[Webkit-unassigned] [Bug 217363] REGRESSION(r267763): [GTK][WPE] Broken main thread assertion in MemoryPressureMonitor

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=217363

Alicia Boya García <aboya at igalia.com> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |aboya at igalia.com
            Summary|REGRESSION(r267763):        |REGRESSION(r267763):
                   |[GTK][WPE] Some flaky       |[GTK][WPE] Broken main
                   |crashes in                  |thread assertion in
                   |MemoryPressureMonitor       |MemoryPressureMonitor

--- Comment #3 from Alicia Boya García <aboya at igalia.com> ---
I have reproduced this in the minibrowser as well. I was attaching gdb to the WebProcess in a computer with very limited RAM. This caused enough RAM to be used to trigger the memory pressure handler in the MiniBrowser, and it crashed there.

Here is the backtrace, same as reported before, but resolving the pointers:

ASSERTION FAILED: RunLoop::isMain()
#0  WTFCrash() () at ../../Source/WTF/wtf/Assertions.cpp:295
#1  0x00007f6bdd2309b7 in CRASH_WITH_INFO(...) () at DerivedSources/ForwardingHeaders/wtf/Assertions.h:713
#2  0x00007f6bde1df52c in WebKit::networkProcessesSet() () at ../../Source/WebKit/UIProcess/Network/NetworkProcessProxy.cpp:90
#3  0x00007f6bde1df5ad in WebKit::NetworkProcessProxy::allNetworkProcesses() () at ../../Source/WebKit/UIProcess/Network/NetworkProcessProxy.cpp:98
#4  0x00007f6bdde8063a in WebKit::WebProcessPool::sendMemoryPressureEvent(bool) (this=0x7f6bc44d6000, isCritical=false) at ../../Source/WebKit/UIProcess/WebProcessPool.cpp:443
#5  0x00007f6bde2d4e53 in operator()() const (__closure=0x7f6bc44fa6a8) at ../../Source/WebKit/UIProcess/linux/MemoryPressureMonitor.cpp:383
#6  0x00007f6bde2d60a6 in WTF::Detail::CallableWrapper<WebKit::MemoryPressureMonitor::start()::<lambda()>, void>::call(void) (this=0x7f6bc44fa6a0) at DerivedSources/ForwardingHeaders/wtf/Function.h:52
#7  0x00007f6bdd233fd3 in WTF::Function<void ()>::operator()() const (this=0x7f6b7dbfac30) at DerivedSources/ForwardingHeaders/wtf/Function.h:83
#8  0x00007f6bce715839 in WTF::Thread::entryPoint(WTF::Thread::NewThreadContext*) (newThreadContext=0x7f6bc44eb410) at ../../Source/WTF/wtf/Threading.cpp:179
#9  0x00007f6bce7a6191 in WTF::wtfThreadEntryPoint(void*) (context=0x7f6bc44eb410) at ../../Source/WTF/wtf/posix/ThreadingPOSIX.cpp:213
#10 0x00007f6bc87674d2 in start_thread (arg=<optimized out>) at pthread_create.c:477
#11 0x00007f6bc64852a3 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95

Note this is the code that starts and runs the MemoryPressureMonitor, very clearly on its own thread.

void MemoryPressureMonitor::start()
{
    if (m_started)
        return;

    m_started = true;

    Thread::create("MemoryPressureMonitor", [] {
        [...]
        while (true) {
            [...]
            if (usedPercentage >= s_memoryPresurePercentageThreshold) {
                [...]
                for (auto* processPool : WebProcessPool::allProcessPools())
                    processPool->sendMemoryPressureEvent([...]);

Then WebProcessPool::sendMemoryPressureEvent() needs to traverse allNetworkProcesses()

void WebProcessPool::sendMemoryPressureEvent([...])
{
    [...]
    for (auto networkProcess : NetworkProcessProxy::allNetworkProcesses())

But networkProcessesSet() assumes it will only ever be used in the main thread, which is not the case here.

static HashSet<NetworkProcessProxy*>& networkProcessesSet()
{
    ASSERT(RunLoop::isMain());
    static NeverDestroyed<HashSet<NetworkProcessProxy*>> set;
    return set;
}

-- 
You are receiving this mail because:
You are the assignee for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.webkit.org/pipermail/webkit-unassigned/attachments/20201210/d1515b24/attachment.htm>