187821 2018-07-19 14:47:20 -0700 [ITP] Crash under ResourceLoadStatisticsMemoryStore::removeDataRecords() 2018-07-19 20:45:07 -0700 1 1 1 Unclassified WebKit WebKit2 WebKit Nightly Build Unspecified Unspecified RESOLVED FIXED InRadar P2 Normal --- 1 cdumez cdumez beidson bfulgham commit-queue ddkilzer rniwa webkit-bug-importer wilander youennf oldest_to_newest 1443513 0 cdumez 2018-07-19 14:47:20 -0700 Crash under ResourceLoadStatisticsMemoryStore::removeDataRecords(): Thread 0 name: Dispatch queue: com.apple.main-thread Thread 0 Crashed ↩: 0 libdispatch.dylib 0x00000001a451dc3c dispatch_async$VARIANT$armv81 + 208 (inline_internal.h:2596) 1 libdispatch.dylib 0x00000001a451dba4 dispatch_async$VARIANT$armv81 + 56 (inline_internal.h:2567) 2 JavaScriptCore 0x00000001ac7c74d4 WTF::WorkQueue::dispatch(WTF::Function<void ()>&&) + 140 (WorkQueueCocoa.cpp:35) 3 WebKit 0x00000001b4e8f620 WTF::Function<void (WTF::HashSet<WTF::String, WTF::StringHash, WTF::HashTraits<WTF::String> > const&)>::CallableWrapper<WebKit::ResourceLoadStatisticsMemoryStore::removeDataRecords(WTF::CompletionHandler<void ()>&&)::$_1::operator()()::'lambda'(WTF::HashSet<WTF::String, WTF::StringHash, WTF::HashTraits<WTF::String> > const&)>::call(WTF::HashSet<WTF::String, WTF::StringHash, WTF::HashTraits<WTF::String> > const&) + 172 (ResourceLoadStatisticsMemoryStore.cpp:249) 4 WebKit 0x00000001b50498e8 WTF::Function<void (WTF::HashSet<WTF::String, WTF::StringHash, WTF::HashTraits<WTF::String> >)>::operator()(WTF::HashSet<WTF::String, WTF::StringHash, WTF::HashTraits<WTF::String> >) const + 64 (Function.h:56) 5 WebKit 0x00000001b50497a8 WTF::Function<void (WTF::HashSet<WTF::String, WTF::StringHash, WTF::HashTraits<WTF::String> >&&)>::CallableWrapper<WebKit::WebProcessProxy::deleteWebsiteDataForTopPrivatelyControlledDomainsInAllPersistentDataStores(WTF::OptionSet<WebKit::WebsiteDataType>, WTF::Vector<WTF::String, 0ul, WTF::CrashOnOverflow, 16ul>&&, bool, WTF::Function<void (WTF::HashSet<WTF::String, WTF::StringHash, WTF::HashTraits<WTF::String> > const&)>&&)::$_1>::call(WTF::HashSet<WTF::String, WTF::StringHash, WTF::HashTraits<WTF::String> >&&) + 224 (WebProcessProxy.cpp:277) 6 JavaScriptCore 0x00000001ac7aea98 WTF::RunLoop::performWork() + 276 (Function.h:56) 7 