199680 2019-07-10 12:45:23 -0700 Crash under IPC::Connection::waitForMessage() 2019-07-16 01:06:46 -0700 1 1 1 Unclassified WebKit WebKit2 WebKit Nightly Build Unspecified Unspecified RESOLVED FIXED https://bugs.webkit.org/show_bug.cgi?id=199205 InRadar P2 Normal --- 1 cdumez cdumez achristensen beidson commit-queue ggaren mcatanzaro thorton webkit-bug-importer wenson_hsieh oldest_to_newest 1551777 0 cdumez 2019-07-10 12:45:23 -0700 Crash under IPC::Connection::waitForMessage(): Thread[0] EXC_BAD_ACCESS (SIGSEGV) (KERN_INVALID_ADDRESS at 0x0000000000000030) [ 0] 0x00007fff44ccc8f4 WebKit`IPC::Connection::waitForMessage(IPC::StringReference, IPC::StringReference, unsigned long long, WTF::Seconds, WTF::OptionSet<IPC::WaitForOption>) [inlined] std::__1::unique_ptr<IPC::Decoder, std::__1::default_delete<IPC::Decoder> >::operator bool() const at memory:2637:19 0x00007fff44ccc8e2: cmpxchgb %r14b, (%r13) 0x00007fff44ccc8e7: jne 0x848b4 ; <+698> [inlined] WTF::Lock::lock() at __mutex_base:131 0x00007fff44ccc8e9: movq -0x30(%rbp), %rdx 0x00007fff44ccc8ed: movq 0xe8(%rdx), %rax -> 0x00007fff44ccc8f4: movq 0x30(%rax), %rcx 0x00007fff44ccc8f8: testq %rcx, %rcx 0x00007fff44ccc8fb: je 0x84913 ; <+793> at memory 0x00007fff44ccc8fd: movq $0x0, 0x30(%rax) 0x00007fff44ccc905: movq -0x40(%rbp), %rax [ 0] 0x00007fff44ccc8f4 WebKit`IPC::Connection::waitForMessage(IPC::StringReference, IPC::StringReference, unsigned long long, WTF::Seconds, WTF::OptionSet<IPC::WaitForOption>) + 762 at Connection.cpp:520 516 SyncMessageState::singleton().dispatchMessages(nullptr); 517 518 std::unique_lock<Lock> lock(m_waitForMessageMutex); 519 -> 520 if (m_waitingForMessage->decoder) { 521 auto decoder = WTFMove(m_waitingForMessage->decoder); 522 m_waitingForMessage = nullptr; 523 return decoder; 524 } [ 1] 0x00007fff44fa4141 WebKit`WebKit::TiledCoreAnimationDrawingAreaProxy::waitForDidUpdateActivityState(unsigned long long) [inlined] bool IPC::Connection::waitForAndDispatchImmediately<Messages::WebPageProxy::DidUpdateActivityState>(unsigned long long, WTF::Seconds, WTF::OptionSet<IPC::WaitForOption>) + 59 at Connection.h:543:40 539 } 540 541 template<typename T> bool Connection::waitForAndDispatchImmediately(uint64_t destinationID, Seconds timeout, OptionSet<WaitForOption> waitForOptions) 