New issue
Advanced search Search tips
Note: Color blocks (like or ) mean that a user may not be available. Tooltip shows the reason.

Issue 649485 link

Starred by 3 users

Issue metadata

Status: WontFix
Owner:
Closed: Aug 2017
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: Windows
Pri: 3
Type: Bug

Blocked on:
issue 596622
issue 695002



Sign in to add a comment

ASSERTION FAILED: !m_heapDoesNotContainCache->lookup(address) in WebGL conformance tests

Project Member Reported by kbr@chromium.org, Sep 22 2016

Issue description

Only a bug sighting; not sure whether this is reproducible.

In https://build.chromium.org/p/tryserver.chromium.win/builders/win_optional_gpu_tests_rel/builds/3942 , WebglConformance_conformance2_textures_video_tex_2d_rgba32f_rgba_float failed in the following way. Not sure whether this is related to other failures to load the actual video being tracked in other bugs (not in front of me right now).

WebglConformance_conformance2_textures_video_tex_2d_rgba32f_rgba_float (gpu_tests.webgl_conformance_integration_test.WebGLConformanceIntegrationTest) ... [3232:872:0922/120525:ERROR:interface_registry.cc(99)] Failed to locate a binder for interface: dom_distiller::mojom::DistillabilityService
[3232:12:0922/120525:ERROR:audio_manager_win.cc(464)] GetPreferredAudioParameters failed: 88890004
[3232:872:0922/120525:ERROR:interface_registry.cc(99)] Failed to locate a binder for interface: dom_distiller::mojom::DistillabilityService
[1628:3956:0922/120525:INFO:gpu_video_decode_accelerator_factory.cc(163)] Initializing DXVA HW decoder for windows.
[3232:12:0922/120525:ERROR:audio_manager_win.cc(464)] GetPreferredAudioParameters failed: 88890004
[3232:12:0922/120525:ERROR:audio_output_resampler.cc(295)] Unable to open audio device in low latency mode.  Falling back to high latency audio output.
[3232:12:0922/120525:ERROR:audio_output_resampler.cc(305)] Unable to open audio device in high latency mode.  Falling back to fake audio output.
[1628:3956:0922/120525:ERROR:dxva_video_decode_accelerator_win.cc(345)] The eglQueryDeviceAttribEXT function failed to get the device
[1628:3956:0922/120525:ERROR:mf_helpers.cc(12)] Error in dxva_video_decode_accelerator_win.cc on line 345
[3232:3244:0922/120526:ERROR:ssl_client_socket_impl.cc(1145)] handshake failed; returned -1, SSL error code 1, net_error -100
ASSERTION FAILED: !m_heapDoesNotContainCache->lookup(address)
e:\b\c\b\win\src\third_party\webkit\source\platform\heap\heap.cpp(338) : unsigned char *__thiscall blink::ThreadHeap::checkAndMarkPointer(class blink::Visitor *,unsigned char *)
Backtrace:
	blink::ThreadHeap::checkAndMarkPointer [0x6897A3CD+223]
	blink::ThreadState::visitStack [0x68988165+70]
	blink::ThreadHeap::visitStackRoots [0x6897C2B0+195]
	blink::ThreadState::collectGarbage [0x6898339F+463]
