194871 2019-02-20 14:24:21 -0800 Crash in DOMWindowExtension::suspendForPageCache 2019-02-20 16:06:31 -0800 1 1 1 Unclassified WebKit DOM WebKit Nightly Build Unspecified Unspecified RESOLVED FIXED InRadar P2 Normal --- 1 rniwa rniwa beidson cdumez ggaren oldest_to_newest 1508248 0 rniwa 2019-02-20 14:24:21 -0800 e.g. Thread 0 Crashed:: Dispatch queue: com.apple.main-thread 0 com.apple.WebCore 0x00007fff47af3f3c WebCore::DOMWindowExtension::suspendForPageCache() + 28 1 com.apple.WebCore 0x00007fff46967fe9 WebCore::DOMWindow::suspendForPageCache() + 233 2 com.apple.WebCore 0x00007fff47861a68 WebCore::CachedFrame::CachedFrame(WebCore::Frame&) + 504 3 com.apple.WebCore 0x00007fff47863869 WebCore::PageCache::addIfCacheable(WebCore::HistoryItem&, WebCore::Page*) + 457 4 com.apple.WebCore 0x00007fff4691a3c7 WebCore::FrameLoader::commitProvisionalLoad() + 263 5 com.apple.WebCore 0x00007fff46967b81 WebCore::DocumentLoader::commitLoad(char const*, int) + 81 6 com.apple.WebCore 0x00007fff47aca1b0 WTF::Function<void ()>::CallableWrapper<WebCore::CachedRawResource::didAddClient(WebCore::CachedResourceClient&)::$_0::operator()(WebCore::ResourceRequest&&)::'lambda'()>::call() + 80 7 com.apple.WebCore 0x00007fff47a559bb WTF::Function<void (WebCore::PolicyAction)>::CallableWrapper<WebCore::DocumentLoader::responseReceived(WebCore::ResourceResponse const&, WTF::CompletionHandler<void ()>&&)::$_7>::call(WebCore::PolicyAction) + 59 8 com.apple.WebKit 0x00007fff488666e9 WebKit::WebFrameLoaderClient::dispatchDecidePolicyForResponse(WebCore::ResourceResponse const&, WebCore::ResourceRequest const&, WTF::Function<void (WebCore::PolicyAction)>&&) + 121 9 com.apple.WebCore 0x00007fff47a4cdd8 WebCore::DocumentLoader::responseReceived(WebCore::ResourceResponse const&, WTF::CompletionHandler<void ()>&&) + 1992 10 com.apple.WebCore 0x00007fff47aca02e WTF::Function<void (WebCore::ResourceRequest&&)>::CallableWrapper<WebCore::CachedRawResource::didAddClient(WebCore::CachedResourceClient&)::$_0>::call(WebCore::ResourceRequest&&) + 350 11 com.apple.WebCore 0x00007fff47abe328 