New issue
Advanced search Search tips
Note: Color blocks (like or ) mean that a user may not be available. Tooltip shows the reason.

Issue 754517 link

Starred by 1 user

Issue metadata

Status: Fixed
Owner:
Closed: Aug 2017
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: ----
Pri: 1
Type: Bug



Sign in to add a comment

FATAL:WrapperVisitor.h(86)] Check failed: false.

Project Member Reported by dalecur...@chromium.org, Aug 11 2017

Issue description

For me this was ToT trying to load https://www.twitch.tv/dota2ti

[1:1:0810/170448.165348:FATAL:WrapperVisitor.h(86)] Check failed: false. 
#0 0x7fe4c0fa7947 base::debug::StackTrace::StackTrace()
#1 0x7fe4c0fce8c1 logging::LogMessage::~LogMessage()
#2 0x7fe4b9679ce3 blink::WrapperVisitor::MissedWriteBarrier<>()
#3 0x7fe4b89560db blink::ScriptWrappableVisitorVerifier::PushToMarkingDeque()
#4 0x7fe4b9679a2e blink::WrapperVisitor::TraceWrappers<>()
#5 0x7fe4b9a2c9e7 blink::ElementRareData::TraceWrappersAfterDispatch()
#6 0x7fe4b9a2a337 blink::TraceTrait<>::TraceMarkedWrapper()
#7 0x7fe4b8954a3d blink::ScriptWrappableVisitor::TraceEpilogue()
#8 0x7fe4bb29bfff v8::internal::MarkCompactCollector::MarkLiveObjects()
#9 0x7fe4bb29b148 v8::internal::MarkCompactCollector::CollectGarbage()
#10 0x7fe4bb26c5bd v8::internal::Heap::MarkCompact()
#11 0x7fe4bb26a7f1 v8::internal::Heap::PerformGarbageCollection()
#12 0x7fe4bb26997a v8::internal::Heap::CollectGarbage()
#13 0x7fe4bb2685b0 v8::internal::Heap::HandleGCRequest()
#14 0x7fe4bb21b85a v8::internal::StackGuard::HandleInterrupts()
#15 0x7fe4bb53191f v8::internal::__RT_impl_Runtime_StackGuard()
#16 0x0e3f3c0043c4 <unknown>

Received signal 6
#0 0x7fe4c0fa7947 base::debug::StackTrace::StackTrace()
#1 0x7fe4c0fa741f base::debug::(anonymous namespace)::StackDumpSignalHandler()
#2 0x7fe4c112c330 <unknown>
#3 0x7fe4b4777c37 gsignal
#4 0x7fe4b477b028 abort
#5 0x7fe4c0fa5552 base::debug::BreakDebugger()
#6 0x7fe4c0fced92 logging::LogMessage::~LogMessage()
#7 0x7fe4b9679ce3 blink::WrapperVisitor::MissedWriteBarrier<>()
#8 0x7fe4b89560db blink::ScriptWrappableVisitorVerifier::PushToMarkingDeque()
#9 0x7fe4b9679a2e blink::WrapperVisitor::TraceWrappers<>()
#10 0x7fe4b9a2c9e7 blink::ElementRareData::TraceWrappersAfterDispatch()
#11 0x7fe4b9a2a337 blink::TraceTrait<>::TraceMarkedWrapper()
#12 0x7fe4b8954a3d blink::ScriptWrappableVisitor::TraceEpilogue()
#13 0x7fe4bb29bfff v8::internal::MarkCompactCollector::MarkLiveObjects()
#14 0x7fe4bb29b148 v8::internal::MarkCompactCollector::CollectGarbage()
#15 0x7fe4bb26c5bd v8::internal::Heap::MarkCompact()
#16 0x7fe4bb26a7f1 v8::internal::Heap::PerformGarbageCollection()
#17 0x7fe4bb26997a v8::internal::Heap::CollectGarbage()
#18 0x7fe4bb2685b0 v8::internal::Heap::HandleGCRequest()
#19 0x7fe4bb21b85a v8::internal::StackGuard::HandleInterrupts()
#20 0x7fe4bb53191f v8::internal::__RT_impl_Runtime_StackGuard()
#21 0x0e3f3c0043c4 <unknown>
  r8: ffffbf8a23a9fb90  r9: ffffbf8a23a9fb80 r10: 0000000000000008 r11: 0000000000000202
 r12: 00007ffe51e35f60 r13: 0000000000000049 r14: 00007ffe51e35f58 r15: 00007ffe51e35f50
  di: 0000000000000001  si: 0000000000000001  bp: 00007ffe51e35b10  bx: 00007ffe51e35b10
  dx: 0000000000000006  ax: 0000000000000000  cx: 00007fe4b4777c37  sp: 00007ffe51e35968
  ip: 00007fe4b4777c37 efl: 0000000000000202 cgf: 000b000000000033 erf: 0000000000000000
 trp: 0000000000000000 msk: 0000000000000000 cr2: 0000000000000000
[end of stack trace]