	blink::ThreadState::scheduleGCIfNeeded [0x689861DF+159]
	blink::NormalPageArena::outOfLineAllocate [0x6897EF8C+206]
	blink::NormalPageArena::allocateObject [0x6897D3B5+221]
	blink::ThreadHeap::allocateOnArenaIndex [0x689C69DD+127]
	blink::ThreadHeap::allocate<blink::Resource> [0x697CE1D4+54]
	blink::Resource::operator new [0x697CE2AD+14]
	blink::RawResource::RawResourceFactory::create [0x6A63372D+16]
	blink::ResourceFetcher::createResourceForLoading [0x697BEFC3+273]
	blink::ResourceFetcher::requestResource [0x697C362D+1235]
	blink::RawResource::fetchMedia [0x6A633F1A+200]
	blink::DocumentThreadableLoader::loadRequest [0x69A713D2+698]
	blink::DocumentThreadableLoader::dispatchInitialRequest [0x69A7075E+67]
	blink::DocumentThreadableLoader::start [0x69A72EDA+1133]
	blink::AssociatedURLLoader::loadAsynchronously [0x69449B64+862]
	media::ResourceMultiBufferDataProvider::Start [0x69FF5A03+869]
	media::ResourceMultiBuffer::CreateWriter [0x69FE95A7+49]
	media::MultiBuffer::AddReader [0x69FF338C+439]
	media::MultiBufferReader::UpdateInternalState [0x6A000E61+541]
	media::MultiBufferReader::SetPreload [0x6A0009E1+136]
	media::MultibufferDataSource::UpdateBufferSizes [0x69FFC0AA+482]
	media::MultibufferDataSource::CreateResourceLoader [0x69FFAB45+212]
	media::MultibufferDataSource::Initialize [0x69FFAD30+247]
	media::WebMediaPlayerImpl::DoLoad [0x69FEC91B+851]
	base::internal::FunctorTraits<void (__thiscall media::WebMediaPlayerImpl::*)(enum blink::WebMediaPlayer::LoadType,blink::WebURL const &,enum blink::WebMediaPlayer::CORSMode),void>::Invoke<base::WeakPtr<media::WebMediaPlayerImpl> const &,enum blink::WebMed [0x69FEB6D2+32]
	base::internal::InvokeHelper<1,void>::MakeItSo<void (__thiscall media::WebMediaPlayerImpl::*const &)(enum blink::WebMediaPlayer::LoadType,blink::WebURL const &,enum blink::WebMediaPlayer::CORSMode),base::WeakPtr<media::WebMediaPlayerImpl> const &,enum bli [0x69FEB794+40]
	base::internal::Invoker<base::internal::BindState<void (__thiscall media::WebMediaPlayerImpl::*)(enum blink::WebMediaPlayer::LoadType,blink::WebURL const &,enum blink::WebMediaPlayer::CORSMode),base::WeakPtr<media::WebMediaPlayerImpl>,enum blink::WebMedia [0x69FEB822+27]
	base::internal::Invoker<base::internal::BindState<void (__thiscall media::WebMediaPlayerImpl::*)(enum blink::WebMediaPlayer::LoadType,blink::WebURL const &,enum blink::WebMediaPlayer::CORSMode),base::WeakPtr<media::WebMediaPlayerImpl>,enum blink::WebMedia [0x69FEE87C+22]
	ChromeContentRendererClient::DeferMediaLoad [0x69E5FCCF+122]
	base::internal::Invoker<base::internal::BindState<void (__thiscall content::ContentRendererClient::*)(content::RenderFrame *,bool,base::Callback<void __cdecl(void),1,1> const &),base::internal::UnretainedWrapper<content::ContentRendererClient>,content::Re [0x69EC2B6A+23]