JavaScriptCore 0x00000001ac7aed60 WTF::RunLoop::performWork(void*) + 36 (RunLoopCF.cpp:38) 8 CoreFoundation 0x00000001a4a9c3cc __CFRUNLOOP_IS_CALLING_OUT_TO_A_SOURCE0_PERFORM_FUNCTION__ + 24 (CFRunLoop.c:1980) 9 CoreFoundation 0x00000001a4a9c34c __CFRunLoopDoSource0 + 88 (CFRunLoop.c:2015) 10 CoreFoundation 0x00000001a4a9bc2c __CFRunLoopDoSources0 + 176 (CFRunLoop.c:2051) 11 CoreFoundation 0x00000001a4a96ad0 __CFRunLoopRun + 1044 (CFRunLoop.c:2922) 12 CoreFoundation 0x00000001a4a96398 CFRunLoopRunSpecific + 436 (CFRunLoop.c:3247) 13 GraphicsServices 0x00000001a6d05570 GSEventRunModal + 100 (GSEvent.c:2245) 14 UIKitCore 0x00000001d2560f5c UIApplicationMain + 212 (UIApplication.m:4314) 15 SafariViewService 0x00000001007068bc main + 244 (main.m:60) 16 libdyld.dylib 0x00000001a4556ddc start + 4 1443514 1 cdumez 2018-07-19 14:47:33 -0700 <rdar://problem/42112693> 1443517 2 345384 cdumez 2018-07-19 14:53:13 -0700 Created attachment 345384 Patch 1443581 3 wilander 2018-07-19 16:20:13 -0700 Looks good to me. I assume we weren't able to add a test case that caused the crash? 1443589 4 cdumez 2018-07-19 16:42:02 -0700 (In reply to John Wilander from comment #3) > Looks good to me. I assume we weren't able to add a test case that caused > the crash? I assume this code path is exercised on the bots. However, this is racy and to experience the crash, the store would need to get destroyed on the background thread *while* the WebPageProxy operation is going on on the main thread. 1443664 5 345384 ddkilzer 2018-07-19 20:19:02 -0700 Comment on attachment 345384 Patch r=me 1443667 6 345384 commit-queue 2018-07-19 20:45:05 -0700 Comment on attachment 345384 Patch Clearing flags on attachment: 345384 Committed r234020: <https://trac.webkit.org/changeset/234020> 1443668 7 commit-queue 2018-07-19 20:45:07 -0700 All reviewed patches have been landed. Closing bug. 345384 2018-07-19 14:53:13 -0700 2018-07-19 20:45:05 -0700 Patch bug-187821-20180719145312.patch text/plain 5229 cdumez U3VidmVyc2lvbiBSZXZpc2lvbjogMjMzOTg0CmRpZmYgLS1naXQgYS9Tb3VyY2UvV2ViS2l0L0No YW5nZUxvZyBiL1NvdXJjZS9XZWJLaXQvQ2hhbmdlTG9nCmluZGV4IGZiMGFhNjQ0YTRhNTBmMTY5 NWRjMGI2MjFlOGE0YjMyZjJhMDM5YzAuLmIwOTM4OTA2ZjZhYjA4ZTQ0YTVhMDMyYmUwNzA1ZjVj NWMyMGQ2ODYgMTAwNjQ0Ci0tLSBhL1NvdXJjZS9XZWJLaXQvQ2hhbmdlTG9nCisrKyBiL1NvdXJj