542 { -> 543 std::unique_ptr<Decoder> decoder = waitForMessage(T::receiverName(), T::name(), destinationID, timeout, waitForOptions); 544 if (!decoder) 545 return false; 546 547 ASSERT(decoder->destinationID() == destinationID); [ 1] 0x00007fff44fa4106 WebKit`WebKit::TiledCoreAnimationDrawingAreaProxy::waitForDidUpdateActivityState(unsigned long long) [inlined] bool IPC::Connection::waitForAndDispatchImmediately<Messages::WebPageProxy::DidUpdateActivityState, WebCore::PageIdentifierType>(WTF::ObjectIdentifier<WebCore::PageIdentifierType>, WTF::Seconds, WTF::OptionSet<IPC::WaitForOption>) at Connection.h:217 213 214 template<typename T, typename U> 215 bool waitForAndDispatchImmediately(ObjectIdentifier<U> destinationID, Seconds timeout, OptionSet<WaitForOption> waitForOptions = { }) 216 { -> 217 return waitForAndDispatchImmediately<T>(destinationID.toUInt64(), timeout, waitForOptions); 218 } 219 220 bool sendMessage(std::unique_ptr<Encoder>, OptionSet<SendOption> sendOptions); 221 void sendMessageWithReply(uint64_t requestID, std::unique_ptr<Encoder>, FunctionDispatcher& replyDispatcher, Function<void(std::unique_ptr<Decoder>)>&& replyHandler); [ 1] 0x00007fff44fa4106 WebKit`WebKit::TiledCoreAnimationDrawingAreaProxy::waitForDidUpdateActivityState(unsigned long long) + 30 at TiledCoreAnimationDrawingAreaProxy.mm:125 121 122 void TiledCoreAnimationDrawingAreaProxy::waitForDidUpdateActivityState(ActivityStateChangeID) 123 { 124 Seconds activityStateUpdateTimeout = Seconds::fromMilliseconds(250); -> 125 process().connection()->waitForAndDispatchImmediately<Messages::WebPageProxy::DidUpdateActivityState>(m_webPageProxy.pageID(), activityStateUpdateTimeout, IPC::WaitForOption::InterruptWaitingIfSyncMessageArrives); 126 } 127 128 void TiledCoreAnimationDrawingAreaProxy::willSendUpdateGeometry() 129 { [ 2] 0x00007fff44f2f8e8 WebKit`WebKit::WebPageProxy::dispatchActivityStateChange() [inlined] WebKit::WebPageProxy::waitForDidUpdateActivityState(unsigned long long) + 72 at WebPageProxy.cpp:1883:20 1879 #endif 1880 1881 m_waitingForDidUpdateActivityState = true; 1882 -> 1883 m_drawingArea->waitForDidUpdateActivityState(activityStateChangeID); 1884 } 1885 1886 IntSize WebPageProxy::viewSize() const 1887 { 1551779 1 cdumez 2019-07-10 