmd_decoder.cc(10688)] [.DisplayCompositor-0x7fb08e860600]GL ERROR :GL_INVALID_OPERATION : glScheduleCALayerCHROMIUM: failed to schedule CALayer
ASSERTION FAILED: !invalidationSet.wholeSubtreeInvalid()
../../third_party/WebKit/Source/core/css/invalidation/StyleInvalidator.cpp(140) : void blink::StyleInvalidator::RecursionData::pushInvalidationSet(const blink::InvalidationSet &)
1   0x11177703b blink::StyleInvalidator::pushInvalidationSetsForContainerNode(blink::ContainerNode&, blink::StyleInvalidator::RecursionData&, blink::StyleInvalidator::SiblingData&)
2   0x1117762c2 blink::StyleInvalidator::invalidate(blink::Element&, blink::StyleInvalidator::RecursionData&, blink::StyleInvalidator::SiblingData&)
3   0x111775dbf blink::StyleInvalidator::invalidate(blink::Document&)
4   0x111319d55 blink::Document::updateStyleInvalidationIfNeeded()
5   0x1113182b6 blink::Document::updateStyleAndLayoutTree()
6   0x11131c2e2 blink::Document::updateStyleAndLayoutTreeForNode(blink::Node const*)
7   0x1116b49bc blink::CSSComputedStyleDeclaration::getPropertyCSSValue(blink::CSSPropertyID) const
8   0x1116b571f blink::CSSComputedStyleDeclaration::getPropertyValue(WTF::String const&)
9   0x1110c6f9f blink::CSSStyleDeclarationV8Internal::getPropertyValueMethodCallback(v8::FunctionCallbackInfo<v8::Value> const&)
10  0x10ef3b30a v8::internal::FunctionCallbackArguments::Call(void (*)(v8::FunctionCallbackInfo<v8::Value> const&))
11  0x10efd11ca v8::internal::MaybeHandle<v8::internal::Object> v8::internal::(anonymous namespace)::HandleApiCallHelper<false>(v8::internal::Isolate*, v8::internal::Handle<v8::internal::HeapObject>, v8::internal::Handle<v8::internal::HeapObject>, v8::internal::Handle<v8::internal::FunctionTemplateInfo>, v8::internal::Handle<v8::internal::Object>, v8::internal::(anonymous namespace)::BuiltinArguments)
12  0x10f008806 v8::internal::Builtin_Impl_HandleApiCall(v8::internal::(anonymous namespace)::BuiltinArguments, v8::internal::Isolate*)
13  0x10efdc9de v8::internal::Builtin_HandleApiCall(int, v8::internal::Object**, v8::internal::Isolate*)
14  0x8bc72206147
15  0x8bc723737d7
16  0x8bc7237319b
17  0x8bc7234f4fe

I'm suspecting that this could be a duplicate of  issue 624221  or issue 624670.

rune@: I can see you landed a change affecting invalidation very recently (https://codereview.chromium.org/2089063005). Is there any chance your patch could have caused this regression? If not, could you please help me route this to someone who can help fix this?

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/055373dbdafcd9bfceb0264df2554005cb22f536

commit 055373dbdafcd9bfceb0264df2554005cb22f536
Author: petrcermak <petrcermak@chromium.org>
Date: Fri Jul 01 16:55:47 2016

[system-health] Re-enable all passing smoke tests on the CQ

All tests except for the following 3 passed in the most recent CQ dry
runs:

  * load:tools:dropbox (crbug.com/624474)
  * load:media:dailymotion ( crbug.com/624607 )
  * load:games:bubbles (crbug.com/624701)

*** NOTE TO SHERRIF ***
If any of the
benchmarks.system_health_smoke_test.SystemHealthBenchmarkSmokeTest.*
tests fails, please do not revert this CL but instead disable only the
failing tests by adding them to the _DISABLE_TESTS list in
tools/perf/benchmarks/system_health_smoke_test.py. Thanks!

BUG=624474,624587, 624607 ,624701, 624840 , 615382 ,589726
TBR=nednguyen@google.com
CQ_EXTRA_TRYBOTS=tryserver.chromium.perf:android_s5_perf_cq;tryserver.chromium.perf:mac_retina_perf_cq

Review-Url: https://codereview.chromium.org/2120443002
Cr-Commit-Position: refs/heads/master@{#403470}

[modify] https://crrev.com/055373dbdafcd9bfceb0264df2554005cb22f536/tools/perf/benchmarks/system_health_smoke_test.py

Does look like mine. I think I see where the problem is.