ZS9XZWJLaXQvQ2hhbmdlTG9nCkBAIC0xLDMgKzEsMjYgQEAKKzIwMTgtMDctMTkgIENocmlzIER1 bWV6ICA8Y2R1bWV6QGFwcGxlLmNvbT4KKworICAgICAgICBbSVRQXSBDcmFzaCB1bmRlciBSZXNv dXJjZUxvYWRTdGF0aXN0aWNzTWVtb3J5U3RvcmU6OnJlbW92ZURhdGFSZWNvcmRzKCkKKyAgICAg ICAgaHR0cHM6Ly9idWdzLndlYmtpdC5vcmcvc2hvd19idWcuY2dpP2lkPTE4NzgyMQorICAgICAg ICA8cmRhcjovL3Byb2JsZW0vNDIxMTI2OTM+CisKKyAgICAgICAgUmV2aWV3ZWQgYnkgTk9CT0RZ IChPT1BTISkuCisKKyAgICAgICAgSW4gdHdvIGNhc2VzLCBSZXNvdXJjZUxvYWRTdGF0aXN0aWNz TWVtb3J5U3RvcmUgKHdoaWNoIGxpdmVzIG9uIGEgYmFja2dyb3VuZCBxdWV1ZSkgbmVlZHMgdG8g Y2FsbCBXZWJQYWdlUHJveHkKKyAgICAgICAgb3BlcmF0aW9ucyBvbiB0aGUgbWFpbiB0aHJlYWQg YW5kIHRoZW4gZGlzcGF0Y2ggYmFjayBvbiB0aGUgYmFja2dyb3VuZCBxdWV1ZSB3aGVuIHRoZSBv cGVyYXRpb24gY29tcGxldGVzLgorICAgICAgICBIb3dldmVyLCBpdCBpcyBwb3NzaWJsZSBmb3Ig dGhlIFJlc291cmNlTG9hZFN0YXRpc3RpY3NNZW1vcnlTdG9yZSB0byBnZXQgZGVzdHJveWVkIG9u IHRoZSBiYWNrZ3JvdW5kIHF1ZXVlCisgICAgICAgIGR1cmluZyB0aGlzIHRpbWUgYW5kIHdlIHdv dWxkIHRoZW4gY3Jhc2ggd2hlbiB0cnlpbmcgdG8gdXNlIG1fd29ya1F1ZXVlIHRvIHJlLWRpc3Bh dGNoLiBUbyBhZGRyZXNzIHRoZSBpc3N1ZSwKKyAgICAgICAgSSBub3cgcmVmIHRoZSB3b3JrIHF1 ZXVlIGluIHRoZSBsYW1iZGEgc28gdGhhdCB3ZSdyZSBndWFyYW50ZWVkIHRvIGJlIGFibGUgdG8g cmUtZGlzcGF0Y2ggdG8gdGhlIGJhY2tncm91bmQKKyAgICAgICAgcXVldWUuIFdoZW4gd2UncmUg YmFjayBvbiB0aGUgYmFja2dyb3VuZCBxdWV1ZSwgd2UnbGwgcmVhbGl6ZSB0aGF0IHdlYWtUaGlz IGluIGdvbmUgYW5kIHdlJ2xsIGNhbGwgdGhlIGNhbGxiYWNrCisgICAgICAgIGFuZCByZXR1cm4g ZWFybHkuCisKKyAgICAgICAgTm90ZSB0aGF0IEkgYW0gbm90IGNoZWNraW5nIHdlYWtUaGlzIG9u IHRoZSBtYWluIHRocmVhZCBhcyB0aGlzIHdvdWxkIG5vdCBiZSBzYWZlLiB3ZWFrVGhpcyBzaG91 bGQgb25seSBiZQorICAgICAgICB1c2VkIG9uIHRoZSBiYWNrZ3JvdW5kIHF1ZXVlLgorCisgICAg ICAgICogVUlQcm9jZXNzL1Jlc291cmNlTG9hZFN0YXRpc3RpY3NNZW1vcnlTdG9yZS5jcHA6Cisg ICAgICAgIChXZWJLaXQ6OlJlc291cmNlTG9hZFN0YXRpc3RpY3NNZW1vcnlTdG9yZTo6cmVtb3Zl RGF0YVJlY29yZHMpOgorICAgICAgICAoV2ViS2l0OjpSZXNvdXJjZUxvYWRTdGF0aXN0aWNzTWVt b3J5U3RvcmU6OmdyYW5kZmF0aGVyRXhpc3RpbmdXZWJzaXRlRGF0YSk6CisKIDIwMTgtMDctMTkg IFlvdWVubiBGYWJsZXQgIDx5b3Vlbm5AYXBwbGUuY29tPgogCiAgICAgICAgIEVuc3VyZSBleHBl cmltZW50YWxQbHVnSW5TYW5kYm94UHJvZmlsZXNFbmFibGVkIGlzIHNldCBvbiBQbHVnaW5Qcm9j ZXNzCmRpZmYgLS1naXQgYS9Tb3VyY2UvV2ViS2l0L1VJUHJvY2Vzcy9SZXNvdXJjZUxvYWRTdGF0 aXN0aWNzTWVtb3J5U3RvcmUuY3BwIGIvU291cmNlL1dlYktpdC9VSVByb2Nlc3MvUmVzb3VyY2VM