WebCore::iterateRedirects(WebCore::CachedResourceHandle<WebCore::CachedRawResource>&&, WebCore::CachedRawResourceClient&, WTF::Vector<std::__1::pair<WebCore::ResourceRequest, WebCore::ResourceResponse>, 0ul, WTF::CrashOnOverflow, 16ul>&&, WTF::CompletionHandler<void (WebCore::ResourceRequest&&)>&&) + 1448 12 com.apple.WebCore 0x00007fff47abd9b1 WebCore::CachedRawResource::didAddClient(WebCore::CachedResourceClient&) + 657 13 com.apple.WebCore 0x00007fff4690f398 WebCore::ThreadTimers::sharedTimerFiredInternal() + 168 14 com.apple.WebCore 0x00007fff4690f2df WebCore::timerFired(__CFRunLoopTimer*, void*) + 31 <rdar://problem/47380794> 1508252 1 rniwa 2019-02-20 14:25:15 -0800 We're also seeing crashes in DOMWindowExtension::willDestroyGlobalObjectInCachedFrame() e.g. Thread 0 Crashed:: Dispatch queue: com.apple.main-thread 0 com.apple.WebCore 0x00007fff52579040 WebCore::DOMWindowExtension::willDestroyGlobalObjectInCachedFrame() + 16 1 com.apple.WebCore 0x00007fff514da36a WebCore::DOMWindow::willDestroyCachedFrame() + 234 2 com.apple.WebCore 0x00007fff514da185 WebCore::CachedFrame::destroy() + 37 3 com.apple.WebCore 0x00007fff522e84d4 WebCore::PageCache::prune(WebCore::PruningReason) + 100 4 com.apple.WebCore 0x00007fff522e8458 WebCore::PageCache::pruneToSizeNow(unsigned int, WebCore::PruningReason) + 24 5 com.apple.WebKit 0x00007fff52fc5a98 IPC::Connection::dispatchMessage(std::__1::unique_ptr<IPC::Decoder, std::__1::default_delete<IPC::Decoder> >) + 108 6 com.apple.WebKit 0x00007fff52fc924b IPC::Connection::dispatchOneIncomingMessage() + 181 7 com.apple.JavaScriptCore 0x00007fff47874734 WTF::RunLoop::performWork() + 228 8 com.apple.JavaScriptCore 0x00007fff478749c2 WTF::RunLoop::performWork(void*) + 34 9 com.apple.CoreFoundation 0x00007fff443526a3 __CFRUNLOOP_IS_CALLING_OUT_TO_A_SOURCE0_PERFORM_FUNCTION__ + 17 10 com.apple.CoreFoundation 0x00007fff44352649 __CFRunLoopDoSource0 + 108 11 com.apple.CoreFoundation 0x00007fff44335ffb __CFRunLoopDoSources0 + 195 12 com.apple.CoreFoundation 0x00007fff443355c5 __CFRunLoopRun + 1189 13 com.apple.CoreFoundation 0x00007fff44334ece CFRunLoopRunSpecific + 455 14 com.apple.Foundation 0x00007fff4664da9f -[NSRunLoop(NSRunLoop) runMode:beforeDate:] + 280 15 com.apple.Foundation 0x00007fff4664d974 -[NSRunLoop(NSRunLoop) run] + 76 16 libxpc.dylib 0x00007fff709ec1d7 _xpc_objc_main + 552 17 libxpc.dylib 0x00007fff709ebcd9 xpc_main + 433 18 com.apple.WebKit.WebContent 0x1013b26e2 WebKit::XPCServiceMain(int, char const**) + 547 (/BuildRoot/Library/Caches/com.apple.xbs/Sources/WebKit2/WebKit2-7607.1.30/Shared/EntryPointUtilities/mac/XPCService/XPCServiceMain.mm:157) 19 com.apple.WebKit.WebContent 0x1013b2867 main + 9 (/BuildRoot/Library/Caches/com.apple.xbs/Sources/WebKit2/WebKit2-7607.1.30/Shared/EntryPointUtilities/mac/XPCService/XPCServiceMain.mm:165) 20 libdyld.dylib 0x00007fff707b93ed start + 1 1508256 2 rniwa 2019-02-20 14:28:03 -0800 I suspect what might be happening here is that DOMWindowExtension is getting removed / unregistered inside the client delegate callbacks in dispatchWillDisconnectDOMWindowExtensionFromGlobalObject and dispatchWillDestroyGlobalObjectForDOMWindowExtension. In DOMWindow::willDestroyCachedFrame, for example, there is a comment about how this may happen: // It is necessary to copy m_properties to a separate vector because the DOMWindowProperties may // unregister themselves from the DOMWindow as a result of the call to willDestroyGlobalObjectInFrame. I think what we didn't account is notifying one DOMWindowExtension removing another DOMWindowExtension. 1508281 3 362547 rniwa 2019-02-20 14:57:17 -0800 Created attachment 362547 Fix attempt 1508294 4 rniwa 2019-02-20 15:09:52 -0800 Waiting for EWS... 1508330 5 362547 rniwa 2019-02-20 16:06:29 -0800 Comment on attachment 362547 Fix attempt Clearing flags on attachment: 362547 Committed r241848: <https://trac.webkit.org/changeset/241848> 1508331 6 rniwa 2019-02-20 16:06:31 -0800 All reviewed patches have been landed. Closing bug. 362547 2019-02-20 14:57:17 -0800 2019-02-20 16:06:29 -0800 Fix attempt bug-194871-20190220145716.patch text/plain 4917 rniwa SW5kZXg6IFNvdXJjZS9XZWJDb3JlL0NoYW5nZUxvZwo9PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09Ci0tLSBTb3VyY2UvV2Vi Q29yZS9DaGFuZ2VMb2cJKHJldmlzaW9uIDI0MTg0MCkKKysrIFNvdXJjZS9XZWJDb3JlL0NoYW5n