	media::WebMediaPlayerImpl::load [0x69FF0108+477]
	blink::HTMLMediaElement::startPlayerLoad [0x6986F7AE+918]
	blink::HTMLMediaElement::loadResource [0x6986937C+1213]
	blink::HTMLMediaElement::loadSourceFromAttribute [0x6986946C+163]
	blink::HTMLMediaElement::selectMediaResource [0x6986C9FB+414]
	blink::HTMLMediaElement::loadInternal [0x69868DFC+247]
	blink::HTMLMediaElement::loadTimerFired [0x6986962B+49]
	blink::TaskRunnerTimer<blink::HTMLMediaElement>::fired [0x69867555+28]
	blink::TimerBase::runInternal [0x693F0BF5+419]
	??$MakeItSo@ABQ8WebMediaPlayerMSCompositor@content@@AEXXZABV?$WeakPtr@VWebMediaPlayerMSCompositor@content@@@base@@$$V@?$InvokeHelper@$00X@internal@base@@SAXABQ8WebMediaPlayerMSCompositor@content@@AEXXZABV?$WeakPtr@VWebMediaPlayerMSCompositor@content@@@2@@ [0x68094027+33]
	base::internal::Invoker<base::internal::BindState<void (__thiscall content::WebMediaPlayerMSCompositor::*)(void),base::WeakPtr<content::WebMediaPlayerMSCompositor> >,void __cdecl(void)>::Run [0x68095CA2+19]
	base::debug::TaskAnnotator::RunTask[3232:3244:0922/120527:ERROR:ssl_client_socket_impl.cc(1145)] handshake failed; returned -1, SSL error code 1, net_error -100
 [0x68AFA58B+267]
	blink::scheduler::TaskQueueManager::ProcessTaskFromWorkQueue [0x693EB5A0+594]
	blink::scheduler::TaskQueueManager::DoWork [0x693EAB6B+452]
	base::internal::FunctorTraits<void (__thiscall blink::scheduler::TaskQueueManager::*)(base::TimeTicks,bool),void>::Invoke<base::WeakPtr<blink::scheduler::TaskQueueManager> const &,base::TimeTicks const &,bool const &> [0x693E9E9F+34]
	base::internal::InvokeHelper<1,void>::MakeItSo<void (__thiscall blink::scheduler::TaskQueueManager::*const &)(base::TimeTicks,bool),base::WeakPtr<blink::scheduler::TaskQueueManager> const &,base::TimeTicks const &,bool const &> [0x693E9EC6+37]
	base::internal::Invoker<base::internal::BindState<void (__thiscall blink::scheduler::TaskQueueManager::*)(base::TimeTicks,bool),base::WeakPtr<blink::scheduler::TaskQueueManager>,base::TimeTicks,bool>,void __cdecl(void)>::RunImpl<void (__thiscall blink::sc [0x693E9EE2+23]
	base::internal::Invoker<base::internal::BindState<void (__thiscall blink::scheduler::TaskQueueManager::*)(base::TimeTicks,bool),base::WeakPtr<blink::scheduler::TaskQueueManager>,base::TimeTicks,bool>,void __cdecl(void)>::Run [0x693EB85C+22]
	base::debug::TaskAnnotator::RunTask [0x68AFA58B+267]
	base::MessageLoop::RunTask [0x68AA79A3+1203]
	base::MessageLoop::DoWork [0x68AA6D15+597]
	base::MessagePumpDefault::Run [0x68AFCED0+416]
	base::MessageLoop::RunHandler [0x68AA74E7+103]
	base::RunLoop::Run [0x68AE1FF9+41]
	content::RendererMain [0x69ED67EA+486]
	content::RunNamedProcessTypeMain [0x68A892CC+176]
	content::ContentMainRunnerImpl::Run [0x68A891EB+274]
	content::ContentMain [0x68A885C8+35]
	ChromeMain [0x67FBC7FE+158]