b2FkU3RhdGlzdGljc01lbW9yeVN0b3JlLmNwcAppbmRleCA5ZjBjN2YwYjY0ZGE0MTEwOTM5MTJi MTZiNmY3ODNmMTFhZWMyYTUyLi42MDdhYzZjY2JlMTgzMjlkMGVlNGNjMTM1NWVlZDYzYTNlY2Ri MmE2IDEwMDY0NAotLS0gYS9Tb3VyY2UvV2ViS2l0L1VJUHJvY2Vzcy9SZXNvdXJjZUxvYWRTdGF0 aXN0aWNzTWVtb3J5U3RvcmUuY3BwCisrKyBiL1NvdXJjZS9XZWJLaXQvVUlQcm9jZXNzL1Jlc291 cmNlTG9hZFN0YXRpc3RpY3NNZW1vcnlTdG9yZS5jcHAKQEAgLTI0NSw4ICsyNDUsOCBAQCB2b2lk IFJlc291cmNlTG9hZFN0YXRpc3RpY3NNZW1vcnlTdG9yZTo6cmVtb3ZlRGF0YVJlY29yZHMoQ29t cGxldGlvbkhhbmRsZXI8dm9pZAogICAgIHNldERhdGFSZWNvcmRzQmVpbmdSZW1vdmVkKHRydWUp OwogCiAgICAgUnVuTG9vcDo6bWFpbigpLmRpc3BhdGNoKFtwcmV2YWxlbnRSZXNvdXJjZURvbWFp bnMgPSBjcm9zc1RocmVhZENvcHkocHJldmFsZW50UmVzb3VyY2VEb21haW5zKSwgY2FsbGJhY2sg PSBXVEZNb3ZlKGNhbGxiYWNrKSwgdGhpcywgd2Vha1RoaXMgPSBtYWtlV2Vha1B0cigqdGhpcyld ICgpIG11dGFibGUgewotICAgICAgICBXZWJQcm9jZXNzUHJveHk6OmRlbGV0ZVdlYnNpdGVEYXRh Rm9yVG9wUHJpdmF0ZWx5Q29udHJvbGxlZERvbWFpbnNJbkFsbFBlcnNpc3RlbnREYXRhU3RvcmVz KFdlYlJlc291cmNlTG9hZFN0YXRpc3RpY3NTdG9yZTo6bW9uaXRvcmVkRGF0YVR5cGVzKCksIFdU Rk1vdmUocHJldmFsZW50UmVzb3VyY2VEb21haW5zKSwgbV9wYXJhbWV0ZXJzLnNob3VsZE5vdGlm eVBhZ2VzV2hlbkRhdGFSZWNvcmRzV2VyZVNjYW5uZWQsIFtjYWxsYmFjayA9IFdURk1vdmUoY2Fs bGJhY2spLCB0aGlzLCB3ZWFrVGhpcyA9IFdURk1vdmUod2Vha1RoaXMpXShjb25zdCBIYXNoU2V0 PFN0cmluZz4mIGRvbWFpbnNXaXRoRGVsZXRlZFdlYnNpdGVEYXRhKSBtdXRhYmxlIHsKLSAgICAg ICAgICAgIG1fd29ya1F1ZXVlLT5kaXNwYXRjaChbdG9wRG9tYWlucyA9IGNyb3NzVGhyZWFkQ29w eShkb21haW5zV2l0aERlbGV0ZWRXZWJzaXRlRGF0YSksIGNhbGxiYWNrID0gV1RGTW92ZShjYWxs YmFjayksIHRoaXMsIHdlYWtUaGlzID0gV1RGTW92ZSh3ZWFrVGhpcyldICgpIG11dGFibGUgewor ICAgICAgICBXZWJQcm9jZXNzUHJveHk6OmRlbGV0ZVdlYnNpdGVEYXRhRm9yVG9wUHJpdmF0ZWx5 Q29udHJvbGxlZERvbWFpbnNJbkFsbFBlcnNpc3RlbnREYXRhU3RvcmVzKFdlYlJlc291cmNlTG9h ZFN0YXRpc3RpY3NTdG9yZTo6bW9uaXRvcmVkRGF0YVR5cGVzKCksIFdURk1vdmUocHJldmFsZW50 UmVzb3VyY2VEb21haW5zKSwgbV9wYXJhbWV0ZXJzLnNob3VsZE5vdGlmeVBhZ2VzV2hlbkRhdGFS ZWNvcmRzV2VyZVNjYW5uZWQsIFtjYWxsYmFjayA9IFdURk1vdmUoY2FsbGJhY2spLCB0aGlzLCB3 ZWFrVGhpcyA9IFdURk1vdmUod2Vha1RoaXMpLCB3b3JrUXVldWUgPSBtX3dvcmtRdWV1ZS5jb3B5 UmVmKCldKGNvbnN0IEhhc2hTZXQ8U3RyaW5nPiYgZG9tYWluc1dpdGhEZWxldGVkV2Vic2l0ZURh dGEpIG11dGFibGUgeworICAgICAgICAgICAgd29ya1F1ZXVlLT5kaXNwYXRjaChbdG9wRG9tYWlu cyA9IGNyb3NzVGhyZWFkQ29weShkb21haW5zV2l0aERlbGV0ZWRXZWJzaXRlRGF0YSksIGNhbGxi