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=5160609973010432

Fuzzer: inferno_layout_test_unmodified
Job Type: linux_debug_content_shell_drt
Platform Id: linux

Crash Type: ASSERT
Crash Address: 
Crash State:
  !invalidationSet.wholeSubtreeInvalid()
  blink::StyleInvalidator::RecursionData::pushInvalidationSet
  blink::StyleInvalidator::pushInvalidationSetsForContainerNode
  

Minimized Testcase (5.10 Kb): https://cluster-fuzz.appspot.com/download/AMIfv97iobl0rgr3UI8tBlut-GpXjFOpvmHAVY4_gfD8Pu8AXA-NlcwHQe82oqBFuOrljIRR7NChrFjKFgR1AI3O0W0TrJhpQA6G3tp8oup1yVTnDKUBMMdmjLvRYJeE9-6c-KXXgSE3m2aysuqaqnTkmHGB2Na4OQ?testcase_id=5160609973010432

Filer: mmohammad

See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.

https://codereview.chromium.org/2106063007/

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/1405b49c739b32c53d57ede4600c9ed7dca5c6af

commit 1405b49c739b32c53d57ede4600c9ed7dca5c6af
Author: rune <rune@opera.com>
Date: Mon Jul 04 11:21:42 2016

Don't schedule wholeSubtreeInvalid sets.

The StyleInvalidator asserts if we scheduled such sets. Mark element
for SubtreeStyleChange instead.

R=esprehn@chromium.org,ericwilligers@chromium.org
BUG= 624607 

Review-Url: https://codereview.chromium.org/2106063007
Cr-Commit-Position: refs/heads/master@{#403663}

[add] https://crrev.com/1405b49c739b32c53d57ede4600c9ed7dca5c6af/third_party/WebKit/LayoutTests/fast/css/invalidation/sibling-mutation-assert.html
[modify] https://crrev.com/1405b49c739b32c53d57ede4600c9ed7dca5c6af/third_party/WebKit/Source/core/css/invalidation/StyleInvalidator.cpp

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/2990b63fcdd23e056e8acbabeb42a4e5bea53426

commit 2990b63fcdd23e056e8acbabeb42a4e5bea53426
Author: petrcermak <petrcermak@chromium.org>
Date: Mon Jul 04 12:54:16 2016

[system-health] Re-enable load:media:dailymotion smoke test on desktop

Rationale: The issue causing the test to fail should have been fixed in
https://codereview.chromium.org/2106063007.

BUG= 624607 
TBR=nednguyen@google.com
CQ_EXTRA_TRYBOTS=tryserver.chromium.perf:android_s5_perf_cq;tryserver.chromium.perf:mac_retina_perf_cq

Review-Url: https://codereview.chromium.org/2117043002
Cr-Commit-Position: refs/heads/master@{#403671}

[modify] https://crrev.com/2990b63fcdd23e056e8acbabeb42a4e5bea53426/tools/perf/benchmarks/system_health_smoke_test.py

https://codereview.chromium.org/2117043002 has made it through the CQ, so I think it's safe to mark this bug as fixed.

rune: Thanks for the quick fix!

ClusterFuzz has detected this issue as fixed in range 403457:403667.

Detailed report: https://cluster-fuzz.appspot.com/testcase?key=5160609973010432

Fuzzer: inferno_layout_test_unmodified
Job Type: linux_debug_content_shell_drt
Platform Id: linux

Crash Type: ASSERT
Crash Address: 
Crash State:
  !invalidationSet.wholeSubtreeInvalid()
  blink::StyleInvalidator::RecursionData::pushInvalidationSet
  blink::StyleInvalidator::pushInvalidationSetsForContainerNode
  
Regressed: https://cluster-fuzz.appspot.com/revisions?job=linux_debug_content_shell_drt&range=402738:402770
Fixed: https://cluster-fuzz.appspot.com/revisions?job=linux_debug_content_shell_drt&range=403457:403667

Minimized Testcase (5.10 Kb): https://cluster-fuzz.appspot.com/download/AMIfv97iobl0rgr3UI8tBlut-GpXjFOpvmHAVY4_gfD8Pu8AXA-NlcwHQe82oqBFuOrljIRR7NChrFjKFgR1AI3O0W0TrJhpQA6G3tp8oup1yVTnDKUBMMdmjLvRYJeE9-6c-KXXgSE3m2aysuqaqnTkmHGB2Na4OQ?testcase_id=5160609973010432

See https://dev.chromium.org/Home/chromium-security/bugs/reproducing-clusterfuzz-bugs for more information.

If you suspect that the result above is incorrect, try re-doing that job on the test case report page.