ASSERTION FAILED: !m_heapDoesNotContainCache->lookup(address) in WebGL conformance tests |
||||||||||||||
Issue descriptionOnly a bug sighting; not sure whether this is reproducible. In https://build.chromium.org/p/tryserver.chromium.win/builders/win_optional_gpu_tests_rel/builds/3942 , WebglConformance_conformance2_textures_video_tex_2d_rgba32f_rgba_float failed in the following way. Not sure whether this is related to other failures to load the actual video being tracked in other bugs (not in front of me right now). WebglConformance_conformance2_textures_video_tex_2d_rgba32f_rgba_float (gpu_tests.webgl_conformance_integration_test.WebGLConformanceIntegrationTest) ... [3232:872:0922/120525:ERROR:interface_registry.cc(99)] Failed to locate a binder for interface: dom_distiller::mojom::DistillabilityService [3232:12:0922/120525:ERROR:audio_manager_win.cc(464)] GetPreferredAudioParameters failed: 88890004 [3232:872:0922/120525:ERROR:interface_registry.cc(99)] Failed to locate a binder for interface: dom_distiller::mojom::DistillabilityService [1628:3956:0922/120525:INFO:gpu_video_decode_accelerator_factory.cc(163)] Initializing DXVA HW decoder for windows. [3232:12:0922/120525:ERROR:audio_manager_win.cc(464)] GetPreferredAudioParameters failed: 88890004 [3232:12:0922/120525:ERROR:audio_output_resampler.cc(295)] Unable to open audio device in low latency mode. Falling back to high latency audio output. [3232:12:0922/120525:ERROR:audio_output_resampler.cc(305)] Unable to open audio device in high latency mode. Falling back to fake audio output. [1628:3956:0922/120525:ERROR:dxva_video_decode_accelerator_win.cc(345)] The eglQueryDeviceAttribEXT function failed to get the device [1628:3956:0922/120525:ERROR:mf_helpers.cc(12)] Error in dxva_video_decode_accelerator_win.cc on line 345 [3232:3244:0922/120526:ERROR:ssl_client_socket_impl.cc(1145)] handshake failed; returned -1, SSL error code 1, net_error -100 ASSERTION FAILED: !m_heapDoesNotContainCache->lookup(address) e:\b\c\b\win\src\third_party\webkit\source\platform\heap\heap.cpp(338) : unsigned char *__thiscall blink::ThreadHeap::checkAndMarkPointer(class blink::Visitor *,unsigned char *) Backtrace: blink::ThreadHeap::checkAndMarkPointer [0x6897A3CD+223] blink::ThreadState::visitStack [0x68988165+70] blink::ThreadHeap::visitStackRoots [0x6897C2B0+195] blink::ThreadState::collectGarbage [0x6898339F+463] blink::ThreadState::scheduleGCIfNeeded [0x689861DF+159] blink::NormalPageArena::outOfLineAllocate [0x6897EF8C+206] blink::NormalPageArena::allocateObject [0x6897D3B5+221] blink::ThreadHeap::allocateOnArenaIndex [0x689C69DD+127] blink::ThreadHeap::allocate<blink::Resource> [0x697CE1D4+54] blink::Resource::operator new [0x697CE2AD+14] blink::RawResource::RawResourceFactory::create [0x6A63372D+16] blink::ResourceFetcher::createResourceForLoading [0x697BEFC3+273] blink::ResourceFetcher::requestResource [0x697C362D+1235] blink::RawResource::fetchMedia [0x6A633F1A+200] blink::DocumentThreadableLoader::loadRequest [0x69A713D2+698] blink::DocumentThreadableLoader::dispatchInitialRequest [0x69A7075E+67] blink::DocumentThreadableLoader::start [0x69A72EDA+1133] blink::AssociatedURLLoader::loadAsynchronously [0x69449B64+862] media::ResourceMultiBufferDataProvider::Start [0x69FF5A03+869] media::ResourceMultiBuffer::CreateWriter [0x69FE95A7+49] media::MultiBuffer::AddReader [0x69FF338C+439] media::MultiBufferReader::UpdateInternalState [0x6A000E61+541] media::MultiBufferReader::SetPreload [0x6A0009E1+136] media::MultibufferDataSource::UpdateBufferSizes [0x69FFC0AA+482] media::MultibufferDataSource::CreateResourceLoader [0x69FFAB45+212] media::MultibufferDataSource::Initialize [0x69FFAD30+247] media::WebMediaPlayerImpl::DoLoad [0x69FEC91B+851] base::internal::FunctorTraits<void (__thiscall media::WebMediaPlayerImpl::*)(enum blink::WebMediaPlayer::LoadType,blink::WebURL const &,enum blink::WebMediaPlayer::CORSMode),void>::Invoke<base::WeakPtr<media::WebMediaPlayerImpl> const &,enum blink::WebMed [0x69FEB6D2+32] base::internal::InvokeHelper<1,void>::MakeItSo<void (__thiscall media::WebMediaPlayerImpl::*const &)(enum blink::WebMediaPlayer::LoadType,blink::WebURL const &,enum blink::WebMediaPlayer::CORSMode),base::WeakPtr<media::WebMediaPlayerImpl> const &,enum bli [0x69FEB794+40] base::internal::Invoker<base::internal::BindState<void (__thiscall media::WebMediaPlayerImpl::*)(enum blink::WebMediaPlayer::LoadType,blink::WebURL const &,enum blink::WebMediaPlayer::CORSMode),base::WeakPtr<media::WebMediaPlayerImpl>,enum blink::WebMedia [0x69FEB822+27] base::internal::Invoker<base::internal::BindState<void (__thiscall media::WebMediaPlayerImpl::*)(enum blink::WebMediaPlayer::LoadType,blink::WebURL const &,enum blink::WebMediaPlayer::CORSMode),base::WeakPtr<media::WebMediaPlayerImpl>,enum blink::WebMedia [0x69FEE87C+22] ChromeContentRendererClient::DeferMediaLoad [0x69E5FCCF+122] base::internal::Invoker<base::internal::BindState<void (__thiscall content::ContentRendererClient::*)(content::RenderFrame *,bool,base::Callback<void __cdecl(void),1,1> const &),base::internal::UnretainedWrapper<content::ContentRendererClient>,content::Re [0x69EC2B6A+23] media::WebMediaPlayerImpl::load [0x69FF0108+477] blink::HTMLMediaElement::startPlayerLoad [0x6986F7AE+918] blink::HTMLMediaElement::loadResource [0x6986937C+1213] blink::HTMLMediaElement::loadSourceFromAttribute [0x6986946C+163] blink::HTMLMediaElement::selectMediaResource [0x6986C9FB+414] blink::HTMLMediaElement::loadInternal [0x69868DFC+247] blink::HTMLMediaElement::loadTimerFired [0x6986962B+49] blink::TaskRunnerTimer<blink::HTMLMediaElement>::fired [0x69867555+28] blink::TimerBase::runInternal [0x693F0BF5+419] ??$MakeItSo@ABQ8WebMediaPlayerMSCompositor@content@@AEXXZABV?$WeakPtr@VWebMediaPlayerMSCompositor@content@@@base@@$$V@?$InvokeHelper@$00X@internal@base@@SAXABQ8WebMediaPlayerMSCompositor@content@@AEXXZABV?$WeakPtr@VWebMediaPlayerMSCompositor@content@@@2@@ [0x68094027+33] base::internal::Invoker<base::internal::BindState<void (__thiscall content::WebMediaPlayerMSCompositor::*)(void),base::WeakPtr<content::WebMediaPlayerMSCompositor> >,void __cdecl(void)>::Run [0x68095CA2+19] base::debug::TaskAnnotator::RunTask[3232:3244:0922/120527:ERROR:ssl_client_socket_impl.cc(1145)] handshake failed; returned -1, SSL error code 1, net_error -100 [0x68AFA58B+267] blink::scheduler::TaskQueueManager::ProcessTaskFromWorkQueue [0x693EB5A0+594] blink::scheduler::TaskQueueManager::DoWork [0x693EAB6B+452] base::internal::FunctorTraits<void (__thiscall blink::scheduler::TaskQueueManager::*)(base::TimeTicks,bool),void>::Invoke<base::WeakPtr<blink::scheduler::TaskQueueManager> const &,base::TimeTicks const &,bool const &> [0x693E9E9F+34] base::internal::InvokeHelper<1,void>::MakeItSo<void (__thiscall blink::scheduler::TaskQueueManager::*const &)(base::TimeTicks,bool),base::WeakPtr<blink::scheduler::TaskQueueManager> const &,base::TimeTicks const &,bool const &> [0x693E9EC6+37] base::internal::Invoker<base::internal::BindState<void (__thiscall