YWNrID0gV1RGTW92ZShjYWxsYmFjayksIHRoaXMsIHdlYWtUaGlzID0gV1RGTW92ZSh3ZWFrVGhp cyldICgpIG11dGFibGUgewogICAgICAgICAgICAgICAgIGlmICghd2Vha1RoaXMpIHsKICAgICAg ICAgICAgICAgICAgICAgY2FsbGJhY2soKTsKICAgICAgICAgICAgICAgICAgICAgcmV0dXJuOwpA QCAtNDg2LDggKzQ4Niw4IEBAIHZvaWQgUmVzb3VyY2VMb2FkU3RhdGlzdGljc01lbW9yeVN0b3Jl OjpncmFuZGZhdGhlckV4aXN0aW5nV2Vic2l0ZURhdGEoQ29tcGxldGlvCiAgICAgUnVuTG9vcDo6 bWFpbigpLmRpc3BhdGNoKFt0aGlzLCB3ZWFrVGhpcyA9IG1ha2VXZWFrUHRyKCp0aGlzKSwgY2Fs bGJhY2sgPSBXVEZNb3ZlKGNhbGxiYWNrKV0gKCkgbXV0YWJsZSB7CiAgICAgICAgIC8vIEZJWE1F OiBUaGlzIG1ldGhvZCBiZWluZyBhIHN0YXRpYyBjYWxsIG9uIFdlYlByb2Nlc3NQcm94eSBpcyB3 cm9uZy4KICAgICAgICAgLy8gSXQgc2hvdWxkIGJlIG9uIHRoZSBkYXRhIHN0b3JlIHRoYXQgdGhp cyBvYmplY3QgYmVsb25ncyB0by4KLSAgICAgICAgV2ViUHJvY2Vzc1Byb3h5Ojp0b3BQcml2YXRl bHlDb250cm9sbGVkRG9tYWluc1dpdGhXZWJzaXRlRGF0YShXZWJSZXNvdXJjZUxvYWRTdGF0aXN0 aWNzU3RvcmU6Om1vbml0b3JlZERhdGFUeXBlcygpLCBtX3BhcmFtZXRlcnMuc2hvdWxkTm90aWZ5 UGFnZXNXaGVuRGF0YVJlY29yZHNXZXJlU2Nhbm5lZCwgW3RoaXMsIHdlYWtUaGlzID0gV1RGTW92 ZSh3ZWFrVGhpcyksIGNhbGxiYWNrID0gV1RGTW92ZShjYWxsYmFjayldIChIYXNoU2V0PFN0cmlu Zz4mJiB0b3BQcml2YXRlbHlDb250cm9sbGVkRG9tYWluc1dpdGhXZWJzaXRlRGF0YSkgbXV0YWJs ZSB7Ci0gICAgICAgICAgICBtX3dvcmtRdWV1ZS0+ZGlzcGF0Y2goW3RoaXMsIHdlYWtUaGlzID0g V1RGTW92ZSh3ZWFrVGhpcyksIHRvcERvbWFpbnMgPSBjcm9zc1RocmVhZENvcHkodG9wUHJpdmF0 ZWx5Q29udHJvbGxlZERvbWFpbnNXaXRoV2Vic2l0ZURhdGEpLCBjYWxsYmFjayA9IFdURk1vdmUo Y2FsbGJhY2spXSAoKSBtdXRhYmxlIHsKKyAgICAgICAgV2ViUHJvY2Vzc1Byb3h5Ojp0b3BQcml2 YXRlbHlDb250cm9sbGVkRG9tYWluc1dpdGhXZWJzaXRlRGF0YShXZWJSZXNvdXJjZUxvYWRTdGF0 aXN0aWNzU3RvcmU6Om1vbml0b3JlZERhdGFUeXBlcygpLCBtX3BhcmFtZXRlcnMuc2hvdWxkTm90 aWZ5UGFnZXNXaGVuRGF0YVJlY29yZHNXZXJlU2Nhbm5lZCwgW3RoaXMsIHdlYWtUaGlzID0gV1RG TW92ZSh3ZWFrVGhpcyksIGNhbGxiYWNrID0gV1RGTW92ZShjYWxsYmFjayksIHdvcmtRdWV1ZSA9 IG1fd29ya1F1ZXVlLmNvcHlSZWYoKV0gKEhhc2hTZXQ8U3RyaW5nPiYmIHRvcFByaXZhdGVseUNv bnRyb2xsZWREb21haW5zV2l0aFdlYnNpdGVEYXRhKSBtdXRhYmxlIHsKKyAgICAgICAgICAgIHdv cmtRdWV1ZS0+ZGlzcGF0Y2goW3RoaXMsIHdlYWtUaGlzID0gV1RGTW92ZSh3ZWFrVGhpcyksIHRv cERvbWFpbnMgPSBjcm9zc1RocmVhZENvcHkodG9wUHJpdmF0ZWx5Q29udHJvbGxlZERvbWFpbnNX aXRoV2Vic2l0ZURhdGEpLCBjYWxsYmFjayA9IFdURk1vdmUoY2FsbGJhY2spXSAoKSBtdXRhYmxl IHsKICAgICAgICAgICAgICAgICBpZiAoIXdlYWtUaGlzKSB7CiAgICAgICAgICAgICAgICAgICAg IGNhbGxiYWNrKCk7CiAgICAgICAgICAgICAgICAgICAgIHJldHVybjsK