ZUxvZwkod29ya2luZyBjb3B5KQpAQCAtMSwzICsxLDI2IEBACisyMDE5LTAyLTIwICBSeW9zdWtl IE5pd2EgIDxybml3YUB3ZWJraXQub3JnPgorCisgICAgICAgIENyYXNoIGluIERPTVdpbmRvd0V4 dGVuc2lvbjo6c3VzcGVuZEZvclBhZ2VDYWNoZQorICAgICAgICBodHRwczovL2J1Z3Mud2Via2l0 Lm9yZy9zaG93X2J1Zy5jZ2k/aWQ9MTk0ODcxCisKKyAgICAgICAgUmV2aWV3ZWQgYnkgTk9CT0RZ IChPT1BTISkuCisKKyAgICAgICAgVGhpcyBpcyBhIHNwZWN1bGF0aXZlIGZpeCBmb3IgYSBjcmFz aCBpbiBET01XaW5kb3dFeHRlbnNpb246OnN1c3BlbmRGb3JQYWdlQ2FjaGUuCisKKyAgICAgICAg V2UgdGhpbmsgaXQncyBwb3NzaWJsZSBmb3IgRE9NV2luZG93RXh0ZW5zaW9uOjpzdXNwZW5kRm9y UGFnZUNhY2hlIG5vdGlmeWluZyB0aGUgY2xpZW50cyB2aWEKKyAgICAgICAgZGlzcGF0Y2hXaWxs RGlzY29ubmVjdERPTVdpbmRvd0V4dGVuc2lvbkZyb21HbG9iYWxPYmplY3QgdG8gcmVtb3ZlIG90 aGVyIERPTVdpbmRvd0V4dGVuc2lvbidzLgorICAgICAgICBDaGVjayB0aGF0IGVhY2ggRE9NV2lu ZG93UHJvcGVydHkgaXMgc3RpbGwgaW4gbV9wcm9wZXJ0aWVzIGJlZm9yZSBpbnZva2luZyBzdXNw ZW5kRm9yUGFnZUNhY2hlCisgICAgICAgIHRvIGF2b2lkIHRoZSBjcmFzaC4KKworICAgICAgICAq IHBhZ2UvRE9NV2luZG93LmNwcDoKKyAgICAgICAgKFdlYkNvcmU6OkRPTVdpbmRvdzo6d2lsbERl c3Ryb3lDYWNoZWRGcmFtZSk6CisgICAgICAgIChXZWJDb3JlOjpET01XaW5kb3c6OndpbGxEZXN0 cm95RG9jdW1lbnRJbkZyYW1lKToKKyAgICAgICAgKFdlYkNvcmU6OkRPTVdpbmRvdzo6d2lsbERl dGFjaERvY3VtZW50RnJvbUZyYW1lKToKKyAgICAgICAgKFdlYkNvcmU6OkRPTVdpbmRvdzo6c3Vz cGVuZEZvclBhZ2VDYWNoZSk6CisgICAgICAgIChXZWJDb3JlOjpET01XaW5kb3c6OnJlc3VtZUZy b21QYWdlQ2FjaGUpOgorICAgICAgICAqIHBhZ2UvRE9NV2luZG93RXh0ZW5zaW9uLmNwcDoKKyAg ICAgICAgKFdlYkNvcmU6OkRPTVdpbmRvd0V4dGVuc2lvbjo6c3VzcGVuZEZvclBhZ2VDYWNoZSk6 CisKIDIwMTktMDItMTggIEJhYmFrIFNoYWZpZWkgIDxic2hhZmllaUBhcHBsZS5jb20+CiAKICAg ICAgICAgQXBwbHkgcGF0Y2guIHJkYXI6Ly9wcm9ibGVtLzQ4MTIyNTUzCkluZGV4OiBTb3VyY2Uv V2ViQ29yZS9wYWdlL0RPTVdpbmRvdy5jcHAKPT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PQotLS0gU291cmNlL1dlYkNvcmUv cGFnZS9ET01XaW5kb3cuY3BwCShyZXZpc2lvbiAyNDE4MjkpCisrKyBTb3VyY2UvV2ViQ29yZS9w YWdlL0RPTVdpbmRvdy5jcHAJKHdvcmtpbmcgY29weSkKQEAgLTQ1NiwxNiArNDU2LDIwIEBAIHZv aWQgRE9NV2luZG93Ojp3aWxsRGVzdHJveUNhY2hlZEZyYW1lKCkKIHsKICAgICAvLyBJdCBpcyBu ZWNlc3NhcnkgdG8gY29weSBtX3Byb3BlcnRpZXMgdG8gYSBzZXBhcmF0ZSB2ZWN0b3IgYmVjYXVz ZSB0aGUgRE9NV2luZG93UHJvcGVydGllcyBtYXkKICAgICAvLyB1bnJlZ2lzdGVyIHRoZW1zZWx2 