12:45:37 -0700 <rdar://problem/52500561> 1551785 2 373858 cdumez 2019-07-10 12:53:12 -0700 Created attachment 373858 Patch 1551790 3 373858 thorton 2019-07-10 13:02:56 -0700 Comment on attachment 373858 Patch This will be ... interesting ... in the case of things that waitForAndDispatchImmediately with an infinite timeout, but ok. 1551796 4 373858 commit-queue 2019-07-10 13:10:55 -0700 Comment on attachment 373858 Patch Clearing flags on attachment: 373858 Committed r247322: <https://trac.webkit.org/changeset/247322> 1551797 5 commit-queue 2019-07-10 13:10:57 -0700 All reviewed patches have been landed. Closing bug. 1553145 6 cgarcia 2019-07-16 01:06:46 -0700 *** Bug 199205 has been marked as a duplicate of this bug. *** 373858 2019-07-10 12:53:12 -0700 2019-07-10 13:10:55 -0700 Patch bug-199680-20190710125311.patch text/plain 4427 cdumez U3VidmVyc2lvbiBSZXZpc2lvbjogMjQ3MzE0CmRpZmYgLS1naXQgYS9Tb3VyY2UvV2ViS2l0L0No YW5nZUxvZyBiL1NvdXJjZS9XZWJLaXQvQ2hhbmdlTG9nCmluZGV4IDcyZjYxYWQ5YTdkNDE5M2My NDM3NzlmYmFjYmIwM2E1NTgzMTg1ODQuLmM1MjcyNjU5ZGZjZmJjMWZiNDNhNmE0YjI1NWFkZDEy YjQ5YTQzYTkgMTAwNjQ0Ci0tLSBhL1NvdXJjZS9XZWJLaXQvQ2hhbmdlTG9nCisrKyBiL1NvdXJj ZS9XZWJLaXQvQ2hhbmdlTG9nCkBAIC0xLDMgKzEsMzMgQEAKKzIwMTktMDctMTAgIENocmlzIER1 bWV6ICA8Y2R1bWV6QGFwcGxlLmNvbT4KKworICAgICAgICBDcmFzaCB1bmRlciBJUEM6OkNvbm5l Y3Rpb246OndhaXRGb3JNZXNzYWdlKCkKKyAgICAgICAgaHR0cHM6Ly9idWdzLndlYmtpdC5vcmcv c2hvd19idWcuY2dpP2lkPTE5OTY4MAorICAgICAgICA8cmRhcjovL3Byb2JsZW0vNTI1MDA1NjE+ CisKKyAgICAgICAgUmV2aWV3ZWQgYnkgTk9CT0RZIChPT1BTISkuCisKKyAgICAgICAgSVBDOjpD b25uZWN0aW9uOjp3YWl0Rm9yTWVzc2FnZSgpIGlzIGNyYXNoaW5nIGR1ZSB0byBhIG51bGwgZGVm ZXJlcmVuY2Ugb2YKKyAgICAgICAgbV93YWl0aW5nRm9yTWVzc2FnZS4gU2luY2UgbV93YWl0aW5n Rm9yTWVzc2FnZSBpcyBvbmx5IGV2ZXIgc2V0IHRvIG51bGwgaW4KKyAgICAgICAgd2FpdEZvck1l c3NhZ2UoKSwgdGhpcyBzZWVtcyB0byBpbXBseSB3ZSd2ZSByZS1lbnRlcmVkIHdhaXRGb3JNZXNz YWdlKCkuCisgICAgICAgIFRoaXMgaXMgaW4gdGhlb3J5IHBvc3NpYmxlIHNpbmNlIHRoZSBsb29w IGluc2lkZSB3YWl0Rm9yTWVzc2FnZSgpIGNhbGxzCisgICAgICAgIFN5bmNNZXNzYWdlU3RhdGU6 OnNpbmdsZXRvbigpLmRpc3BhdGNoTWVzc2FnZXMoKSBvbiBldmVyeSBpdGVyYXRpb24gdG8KKyAg ICAgICAgcHJvY2VzcyBpbmNvbWluZyBzeW5jaHJvbm91cyBJUEMgbWVzc2FnZXMuIEluIHRoZW9y eSwgb25lIG9mIHRoZXNlIHN5bmMKKyAgICAgICAgSVBDIG1lc3NhZ2VzIGNvdWxkIHJ1biBjb2Rl IHdoaWNoIGVuZHMgdXAgY2FsbGluZyB3YWl0Rm9yQW5kRGlzcGF0Y2hJbW1lZGlhdGVseSgpCisg