193897 2019-01-28 01:23:32 -0800 Crash in WebKit::RemoteLayerTreePropertyApplier::updateChildren 2019-01-30 10:44:31 -0800 1 1 1 Unclassified WebKit Layout and Rendering WebKit Nightly Build Unspecified Unspecified RESOLVED FIXED InRadar P2 Normal --- 1 koivisto webkit-unassigned bfulgham commit-queue ggaren jfernandez simon.fraser thorton zalan oldest_to_newest 1498962 0 koivisto 2019-01-28 01:23:32 -0800 Exception Type: EXC_BAD_ACCESS (SIGSEGV) Exception Subtype: KERN_INVALID_ADDRESS at 0x0000000000000000 VM Region Info: 0 is not in any region. Bytes before following region: 4335222784 REGION TYPE START - END [ VSIZE] PRT/MAX SHRMOD REGION DETAIL UNUSED SPACE AT START ---> __TEXT 0000000102664000-000000010283c000 [ 1888K] r-x/r-x SM=COW .../MobileSafari Termination Signal: Segmentation fault: 11 Termination Reason: Namespace SIGNAL, Code 0xb Terminating Process: exc handler [283] Triggered by Thread: 0 Thread 0 name: Dispatch queue: com.apple.main-thread Thread 0 Crashed: 0 WebKit 0x00000001bad2b4b0 WebKit::RemoteLayerTreePropertyApplier::applyProperties(WebKit::RemoteLayerTreeNode&, WebKit::RemoteLayerTreeHost*, WebKit::RemoteLayerTreeTransaction::LayerProperties const&, WTF::HashMap<unsigned long long, std::__1::unique_ptr<WebKit::RemoteLayerTreeNode, std::__1::default_delete<WebKit::RemoteLayerTreeNode> >, WTF::IntHash<unsigned long long>, WTF::HashTraits<unsigned long long>, WTF::HashTraits<std::__1::unique_ptr<WebKit::RemoteLayerTreeNode, std::__1::default_delete<WebKit::RemoteLayerTreeNode> > > > const&, WebKit::RemoteLayerBackingStore::LayerContentsType) + 28 (RetainPtr.h:90) 1 WebKit 0x00000001baddfda0 WebKit::RemoteLayerTreeHost::updateLayerTree(WebKit::RemoteLayerTreeTransaction const&, float) + 592 (RemoteLayerTreeHost.mm:108) 2 WebKit 0x00000001baddfda0 WebKit::RemoteLayerTreeHost::updateLayerTree(WebKit::RemoteLayerTreeTransaction const&, float) + 592 (RemoteLayerTreeHost.mm:108) 3 WebKit 0x00000001baddf84c WebKit::RemoteLayerTreeDrawingAreaProxy::commitLayerTree(WebKit::RemoteLayerTreeTransaction