 
Cc: hubbe@chromium.org
+hubbe in case any loading looks odd.

Comment 2 by hubbe@chromium.org, Sep 22 2016

Multibuffers looks incidential here, but good to know in case more reports or evidence shows up.
Components: -Blink>Media>Video Internals>Media

Comment 4 by kbr@chromium.org, Oct 21 2016

Blocking: 596622
Summary: ASSERTION FAILED: !m_heapDoesNotContainCache->lookup(address) in WebGL conformance tests (was: ASSERTION FAILED: !m_heapDoesNotContainCache->lookup(address) in video-related WebGL conformance tests)
Another instance on a non-video-related WebGL conformacnce test:
https://build.chromium.org/p/tryserver.chromium.win/builders/win_chromium_rel_ng/builds/316668

WebglConformance_conformance_glsl_misc_shader_with_non_reserved_words (gpu_tests.webgl_conformance_integration_test.WebGLConformanceIntegrationTest) ... ASSERTION FAILED: !m_heapDoesNotContainCache->lookup(address)
e:\b\c\b\win\src\third_party\webkit\source\platform\heap\heap.cpp(312) : unsigned char *__thiscall blink::ThreadHeap::checkAndMarkPointer(class blink::Visitor *,unsigned char *)
Backtrace:
	blink::ThreadHeap::checkAndMarkPointer [0x67CB87AC+223]
	blink::ThreadState::visitStack [0x67CC66BE+70]
	blink::ThreadHeap::visitStackRoots [0x67CBA687+195]
	blink::ThreadState::collectGarbage [0x67CC18EC+440]
	blink::ThreadState::scheduleGCIfNeeded [0x67CC4700+159]
	blink::LargeObjectArena::allocateLargeObjectPage [0x67CBB52E+81]
	blink::BaseArena::allocateLargeObject [0x67CBB4D6+86]
	blink::NormalPageArena::outOfLineAllocate [0x67CBD2FB+111]
	blink::NormalPageArena::allocateObject [0x67CBB61D+221]
	blink::ThreadHeap::allocateOnArenaIndex [0x67D05636+127]
	blink::HeapAllocator::allocateHashTableBacking<WTF::KeyValuePair<blink::WeakMember<blink::Node>,blink::Member<blink::EventTargetData> >,WTF::HashTable<blink::WeakMember<blink::Node>,WTF::KeyValuePair<blink::WeakMember<blink::Node>,blink::Member<blink::Eve [0x689B8E55+33]
	WTF::HashTable<blink::WeakMember<blink::Node>,WTF::KeyValuePair<blink::WeakMember<blink::Node>,blink::Member<blink::EventTargetData> >,WTF::KeyValuePairKeyExtractor,WTF::MemberHash<blink::Node>,WTF::HashMapValueTraits<WTF::HashTraits<blink::WeakMember<bli [0x689BA9D9+15]
	WTF::HashTable<blink::WeakMember<blink::Node>,WTF::KeyValuePair<blink::WeakMember<blink::Node>,blink::Member<blink::EventTargetData> >,WTF::KeyValuePairKeyExtractor,WTF::MemberHash<blink::Node>,WTF::HashMapValueTraits<WTF::HashTraits<blink::WeakMember<bli [0x689BF392+43]
	WTF::HashTable<blink::WeakMember<blink::Node>,WTF::KeyValuePair<blink::WeakMember<blink::Node>,blink::Member<blink::EventTargetData> >,WTF::KeyValuePairKeyExtractor,WTF::MemberHash<blink::Node>,WTF::HashMapValueTraits<WTF::HashTraits<blink::WeakMember<bli [0x689BCB0F+85]
	WTF::HashTable<blink::WeakMember<blink::Node>,WTF::KeyValuePair<blink::WeakMember<blink::Node>,blink::Member<blink::EventTargetData> >,WTF::KeyValuePairKeyExtractor,WTF::MemberHash<blink::Node>,WTF::HashMapValueTraits<WTF::HashTraits<blink::WeakMember<bli [0x689B8AC2+411]
	WTF::HashMap<blink::WeakMember<blink::Node>,blink::Member<blink::EventTargetData>,WTF::MemberHash<blink::Node>,WTF::HashTraits<blink::WeakMember<blink::Node> >,WTF::HashTraits<blink::Member<blink::EventTargetData> >,blink::HeapAllocator>::set<blink::Node  [0x689B9B01+21]
	blink::Node::ensureEventTargetData [0x689BC787+196]
	blink::EventTarget::addEventListenerInternal [0x68A919D2+348]
	blink::EventTarget::addEventListener [0x68A91862+59]
	blink::EventTarget::addEventListener [0x68A91820+95]
	blink::TextTrackV8Internal::addCueMethodCallback [0x687B5C6C+520]
	(No symbol) [0x2B4CF58B]
	v8::internal::Runtime_StringReplaceGlobalRegExpWithString [0x67AE4E6C+204]

Cc: -hubbe@chromium.org
Owner: hubbe@chromium.org
Status: Assigned (was: Untriaged)
assign to hubbe. Please free free to re-assign appropriately or resolve.