ZXMgZnJvbSB0aGUgRE9NV2luZG93IGFzIGEgcmVzdWx0IG9mIHRoZSBjYWxsIHRvIHdpbGxEZXN0 cm95R2xvYmFsT2JqZWN0SW5DYWNoZWRGcmFtZS4KLSAgICBmb3IgKGF1dG8mIHByb3BlcnR5IDog Y29weVRvVmVjdG9yKG1fcHJvcGVydGllcykpCi0gICAgICAgIHByb3BlcnR5LT53aWxsRGVzdHJv eUdsb2JhbE9iamVjdEluQ2FjaGVkRnJhbWUoKTsKKyAgICBmb3IgKGF1dG8qIHByb3BlcnR5IDog Y29weVRvVmVjdG9yKG1fcHJvcGVydGllcykpIHsKKyAgICAgICAgaWYgKG1fcHJvcGVydGllcy5j b250YWlucyhwcm9wZXJ0eSkpCisgICAgICAgICAgICBwcm9wZXJ0eS0+d2lsbERlc3Ryb3lHbG9i YWxPYmplY3RJbkNhY2hlZEZyYW1lKCk7CisgICAgfQogfQogCiB2b2lkIERPTVdpbmRvdzo6d2ls bERlc3Ryb3lEb2N1bWVudEluRnJhbWUoKQogewogICAgIC8vIEl0IGlzIG5lY2Vzc2FyeSB0byBj b3B5IG1fcHJvcGVydGllcyB0byBhIHNlcGFyYXRlIHZlY3RvciBiZWNhdXNlIHRoZSBET01XaW5k b3dQcm9wZXJ0aWVzIG1heQogICAgIC8vIHVucmVnaXN0ZXIgdGhlbXNlbHZlcyBmcm9tIHRoZSBE T01XaW5kb3cgYXMgYSByZXN1bHQgb2YgdGhlIGNhbGwgdG8gd2lsbERlc3Ryb3lHbG9iYWxPYmpl Y3RJbkZyYW1lLgotICAgIGZvciAoYXV0byYgcHJvcGVydHkgOiBjb3B5VG9WZWN0b3IobV9wcm9w ZXJ0aWVzKSkKLSAgICAgICAgcHJvcGVydHktPndpbGxEZXN0cm95R2xvYmFsT2JqZWN0SW5GcmFt ZSgpOworICAgIGZvciAoYXV0byogcHJvcGVydHkgOiBjb3B5VG9WZWN0b3IobV9wcm9wZXJ0aWVz KSkgeworICAgICAgICBpZiAobV9wcm9wZXJ0aWVzLmNvbnRhaW5zKHByb3BlcnR5KSkKKyAgICAg ICAgICAgIHByb3BlcnR5LT53aWxsRGVzdHJveUdsb2JhbE9iamVjdEluRnJhbWUoKTsKKyAgICB9 CiB9CiAKIHZvaWQgRE9NV2luZG93Ojp3aWxsRGV0YWNoRG9jdW1lbnRGcm9tRnJhbWUoKQpAQCAt NDc1LDggKzQ3OSwxMCBAQCB2b2lkIERPTVdpbmRvdzo6d2lsbERldGFjaERvY3VtZW50RnJvbUZy CiAKICAgICAvLyBJdCBpcyBuZWNlc3NhcnkgdG8gY29weSBtX3Byb3BlcnRpZXMgdG8gYSBzZXBh cmF0ZSB2ZWN0b3IgYmVjYXVzZSB0aGUgRE9NV2luZG93UHJvcGVydGllcyBtYXkKICAgICAvLyB1 bnJlZ2lzdGVyIHRoZW1zZWx2ZXMgZnJvbSB0aGUgRE9NV2luZG93IGFzIGEgcmVzdWx0IG9mIHRo ZSBjYWxsIHRvIHdpbGxEZXRhY2hHbG9iYWxPYmplY3RGcm9tRnJhbWUuCi0gICAgZm9yIChhdXRv JiBwcm9wZXJ0eSA6IGNvcHlUb1ZlY3RvcihtX3Byb3BlcnRpZXMpKQotICAgICAgICBwcm9wZXJ0 eS0+d2lsbERldGFjaEdsb2JhbE9iamVjdEZyb21GcmFtZSgpOworICAgIGZvciAoYXV0byYgcHJv cGVydHkgOiBjb3B5VG9WZWN0b3IobV9wcm9wZXJ0aWVzKSkgeworICAgICAgICBpZiAobV9wcm9w ZXJ0aWVzLmNvbnRhaW5zKHByb3BlcnR5KSkKKyAgICAgICAgICAgIHByb3BlcnR5LT53aWxsRGV0 YWNoR2xvYmFsT2JqZWN0RnJvbUZyYW1lKCk7CisgICAgfQogCiAgICAgaWYgKG1fcGVyZm9ybWFu