const&, WebKit::RemoteScrollingCoordinatorTransaction const&) + 120 (RemoteLayerTreeDrawingAreaProxy.mm:205) 4 WebKit 0x00000001bac8e198 void IPC::handleMessage<Messages::RemoteLayerTreeDrawingAreaProxy::CommitLayerTree, WebKit::RemoteLayerTreeDrawingAreaProxy, void (WebKit::RemoteLayerTreeDrawingAreaProxy::*)(WebKit::RemoteLayerTreeTransaction const&, WebKit::RemoteScrollingCoordinatorTransaction const&)>(IPC::Decoder&, WebKit::RemoteLayerTreeDrawingAreaProxy*, void (WebKit::RemoteLayerTreeDrawingAreaProxy::*)(WebKit::RemoteLayerTreeTransaction const&, WebKit::RemoteScrollingCoordinatorTransaction const&)) + 120 (HandleMessage.h:41) 5 WebKit 0x00000001bac71f44 IPC::MessageReceiverMap::dispatchMessage(IPC::Connection&, IPC::Decoder&) + 120 (MessageReceiverMap.cpp:0) 6 WebKit 0x00000001bae2fbec WebKit::WebProcessProxy::didReceiveMessage(IPC::Connection&, IPC::Decoder&) + 32 (WebProcessProxy.cpp:651) 1498963 1 koivisto 2019-01-28 01:23:54 -0800 <rdar://problem/47427750> 1498966 2 360326 koivisto 2019-01-28 01:38:06 -0800 Created attachment 360326 patch 1498967 3 360327 koivisto 2019-01-28 01:43:09 -0800 Created attachment 360327 patch 1498994 4 360327 jfernandez 2019-01-28 05:37:51 -0800 Comment on attachment 360327 patch View in context: https://bugs.webkit.org/attachment.cgi?id=360327&action=review > Source/WebKit/Shared/RemoteLayerTree/RemoteLayerTreePropertyApplier.mm:284 > + return childNode && childNode->uiView(); Does this 'childNode' check make sense after the ASSERT ? 1499105 5 360327 simon.fraser 2019-01-28 11:28:46 -0800 Comment on attachment 360327 patch r=me but I would like to understand why this happens. 1499111 6 thorton 2019-01-28 11:34:01 -0800 +1 what smfr said, this is a papering over a pretty scary symptom that we should probably investigate the root cause of 1500072 7 360327 commit-queue 2019-01-30 10:44:30 -0800 Comment on attachment 360327 patch Clearing flags on attachment: 360327 Committed r240717: <https://trac.webkit.org/changeset/240717> 