ICAgICAgIChhbmQgdGh1cyB3YWl0Rm9yTWVzc2FnZSgpKS4KKworICAgICAgICBXZSBoYWQgYSBk ZWJ1ZyBhc3NlcnRpb24gdG8gdHJ5IGFuZCBjYXRjaCByZS1lbnRyYW5jeSB3aXRoIGEgY29tbWVu dCBzdGF0aW5nCisgICAgICAgICJXZSBkb24ndCBzdXBwb3J0IGhhdmluZyBtdWx0aXBsZSBjbGll bnRzIHdhaXRpbmcgZm9yIG1lc3NhZ2VzLiIgYnV0IHdlCisgICAgICAgIHdvdWxkIG5vdCBzZWUg dGhvc2UgaW4gcmVsZWFzZSBhbmQgd2Ugd291bGQgY3Jhc2ggd2l0aCBhIG51bGwgZGVyZWZlcmVu Y2UKKyAgICAgICAgaW5zdGVhZC4KKworICAgICAgICBUbyBhZGRyZXNzIHRoZSBjcmFzaGVzIGlu IHJlbGVhc2UsIHJldHVybiBlYXJseSBpbiBjYXNlIG9mIHJlLWVudHJhbmN5CisgICAgICAgICh3 ZSB3b3VsZCBzdGlsbCBoaXQgYW4gYXNzZXJ0aW9uIGluIGRlYnVnKS4KKworICAgICAgICAqIFBs YXRmb3JtL0lQQy9Db25uZWN0aW9uLmNwcDoKKyAgICAgICAgKElQQzo6Q29ubmVjdGlvbjo6Q29u bmVjdGlvbik6CisgICAgICAgIChJUEM6OkNvbm5lY3Rpb246OndhaXRGb3JNZXNzYWdlKToKKyAg ICAgICAgKiBQbGF0Zm9ybS9JUEMvQ29ubmVjdGlvbi5oOgorCiAyMDE5LTA3LTEwICBZb3Vlbm4g RmFibGV0ICA8eW91ZW5uQGFwcGxlLmNvbT4KIAogICAgICAgICBEaXNhYmxlIHNwZWN1bGF0aXZl IGxvYWRpbmcgaWYgY2FjaGUgaXMgbm90IHRvIGJlIHVzZWQgZm9yIHRoZSBsb2FkCmRpZmYgLS1n aXQgYS9Tb3VyY2UvV2ViS2l0L1BsYXRmb3JtL0lQQy9Db25uZWN0aW9uLmNwcCBiL1NvdXJjZS9X ZWJLaXQvUGxhdGZvcm0vSVBDL0Nvbm5lY3Rpb24uY3BwCmluZGV4IDkyMWE2MjIyOGJkODBkZGY1 N2YwZDc5NzY4NDIyNTlmMDEzYzdlYTYuLjJkMDQwM2M2OTcwZGMxYmY0Y2ExZWE1NzcyZjk4ZTc4 MDlkNGU1NjUgMTAwNjQ0Ci0tLSBhL1NvdXJjZS9XZWJLaXQvUGxhdGZvcm0vSVBDL0Nvbm5lY3Rp b24uY3BwCisrKyBiL1NvdXJjZS9XZWJLaXQvUGxhdGZvcm0vSVBDL0Nvbm5lY3Rpb24uY3BwCkBA IC0yNjAsNyArMjYwLDYgQEAgQ29ubmVjdGlvbjo6Q29ubmVjdGlvbihJZGVudGlmaWVyIGlkZW50 aWZpZXIsIGJvb2wgaXNTZXJ2ZXIsIENsaWVudCYgY2xpZW50KQogICAgICwgbV9pbkRpc3BhdGNo TWVzc2FnZUNvdW50KDApCiAgICAgLCBtX2luRGlzcGF0Y2hNZXNzYWdlTWFya2VkRGlzcGF0Y2hX aGVuV2FpdGluZ0ZvclN5bmNSZXBseUNvdW50KDApCiAgICAgLCBtX2RpZFJlY2VpdmVJbnZhbGlk TWVzc2FnZShmYWxzZSkKLSAgICAsIG1fd2FpdGluZ0Zvck1lc3NhZ2UobnVsbHB0cikKICAgICAs IG1fc2hvdWxkV2FpdEZvclN5bmNSZXBsaWVzKHRydWUpCiB7CiAgICAgQVNTRVJUKFJ1bkxvb3A6 OmlzTWFpbigpKTsKQEAgLTQ2OCw2ICs0NjcsNyBAQCBTZWNvbmRzIENvbm5lY3Rpb246OnRpbWVv dXRSZXNwZWN0aW5nSWdub3JlVGltZW91dHNGb3JUZXN0aW5nKFNlY29uZHMgdGltZW91dCkgYwog c3RkOjp1bmlxdWVfcHRyPERlY29kZXI+IENvbm5lY3Rpb246OndhaXRGb3JNZXNzYWdlKFN0cmlu Z1JlZmVyZW5jZSBtZXNzYWdlUmVjZWl2ZXJOYW1lLCBTdHJpbmdSZWZlcmVuY2UgbWVzc2FnZU5h bWUsIHVpbnQ2NF90IGRlc3RpbmF0aW9uSUQsIFNlY29uZHMgdGltZW91dCwgT3B0aW9uU2V0PFdh