blink::scheduler::TaskQueueManager::*)(base::TimeTicks,bool),base::WeakPtr<blink::scheduler::TaskQueueManager>,base::TimeTicks,bool>,void __cdecl(void)>::RunImpl<void (__thiscall blink::sc [0x693E9EE2+23] base::internal::Invoker<base::internal::BindState<void (__thiscall blink::scheduler::TaskQueueManager::*)(base::TimeTicks,bool),base::WeakPtr<blink::scheduler::TaskQueueManager>,base::TimeTicks,bool>,void __cdecl(void)>::Run [0x693EB85C+22] base::debug::TaskAnnotator::RunTask [0x68AFA58B+267] base::MessageLoop::RunTask [0x68AA79A3+1203] base::MessageLoop::DoWork [0x68AA6D15+597] base::MessagePumpDefault::Run [0x68AFCED0+416] base::MessageLoop::RunHandler [0x68AA74E7+103] base::RunLoop::Run [0x68AE1FF9+41] content::RendererMain [0x69ED67EA+486] content::RunNamedProcessTypeMain [0x68A892CC+176] content::ContentMainRunnerImpl::Run [0x68A891EB+274] content::ContentMain [0x68A885C8+35] ChromeMain [0x67FBC7FE+158]
,
Sep 22 2016
Multibuffers looks incidential here, but good to know in case more reports or evidence shows up.
,
Sep 29 2016
,
Oct 21 2016
Another instance on a non-video-related WebGL conformacnce test: https://build.chromium.org/p/tryserver.chromium.win/builders/win_chromium_rel_ng/builds/316668 WebglConformance_conformance_glsl_misc_shader_with_non_reserved_words (gpu_tests.webgl_conformance_integration_test.WebGLConformanceIntegrationTest) ... ASSERTION FAILED: !m_heapDoesNotContainCache->lookup(address) e:\b\c\b\win\src\third_party\webkit\source\platform\heap\heap.cpp(312) : unsigned char *__thiscall blink::ThreadHeap::checkAndMarkPointer(class blink::Visitor *,unsigned char *) Backtrace: blink::ThreadHeap::checkAndMarkPointer [0x67CB87AC+223] blink::ThreadState::visitStack [0x67CC66BE+70] blink::ThreadHeap::visitStackRoots [0x67CBA687+195] blink::ThreadState::collectGarbage [0x67CC18EC+440] blink::ThreadState::scheduleGCIfNeeded [0x67CC4700+159] blink::LargeObjectArena::allocateLargeObjectPage [0x67CBB52E+81] blink::BaseArena::allocateLargeObject [0x67CBB4D6+86] blink::NormalPageArena::outOfLineAllocate [0x67CBD2FB+111] blink::NormalPageArena::allocateObject [0x67CBB61D+221] blink::ThreadHeap::allocateOnArenaIndex [0x67D05636+127] blink::HeapAllocator::allocateHashTableBacking<WTF::KeyValuePair<blink::WeakMember<blink::Node>,blink::Member<blink::EventTargetData> >,WTF::HashTable<blink::WeakMember<blink::Node>,WTF::KeyValuePair<blink::WeakMember<blink::Node>,blink::Member<blink::Eve [0x689B8E55+33] WTF::HashTable<blink::WeakMember<blink::Node>,WTF::KeyValuePair<blink::WeakMember<blink::Node>,blink::Member<blink::EventTargetData> >,WTF::KeyValuePairKeyExtractor,WTF::MemberHash<blink::Node>,WTF::HashMapValueTraits<WTF::HashTraits<blink::WeakMember<bli [0x689BA9D9+15] WTF::HashTable<blink::WeakMember<blink::Node>,WTF::KeyValuePair<blink::WeakMember<blink::Node>,blink::Member<blink::EventTargetData> >,WTF::KeyValuePairKeyExtractor,WTF::MemberHash<blink::Node>,WTF::HashMapValueTraits<WTF::HashTraits<blink::WeakMember<bli [0x689BF392+43] WTF::HashTable<blink::WeakMember<blink::Node>,WTF::KeyValuePair<blink::WeakMember<blink::Node>,blink::Member<blink::EventTargetData> >,WTF::KeyValuePairKeyExtractor,WTF::MemberHash<blink::Node>,WTF::HashMapValueTraits<WTF::HashTraits<blink::WeakMember<bli [0x689BCB0F+85] WTF::HashTable<blink::WeakMember<blink::Node>,WTF::KeyValuePair<blink::WeakMember<blink::Node>,blink::Member<blink::EventTargetData> >,WTF::KeyValuePairKeyExtractor,WTF::MemberHash<blink::Node>,WTF::HashMapValueTraits<WTF::HashTraits<blink::WeakMember<bli [0x689B8AC2+411] WTF::HashMap<blink::WeakMember<blink::Node>,blink::Member<blink::EventTargetData>,WTF::MemberHash<blink::Node>,WTF::HashTraits<blink::WeakMember<blink::Node> >,WTF::HashTraits<blink::Member<blink::EventTargetData> >,blink::HeapAllocator>::set<blink::Node [0x689B9B01+21] blink::Node::ensureEventTargetData [0x689BC787+196] blink::EventTarget::addEventListenerInternal [0x68A919D2+348] blink::EventTarget::addEventListener [0x68A91862+59] blink::EventTarget::addEventListener [0x68A91820+95] blink::TextTrackV8Internal::addCueMethodCallback [0x687B5C6C+520] (No symbol) [0x2B4CF58B] v8::internal::Runtime_StringReplaceGlobalRegExpWithString [0x67AE4E6C+204]
,
Nov 16 2016
assign to hubbe. Please free free to re-assign appropriately or resolve.
,
Nov 16 2016
I can't even triage this bug properly. Assigning to kbr@, maybe he knows where it should go?
,
Nov 16 2016
This isn't media-related. It appears to be a problem in Oilpan, the Blink garbage collector. haraken@, is there any instrumentation that could be added to catch this sort of error earlier?
,
Nov 17 2016
,
Dec 19 2016
,
Dec 19 2016
,
Feb 24 2017
,
Feb 24 2017
Another incident reported in Issue 695002 .
,
Feb 24 2017
The ephemeral conditions that bring this assert about, are proving hard to work out. Let's add an assert when committing new pages, checking that the negative page cache agrees. That might get us closer to the source of it..
,
Feb 24 2017
Thanks Sigbjorn. Is keishi@ the best person to own this bug and add that assert?
,
Feb 24 2017
The following revision refers to this bug: https://chromium.googlesource.com/chromium/src.git/+/7c787e8cafaa3b13951ce38c76e0ebefb31ff454 commit 7c787e8cafaa3b13951ce38c76e0ebefb31ff454 Author: sigbjornf <sigbjornf@opera.com> Date: Fri Feb 24 15:45:07 2017 Verify that a new heap page isn't also marked as being off heap. Attempt to diagnose a rare assert failure, where a conservative GC stack scan finds a potential pointer in both the heap's negative heap page cache and in the map of in-use heap pages. Those two mapping should be mutually exclusive by construction, and must be -- the negative page cache must not contain false positives. Hence, add verification when a new page is committed & used, it does not already have a mapping in that negative cache. R=haraken BUG= 649485 Review-Url: https://codereview.chromium.org/2715713005 Cr-Commit-Position: refs/heads/master@{#452833} [modify] https://crrev.com/7c787e8cafaa3b13951ce38c76e0ebefb31ff454/third_party/WebKit/Source/platform/heap/PageMemory.h [modify] https://crrev.com/7c787e8cafaa3b13951ce38c76e0ebefb31ff454/third_party/WebKit/Source/platform/heap/ThreadState.cpp [modify] https://crrev.com/7c787e8cafaa3b13951ce38c76e0ebefb31ff454/third_party/WebKit/Source/platform/heap/ThreadState.h
,
Feb 24 2017
(We've added a CHECK() for this, failures in PageMemory::commit() is what to look out for.)
,
Feb 25 2017
Thanks Sigbjorn for adding the stronger assertion. May I please assign this to you so that it doesn't fall off anyone's radar?
,
Aug 1 2017
The assigned owner "sigbjornf@opera.com" is not able to receive e-mails, please re-triage. For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot
,
Aug 8 2017
There has been only one crash with signature PageMemory::commit in M57. Would keishi@ be able to investigate further?
,
Aug 8 2017
Let's close this as WontFix instead. Thanks for triaging. |
||||||||||||||
►
Sign in to add a comment |
||||||||||||||
Comment 1 by dalecur...@chromium.org
, Sep 22 2016