1500073 8 commit-queue 2019-01-30 10:44:31 -0800 All reviewed patches have been landed. Closing bug. 360326 2019-01-28 01:38:06 -0800 2019-01-28 01:43:09 -0800 patch applyProperties-crash.patch text/plain 2712 koivisto SW5kZXg6IFNvdXJjZS9XZWJLaXQvQ2hhbmdlTG9nCj09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT0KLS0tIFNvdXJjZS9XZWJL aXQvQ2hhbmdlTG9nCShyZXZpc2lvbiAyNDA1NTgpCisrKyBTb3VyY2UvV2ViS2l0L0NoYW5nZUxv Zwkod29ya2luZyBjb3B5KQpAQCAtMSwzICsxLDE5IEBACisyMDE5LTAxLTI4ICBBbnR0aSBLb2l2 aXN0byAgPGFudHRpQGFwcGxlLmNvbT4KKworICAgICAgICBDcmFzaCBpbiBXZWJLaXQ6OlJlbW90 ZUxheWVyVHJlZVByb3BlcnR5QXBwbGllcjo6dXBkYXRlQ2hpbGRyZW4KKyAgICAgICAgaHR0cHM6 Ly9idWdzLndlYmtpdC5vcmcvc2hvd19idWcuY2dpP2lkPTE5Mzg5NworICAgICAgICA8cmRhcjov L3Byb2JsZW0vNDc0Mjc3NTA+CisKKyAgICAgICAgUmV2aWV3ZWQgYnkgTk9CT0RZIChPT1BTISku CisKKyAgICAgICAgVGhlcmUgaGFzIGJlZW4gc29tZSBudWxsIHBvaW50ZXIgY3Jhc2hlcyB3aGVy ZSB3ZSBmYWlsIHRvIGZpbmQgYSByZW1vdGUgbGF5ZXIgdHJlZSBub2RlIHRoYXQgbWF0Y2hlcwor ICAgICAgICB0aGUgdHJhbnNhY3Rpb24gcHJvcGVydGllcy4KKworICAgICAgICAqIFNoYXJlZC9S ZW1vdGVMYXllclRyZWUvUmVtb3RlTGF5ZXJUcmVlUHJvcGVydHlBcHBsaWVyLm1tOgorICAgICAg ICAoV2ViS2l0OjpSZW1vdGVMYXllclRyZWVQcm9wZXJ0eUFwcGxpZXI6OnVwZGF0ZUNoaWxkcmVu KToKKworICAgICAgICBOdWxsIGNoZWNrIHRoZSBub2Rlcy4KKwogMjAxOC0xMi0xNSAgRGFyaW4g QWRsZXIgIDxkYXJpbkBhcHBsZS5jb20+CiAKICAgICAgICAgUmVwbGFjZSBtYW55IHVzZXMgb2Yg U3RyaW5nOjpmb3JtYXQgd2l0aCBtb3JlIHR5cGUtc2FmZSBhbHRlcm5hdGl2ZXMKSW5kZXg6IFNv dXJjZS9XZWJLaXQvU2hhcmVkL1JlbW90ZUxheWVyVHJlZS9SZW1vdGVMYXllclRyZWVQcm9wZXJ0 eUFwcGxpZXIubW0KPT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PQotLS0gU291cmNlL1dlYktpdC9TaGFyZWQvUmVtb3RlTGF5 ZXJUcmVlL1JlbW90ZUxheWVyVHJlZVByb3BlcnR5QXBwbGllci5tbQkocmV2aXNpb24gMjQwNDA3 KQorKysgU291cmNlL1dlYktpdC9TaGFyZWQvUmVtb3RlTGF5ZXJUcmVlL1JlbW90ZUxheWVyVHJl ZVByb3BlcnR5QXBwbGllci5tbQkod29ya2luZyBjb3B5KQpAQCAtMjc3LDcgKzI3NywxMSBAQCB2 b2lkIFJlbW90ZUxheWVyVHJlZVByb3BlcnR5QXBwbGllcjo6dXBkCiAgICAgYXV0byBoYXNWaWV3 Q2hpbGRyZW4gPSBbJl0gewogICAgICAgICBpZiAobm9kZS51aVZpZXcoKSAmJiBbW25vZGUudWlW