Comment 6 by hubbe@chromium.org, Nov 16 2016

Cc: hubbe@chromium.org
Owner: kbr@chromium.org
Status: Untriaged (was: Assigned)
I can't even triage this bug properly.
Assigning to kbr@, maybe he knows where it should go?

Comment 7 by kbr@chromium.org, Nov 16 2016

Components: -Internals>Media
Owner: haraken@chromium.org
Status: Assigned (was: Untriaged)
This isn't media-related. It appears to be a problem in Oilpan, the Blink garbage collector.

haraken@, is there any instrumentation that could be added to catch this sort of error earlier?

Owner: keishi@chromium.org

Comment 9 by kbr@chromium.org, Dec 19 2016

Blocking: -596622

Comment 10 by kbr@chromium.org, Dec 19 2016

Blockedon: 596622

Comment 11 by kbr@chromium.org, Feb 24 2017

Blockedon: 695002

Comment 12 by kbr@chromium.org, Feb 24 2017

Another incident reported in  Issue 695002 .

The ephemeral conditions that bring this assert about, are proving hard to work out. Let's add an assert when committing new pages, checking that the negative page cache agrees. That might get us closer to the source of it..

Comment 14 by kbr@chromium.org, Feb 24 2017

Thanks Sigbjorn. Is keishi@ the best person to own this bug and add that assert?

Project Member

Comment 15 by bugdroid1@chromium.org, Feb 24 2017

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/7c787e8cafaa3b13951ce38c76e0ebefb31ff454

commit 7c787e8cafaa3b13951ce38c76e0ebefb31ff454
Author: sigbjornf <sigbjornf@opera.com>
Date: Fri Feb 24 15:45:07 2017

Verify that a new heap page isn't also marked as being off heap.

Attempt to diagnose a rare assert failure, where a conservative
GC stack scan finds a potential pointer in both the heap's
negative heap page cache and in the map of in-use heap pages.

Those two mapping should be mutually exclusive by construction,
and must be -- the negative page cache must not contain false
positives. Hence, add verification when a new page is committed
& used, it does not already have a mapping in that negative cache.

R=haraken
BUG= 649485 

Review-Url: https://codereview.chromium.org/2715713005
Cr-Commit-Position: refs/heads/master@{#452833}

[modify] https://crrev.com/7c787e8cafaa3b13951ce38c76e0ebefb31ff454/third_party/WebKit/Source/platform/heap/PageMemory.h
[modify] https://crrev.com/7c787e8cafaa3b13951ce38c76e0ebefb31ff454/third_party/WebKit/Source/platform/heap/ThreadState.cpp
[modify] https://crrev.com/7c787e8cafaa3b13951ce38c76e0ebefb31ff454/third_party/WebKit/Source/platform/heap/ThreadState.h

(We've added a CHECK() for this, failures in PageMemory::commit() is what to look out for.)

Comment 17 by kbr@chromium.org, Feb 25 2017

Cc: keishi@chromium.org
Owner: sigbjo...@opera.com
Thanks Sigbjorn for adding the stronger assertion.

May I please assign this to you so that it doesn't fall off anyone's radar?

Project Member

Comment 18 by sheriffbot@chromium.org, Aug 1 2017

Labels: Hotlist-Recharge-BouncingOwner
Owner: ----
Status: Untriaged (was: Assigned)
The assigned owner "sigbjornf@opera.com" is not able to receive e-mails, please re-triage.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot
Cc: sigbjo...@opera.com
Owner: keishi@chromium.org
There has been only one crash with signature PageMemory::commit in M57. Would keishi@ be able to investigate further?

Comment 20 by kbr@chromium.org, Aug 8 2017

Status: WontFix (was: Untriaged)
Let's close this as WontFix instead. Thanks for triaging.

Sign in to add a comment