aXRGb3JPcHRpb24+IHdhaXRGb3JPcHRpb25zKQogewogICAgIEFTU0VSVChSdW5Mb29wOjppc01h aW4oKSk7CisgICAgYXV0byBwcm90ZWN0ZWRUaGlzID0gbWFrZVJlZigqdGhpcyk7CiAKICAgICB0 aW1lb3V0ID0gdGltZW91dFJlc3BlY3RpbmdJZ25vcmVUaW1lb3V0c0ZvclRlc3RpbmcodGltZW91 dCk7CiAKQEAgLTQ5NCw3ICs0OTQsMTEgQEAgc3RkOjp1bmlxdWVfcHRyPERlY29kZXI+IENvbm5l Y3Rpb246OndhaXRGb3JNZXNzYWdlKFN0cmluZ1JlZmVyZW5jZSBtZXNzYWdlUmVjZWkKIAogICAg IC8vIERvbid0IGV2ZW4gc3RhcnQgd2FpdGluZyBpZiB3ZSBoYXZlIEludGVycnVwdFdhaXRpbmdJ ZlN5bmNNZXNzYWdlQXJyaXZlcyBhbmQgdGhlcmUncyBhIHN5bmMgbWVzc2FnZSBhbHJlYWR5IGlu IHRoZSBxdWV1ZS4KICAgICBpZiAoaGFzSW5jb21pbmdTeW5jaHJvbm91c01lc3NhZ2UgJiYgd2Fp dEZvck9wdGlvbnMuY29udGFpbnMoV2FpdEZvck9wdGlvbjo6SW50ZXJydXB0V2FpdGluZ0lmU3lu Y01lc3NhZ2VBcnJpdmVzKSkgewotICAgICAgICBtX3dhaXRpbmdGb3JNZXNzYWdlID0gbnVsbHB0 cjsKKyNpZiAhQVNTRVJUX0RJU0FCTEVECisgICAgICAgIHN0ZDo6bG9ja19ndWFyZDxMb2NrPiBs b2NrKG1fd2FpdEZvck1lc3NhZ2VNdXRleCk7CisgICAgICAgIC8vIFdlIGRvbid0IHN1cHBvcnQg aGF2aW5nIG11bHRpcGxlIGNsaWVudHMgd2FpdGluZyBmb3IgbWVzc2FnZXMuCisgICAgICAgIEFT U0VSVCghbV93YWl0aW5nRm9yTWVzc2FnZSk7CisjZW5kaWYKICAgICAgICAgcmV0dXJuIG51bGxw dHI7CiAgICAgfQogCkBAIC01MDUsNiArNTA5LDggQEAgc3RkOjp1bmlxdWVfcHRyPERlY29kZXI+ IENvbm5lY3Rpb246OndhaXRGb3JNZXNzYWdlKFN0cmluZ1JlZmVyZW5jZSBtZXNzYWdlUmVjZWkK IAogICAgICAgICAvLyBXZSBkb24ndCBzdXBwb3J0IGhhdmluZyBtdWx0aXBsZSBjbGllbnRzIHdh aXRpbmcgZm9yIG1lc3NhZ2VzLgogICAgICAgICBBU1NFUlQoIW1fd2FpdGluZ0Zvck1lc3NhZ2Up OworICAgICAgICBpZiAobV93YWl0aW5nRm9yTWVzc2FnZSkKKyAgICAgICAgICAgIHJldHVybiBu dWxscHRyOwogCiAgICAgICAgIG1fd2FpdGluZ0Zvck1lc3NhZ2UgPSAmd2FpdGluZ0Zvck1lc3Nh Z2U7CiAgICAgfQpkaWZmIC0tZ2l0IGEvU291cmNlL1dlYktpdC9QbGF0Zm9ybS9JUEMvQ29ubmVj dGlvbi5oIGIvU291cmNlL1dlYktpdC9QbGF0Zm9ybS9JUEMvQ29ubmVjdGlvbi5oCmluZGV4IDRk ZTA2ODdhYjUzMjc5MmFhMzRkZDdkOWVlM2NkMzZkNTU3YWY2ZjQuLmQ3ZTFkMjhmYTc1YzM0Zjc0 NWU2MjAzN2Y4ODljYzQ0MzM4ZWU5NjUgMTAwNjQ0Ci0tLSBhL1NvdXJjZS9XZWJLaXQvUGxhdGZv cm0vSVBDL0Nvbm5lY3Rpb24uaAorKysgYi9Tb3VyY2UvV2ViS2l0L1BsYXRmb3JtL0lQQy9Db25u ZWN0aW9uLmgKQEAgLTM1Myw3ICszNTMsNyBAQCBwcml2YXRlOgogICAgIEhhc2hNYXA8dWludDY0 X3QsIFJlcGx5SGFuZGxlcj4gbV9yZXBseUhhbmRsZXJzOwogCiAgICAgc3RydWN0IFdhaXRGb3JN ZXNzYWdlU3RhdGU7Ci0gICAgV2FpdEZvck1lc3NhZ2VTdGF0ZSogbV93YWl0aW5nRm9yTWVzc2Fn ZTsKKyAgICBXYWl0Rm9yTWVzc2FnZVN0YXRlKiBtX3dhaXRpbmdGb3JNZXNzYWdlIHsgbnVsbHB0 ciB9OwogCiAgICAgY2xhc3MgU3luY01lc3NhZ2VTdGF0ZTsKIAo=