aWV3KCkgc3Vidmlld3NdIGNvdW50XSkKICAgICAgICAgICAgIHJldHVybiB0cnVlOwotICAgICAg ICByZXR1cm4gIXByb3BlcnRpZXMuY2hpbGRyZW4uaXNFbXB0eSgpICYmIHJlbGF0ZWRMYXllcnMu Z2V0KHByb3BlcnRpZXMuY2hpbGRyZW4uZmlyc3QoKSktPnVpVmlldygpOworICAgICAgICBpZiAo cHJvcGVydGllcy5jaGlsZHJlbi5pc0VtcHR5KCkpCisgICAgICAgICAgICByZXR1cm4gZmFsc2U7 CisgICAgICAgIGF1dG8qIGNoaWxkTm9kZSA9IHJlbGF0ZWRMYXllcnMuZ2V0KHByb3BlcnRpZXMu Y2hpbGRyZW4uZmlyc3QoKSk7CisgICAgICAgIEFTU0VSVChjaGlsZE5vZGUpOworICAgICAgICBy ZXR1cm4gY2hpbGROb2RlICYmIGNoaWxkTm9kZS0+dWlWaWV3KCk7CiAgICAgfTsKIAogICAgIGF1 dG8gY29udGVudFZpZXcgPSBbJl0gewpAQCAtMjk1LDYgKzI5OSw5IEBAIHZvaWQgUmVtb3RlTGF5 ZXJUcmVlUHJvcGVydHlBcHBsaWVyOjp1cGQKICAgICAgICAgUmV0YWluUHRyPE5TTXV0YWJsZUFy cmF5PiBzdWJ2aWV3cyA9IGFkb3B0TlMoW1tOU011dGFibGVBcnJheSBhbGxvY10gaW5pdFdpdGhD YXBhY2l0eTpwcm9wZXJ0aWVzLmNoaWxkcmVuLnNpemUoKV0pOwogICAgICAgICBmb3IgKGF1dG8m IGNoaWxkIDogcHJvcGVydGllcy5jaGlsZHJlbikgewogICAgICAgICAgICAgYXV0byogY2hpbGRO b2RlID0gcmVsYXRlZExheWVycy5nZXQoY2hpbGQpOworICAgICAgICAgICAgQVNTRVJUKGNoaWxk Tm9kZSk7CisgICAgICAgICAgICBpZiAoIWNoaWxkTm9kZSkKKyAgICAgICAgICAgICAgICBjb250 aW51ZTsKICAgICAgICAgICAgIEFTU0VSVChjaGlsZE5vZGUtPnVpVmlldygpKTsKICAgICAgICAg ICAgIFtzdWJ2aWV3cyBhZGRPYmplY3Q6Y2hpbGROb2RlLT51aVZpZXcoKV07CiAgICAgICAgIH0K QEAgLTMwNyw2ICszMTQsOSBAQCB2b2lkIFJlbW90ZUxheWVyVHJlZVByb3BlcnR5QXBwbGllcjo6 dXBkCiAgICAgUmV0YWluUHRyPE5TTXV0YWJsZUFycmF5PiBzdWJsYXllcnMgPSBhZG9wdE5TKFtb TlNNdXRhYmxlQXJyYXkgYWxsb2NdIGluaXRXaXRoQ2FwYWNpdHk6cHJvcGVydGllcy5jaGlsZHJl bi5zaXplKCldKTsKICAgICBmb3IgKGF1dG8mIGNoaWxkIDogcHJvcGVydGllcy5jaGlsZHJlbikg ewogICAgICAgICBhdXRvKiBjaGlsZE5vZGUgPSByZWxhdGVkTGF5ZXJzLmdldChjaGlsZCk7Cisg ICAgICAgIEFTU0VSVChjaGlsZE5vZGUpOworICAgICAgICBpZiAoIWNoaWxkTm9kZSkKKyAgICAg ICAgICAgIGNvbnRpbnVlOwogI2lmIFBMQVRGT1JNKElPU19GQU1JTFkpCiAgICAgICAgIEFTU0VS VCghY2hpbGROb2RlLT51aVZpZXcoKSk7CiAjZW5kaWYK 360327 2019-01-28 01:43:09 -0800 2019-01-30 10:44:30 -0800 patch applyProperties-crash-2.patch text/plain 3132 koivisto SW5kZXg6IFNvdXJjZS9XZWJLaXQvQ2hhbmdlTG9nCj09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT0KLS0tIFNvdXJjZS9XZWJL