Seems to be from c8f2be9535cf78f61faa9e946547eb7885f87f53
 
If that ones commented out, this one fails too:

[1:1:0810/171517.904407:FATAL:ScriptWrappableVisitorVerifier.h(39)] Check failed: false. 
#0 0x7f804c966947 base::debug::StackTrace::StackTrace()
#1 0x7f804c98d8c1 logging::LogMessage::~LogMessage()
#2 0x7f8044315117 blink::ScriptWrappableVisitorVerifier::PushToMarkingDeque()
#3 0x7f8045038a2e blink::WrapperVisitor::TraceWrappers<>()
#4 0x7f80453eb967 blink::ElementRareData::TraceWrappersAfterDispatch()
#5 0x7f80453e92b7 blink::TraceTrait<>::TraceMarkedWrapper()
#6 0x7f8044313a3d blink::ScriptWrappableVisitor::TraceEpilogue()
#7 0x7f8046c5afff v8::internal::MarkCompactCollector::MarkLiveObjects()
#8 0x7f8046c5a148 v8::internal::MarkCompactCollector::CollectGarbage()
#9 0x7f8046c2b5bd v8::internal::Heap::MarkCompact()
#10 0x7f8046c297f1 v8::internal::Heap::PerformGarbageCollection()
#11 0x7f8046c2897a v8::internal::Heap::CollectGarbage()
#12 0x7f8046c275b0 v8::internal::Heap::HandleGCRequest()
#13 0x7f8046bda85a v8::internal::StackGuard::HandleInterrupts()
#14 0x7f8046ef091f v8::internal::__RT_impl_Runtime_StackGuard()
#15 0x2ac45c6843c4 <unknown>

Components: Blink>JavaScript>GC Blink>Bindings
Status: Started (was: Assigned)
Thanks a lot. I will have a look.

The second check verfies the same condition as the first one; it's just that the first one produces a more meaningful error message (missed write barrier)
Cc: haraken@chromium.org
CL is in flight: https://chromium-review.googlesource.com/c/611981/

Thanks for browsing with DCHECKs :)
Project Member

Comment 4 by bugdroid1@chromium.org, Aug 11 2017

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/67c862ea884dc3ee389f4f80883a54d487374e7d

commit 67c862ea884dc3ee389f4f80883a54d487374e7d
Author: Michael Lippautz <mlippautz@chromium.org>
Date: Fri Aug 11 14:36:17 2017

[wrapper-tracing] ElementRareData: Use TraceWrapperMember

Previously fields in ElementRareData with issuing a manual write
barrier. This was required because TraceWrapperMember was too large. Now
that it is the same size as Member we can just switch over.

Drive-by: Fixed a missing write barrier in resize_observer_data_.Keys().

Bug:  chromium:754517 ,  chromium:752600 
Change-Id: I6b94f77949b0fc6c25ebcfe5c83b3277a8815242
Reviewed-on: https://chromium-review.googlesource.com/611981
Reviewed-by: Kentaro Hara <haraken@chromium.org>
Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/master@{#493732}
[modify] https://crrev.com/67c862ea884dc3ee389f4f80883a54d487374e7d/third_party/WebKit/Source/core/dom/Element.cpp
[modify] https://crrev.com/67c862ea884dc3ee389f4f80883a54d487374e7d/third_party/WebKit/Source/core/dom/Element.h
[modify] https://crrev.com/67c862ea884dc3ee389f4f80883a54d487374e7d/third_party/WebKit/Source/core/dom/ElementRareData.cpp
[modify] https://crrev.com/67c862ea884dc3ee389f4f80883a54d487374e7d/third_party/WebKit/Source/core/dom/ElementRareData.h
[modify] https://crrev.com/67c862ea884dc3ee389f4f80883a54d487374e7d/third_party/WebKit/Source/core/dom/TreeScopeAdopter.cpp

Status: Fixed (was: Started)
Thanks for the quick fix!

Sign in to add a comment