Y2UpCiAgICAgICAgIG1fcGVyZm9ybWFuY2UtPmNsZWFyUmVzb3VyY2VUaW1pbmdzKCk7CkBAIC01 MjAsMTYgKzUyNiwyMCBAQCB2b2lkIERPTVdpbmRvdzo6cmVzZXRVbmxlc3NTdXNwZW5kZWRGb3JE CiAKIHZvaWQgRE9NV2luZG93OjpzdXNwZW5kRm9yUGFnZUNhY2hlKCkKIHsKLSAgICBmb3IgKGF1 dG8mIHByb3BlcnR5IDogY29weVRvVmVjdG9yKG1fcHJvcGVydGllcykpCi0gICAgICAgIHByb3Bl cnR5LT5zdXNwZW5kRm9yUGFnZUNhY2hlKCk7CisgICAgZm9yIChhdXRvKiBwcm9wZXJ0eSA6IGNv cHlUb1ZlY3RvcihtX3Byb3BlcnRpZXMpKSB7CisgICAgICAgIGlmIChtX3Byb3BlcnRpZXMuY29u dGFpbnMocHJvcGVydHkpKQorICAgICAgICAgICAgcHJvcGVydHktPnN1c3BlbmRGb3JQYWdlQ2Fj aGUoKTsKKyAgICB9CiAKICAgICBtX3N1c3BlbmRlZEZvckRvY3VtZW50U3VzcGVuc2lvbiA9IHRy dWU7CiB9CiAKIHZvaWQgRE9NV2luZG93OjpyZXN1bWVGcm9tUGFnZUNhY2hlKCkKIHsKLSAgICBm b3IgKGF1dG8mIHByb3BlcnR5IDogY29weVRvVmVjdG9yKG1fcHJvcGVydGllcykpCi0gICAgICAg IHByb3BlcnR5LT5yZXN1bWVGcm9tUGFnZUNhY2hlKCk7CisgICAgZm9yIChhdXRvKiBwcm9wZXJ0 eSA6IGNvcHlUb1ZlY3RvcihtX3Byb3BlcnRpZXMpKSB7CisgICAgICAgIGlmIChtX3Byb3BlcnRp ZXMuY29udGFpbnMocHJvcGVydHkpKQorICAgICAgICAgICAgcHJvcGVydHktPnJlc3VtZUZyb21Q YWdlQ2FjaGUoKTsKKyAgICB9CiAKICAgICBtX3N1c3BlbmRlZEZvckRvY3VtZW50U3VzcGVuc2lv biA9IGZhbHNlOwogfQpJbmRleDogU291cmNlL1dlYkNvcmUvcGFnZS9ET01XaW5kb3dFeHRlbnNp b24uY3BwCj09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT0KLS0tIFNvdXJjZS9XZWJDb3JlL3BhZ2UvRE9NV2luZG93RXh0ZW5z aW9uLmNwcAkocmV2aXNpb24gMjQxODI5KQorKysgU291cmNlL1dlYkNvcmUvcGFnZS9ET01XaW5k b3dFeHRlbnNpb24uY3BwCSh3b3JraW5nIGNvcHkpCkBAIC00OCwxMSArNDgsMTEgQEAgdm9pZCBE T01XaW5kb3dFeHRlbnNpb246OnN1c3BlbmRGb3JQYWdlQwogICAgIC8vIENhbGxpbmcgb3V0IHRv IHRoZSBjbGllbnQgbWlnaHQgcmVzdWx0IGluIHRoaXMgRE9NV2luZG93RXh0ZW5zaW9uIGJlaW5n IGRlc3Ryb3llZAogICAgIC8vIHdoaWxlIHRoZXJlIGlzIHN0aWxsIHdvcmsgdG8gZG8uCiAgICAg UmVmPERPTVdpbmRvd0V4dGVuc2lvbj4gcHJvdGVjdGVkVGhpcygqdGhpcyk7Ci0gICAgCi0gICAg RnJhbWUqIGZyYW1lID0gdGhpcy0+ZnJhbWUoKTsKKworICAgIGF1dG8gZnJhbWUgPSBtYWtlUmVm KCp0aGlzLT5mcmFtZSgpKTsKICAgICBmcmFtZS0+bG9hZGVyKCkuY2xpZW50KCkuZGlzcGF0Y2hX aWxsRGlzY29ubmVjdERPTVdpbmRvd0V4dGVuc2lvbkZyb21HbG9iYWxPYmplY3QodGhpcyk7CiAK LSAgICBtX2Rpc2Nvbm5lY3RlZEZyYW1lID0gZnJhbWU7CisgICAgbV9kaXNjb25uZWN0ZWRGcmFt ZSA9IFdURk1vdmUoZnJhbWUpOwogCiAgICAgRE9NV2luZG93UHJvcGVydHk6OnN1c3BlbmRGb3JQ YWdlQ2FjaGUoKTsKIH0K