aXQvQ2hhbmdlTG9nCShyZXZpc2lvbiAyNDA1NTgpCisrKyBTb3VyY2UvV2ViS2l0L0NoYW5nZUxv Zwkod29ya2luZyBjb3B5KQpAQCAtMSwzICsxLDE5IEBACisyMDE5LTAxLTI4ICBBbnR0aSBLb2l2 aXN0byAgPGFudHRpQGFwcGxlLmNvbT4KKworICAgICAgICBDcmFzaCBpbiBXZWJLaXQ6OlJlbW90 ZUxheWVyVHJlZVByb3BlcnR5QXBwbGllcjo6dXBkYXRlQ2hpbGRyZW4KKyAgICAgICAgaHR0cHM6 Ly9idWdzLndlYmtpdC5vcmcvc2hvd19idWcuY2dpP2lkPTE5Mzg5NworICAgICAgICA8cmRhcjov L3Byb2JsZW0vNDc0Mjc3NTA+CisKKyAgICAgICAgUmV2aWV3ZWQgYnkgTk9CT0RZIChPT1BTISku CisKKyAgICAgICAgVGhlcmUgaGFzIGJlZW4gc29tZSBudWxsIHBvaW50ZXIgY3Jhc2hlcyB3aGVy ZSB3ZSBmYWlsIHRvIGZpbmQgYSByZW1vdGUgbGF5ZXIgdHJlZSBub2RlIHRoYXQgbWF0Y2hlcwor ICAgICAgICB0aGUgdHJhbnNhY3Rpb24gcHJvcGVydGllcy4KKworICAgICAgICAqIFNoYXJlZC9S ZW1vdGVMYXllclRyZWUvUmVtb3RlTGF5ZXJUcmVlUHJvcGVydHlBcHBsaWVyLm1tOgorICAgICAg ICAoV2ViS2l0OjpSZW1vdGVMYXllclRyZWVQcm9wZXJ0eUFwcGxpZXI6OnVwZGF0ZUNoaWxkcmVu KToKKworICAgICAgICBOdWxsIGNoZWNrIHRoZSBub2Rlcy4KKwogMjAxOC0xMi0xNSAgRGFyaW4g QWRsZXIgIDxkYXJpbkBhcHBsZS5jb20+CiAKICAgICAgICAgUmVwbGFjZSBtYW55IHVzZXMgb2Yg U3RyaW5nOjpmb3JtYXQgd2l0aCBtb3JlIHR5cGUtc2FmZSBhbHRlcm5hdGl2ZXMKSW5kZXg6IFNv dXJjZS9XZWJLaXQvU2hhcmVkL1JlbW90ZUxheWVyVHJlZS9SZW1vdGVMYXllclRyZWVQcm9wZXJ0 eUFwcGxpZXIubW0KPT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PQotLS0gU291cmNlL1dlYktpdC9TaGFyZWQvUmVtb3RlTGF5 ZXJUcmVlL1JlbW90ZUxheWVyVHJlZVByb3BlcnR5QXBwbGllci5tbQkocmV2aXNpb24gMjQwNDA3 KQorKysgU291cmNlL1dlYktpdC9TaGFyZWQvUmVtb3RlTGF5ZXJUcmVlL1JlbW90ZUxheWVyVHJl ZVByb3BlcnR5QXBwbGllci5tbQkod29ya2luZyBjb3B5KQpAQCAtMjc3LDcgKzI3NywxMSBAQCB2 b2lkIFJlbW90ZUxheWVyVHJlZVByb3BlcnR5QXBwbGllcjo6dXBkCiAgICAgYXV0byBoYXNWaWV3 Q2hpbGRyZW4gPSBbJl0gewogICAgICAgICBpZiAobm9kZS51aVZpZXcoKSAmJiBbW25vZGUudWlW aWV3KCkgc3Vidmlld3NdIGNvdW50XSkKICAgICAgICAgICAgIHJldHVybiB0cnVlOwotICAgICAg ICByZXR1cm4gIXByb3BlcnRpZXMuY2hpbGRyZW4uaXNFbXB0eSgpICYmIHJlbGF0ZWRMYXllcnMu Z2V0KHByb3BlcnRpZXMuY2hpbGRyZW4uZmlyc3QoKSktPnVpVmlldygpOworICAgICAgICBpZiAo cHJvcGVydGllcy5jaGlsZHJlbi5pc0VtcHR5KCkpCisgICAgICAgICAgICByZXR1cm4gZmFsc2U7 CisgICAgICAgIGF1dG8qIGNoaWxkTm9kZSA9IHJlbGF0ZWRMYXllcnMuZ2V0KHByb3BlcnRpZXMu Y2hpbGRyZW4uZmlyc3QoKSk7CisgICAgICAgIEFTU0VSVChjaGlsZE5vZGUpOworICAgICAgICBy ZXR1cm4gY2hpbGROb2RlICYmIGNoaWxkTm9kZS0+dWlWaWV3KCk7CiAgICAgfTsKIAogICAgIGF1 dG8gY29udGVudFZpZXcgPSBbJl0gewpAQCAtMjk1LDYgKzI5OSw5IEBAIHZvaWQgUmVtb3RlTGF5 ZXJUcmVlUHJvcGVydHlBcHBsaWVyOjp1cGQKICAgICAgICAgUmV0YWluUHRyPE5TTXV0YWJsZUFy cmF5PiBzdWJ2aWV3cyA9IGFkb3B0TlMoW1tOU011dGFibGVBcnJheSBhbGxvY10gaW5pdFdpdGhD YXBhY2l0eTpwcm9wZXJ0aWVzLmNoaWxkcmVuLnNpemUoKV0pOwogICAgICAgICBmb3IgKGF1dG8m IGNoaWxkIDogcHJvcGVydGllcy5jaGlsZHJlbikgewogICAgICAgICAgICAgYXV0byogY2hpbGRO b2RlID0gcmVsYXRlZExheWVycy5nZXQoY2hpbGQpOworICAgICAgICAgICAgQVNTRVJUKGNoaWxk Tm9kZSk7CisgICAgICAgICAgICBpZiAoIWNoaWxkTm9kZSkKKyAgICAgICAgICAgICAgICBjb250 aW51ZTsKICAgICAgICAgICAgIEFTU0VSVChjaGlsZE5vZGUtPnVpVmlldygpKTsKICAgICAgICAg ICAgIFtzdWJ2aWV3cyBhZGRPYmplY3Q6Y2hpbGROb2RlLT51aVZpZXcoKV07CiAgICAgICAgIH0K QEAgLTMwNyw2ICszMTQsOSBAQCB2b2lkIFJlbW90ZUxheWVyVHJlZVByb3BlcnR5QXBwbGllcjo6 dXBkCiAgICAgUmV0YWluUHRyPE5TTXV0YWJsZUFycmF5PiBzdWJsYXllcnMgPSBhZG9wdE5TKFtb TlNNdXRhYmxlQXJyYXkgYWxsb2NdIGluaXRXaXRoQ2FwYWNpdHk6cHJvcGVydGllcy5jaGlsZHJl bi5zaXplKCldKTsKICAgICBmb3IgKGF1dG8mIGNoaWxkIDogcHJvcGVydGllcy5jaGlsZHJlbikg ewogICAgICAgICBhdXRvKiBjaGlsZE5vZGUgPSByZWxhdGVkTGF5ZXJzLmdldChjaGlsZCk7Cisg ICAgICAgIEFTU0VSVChjaGlsZE5vZGUpOworICAgICAgICBpZiAoIWNoaWxkTm9kZSkKKyAgICAg ICAgICAgIGNvbnRpbnVlOwogI2lmIFBMQVRGT1JNKElPU19GQU1JTFkpCiAgICAgICAgIEFTU0VS VCghY2hpbGROb2RlLT51aVZpZXcoKSk7CiAjZW5kaWYKQEAgLTMzOSw3ICszNDksMTEgQEAgdm9p ZCBSZW1vdGVMYXllclRyZWVQcm9wZXJ0eUFwcGxpZXI6OnVwZAogICAgICAgICByZXR1cm47CiAg ICAgfQogCi0gICAgQ0FMYXllciAqbWFza0xheWVyID0gcmVsYXRlZExheWVycy5nZXQocHJvcGVy dGllcy5tYXNrTGF5ZXJJRCktPmxheWVyKCk7CisgICAgYXV0byogbWFza05vZGUgPSByZWxhdGVk TGF5ZXJzLmdldChwcm9wZXJ0aWVzLm1hc2tMYXllcklEKTsKKyAgICBBU1NFUlQobWFza05vZGUp OworICAgIGlmICghbWFza05vZGUpCisgICAgICAgIHJldHVybjsKKyAgICBDQUxheWVyICptYXNr TGF5ZXIgPSBtYXNrTm9kZS0+bGF5ZXIoKTsKICAgICBBU1NFUlQoIW1hc2tMYXllci5zdXBlcmxh eWVyKTsKICAgICBpZiAobWFza0xheWVyLnN1cGVybGF5ZXIpCiAgICAgICAgIHJldHVybjsK