144401 2015-04-29 11:18:28 -0700 Use-after-free when invalidating WKPageForceRepaint callback 2015-04-29 12:56:54 -0700 1 1 1 Unclassified WebKit Tools / Tests 528+ (Nightly build) Unspecified Unspecified RESOLVED FIXED InRadar P2 Normal --- 1 ap ap commit-queue thorton oldest_to_newest 1090083 0 ap 2015-04-29 11:18:28 -0700 This happens on bots frequently: Thread 0 Crashed:: Dispatch queue: com.apple.main-thread 0 WebKitTestRunner 0x0000000102be0e14 0x102bd4000 + 52756 1 com.apple.WebKit 0x0000000103654023 std::__1::__function::__func<WKPageForceRepaint::$_1, std::__1::allocator<WKPageForceRepaint::$_1>, void (WebKit::CallbackBase::Error)>::operator()(WebKit::CallbackBase::Error&&) + 53 2 com.apple.WebKit 0x00000001035db54c WebKit::GenericCallback<>::invalidate(WebKit::CallbackBase::Error) + 40 3 com.apple.WebKit 0x0000000103513ea1 void WebKit::invalidateCallbackMap<WTF::RefPtr<WebKit::CallbackBase> >(WTF::HashMap<unsigned long long, WTF::RefPtr<WebKit::CallbackBase>, WTF::IntHash<unsigned long long>, WTF::HashTraits<unsigned long long>, WTF::HashTraits<WTF::RefPtr<WebKit::CallbackBase> > >&, WebKit::CallbackBase::Error) + 231 4 com.apple.WebKit 0x00000001035cd457 WebKit::WebPageProxy::resetState(WebKit::WebPageProxy::ResetStateReason) + 517 5 com.apple.WebKit 0x0000000103414c0e WebKit::WebPageProxy::close() + 118 6 com.apple.WebKit 0x0000000103415d4b -[WKView dealloc] + 106 7 libobjc.A.dylib 0x00007fff8c41dc64 (anonymous namespace)::AutoreleasePoolPage::pop(void*) + 476 8 com.apple.CoreFoundation 0x00007fff981bbf22 _CFAutoreleasePoolPop + 50 9 com.apple.Foundation 0x00007fff8b30e352 -[NSAutoreleasePool drain] + 153 10 WebKitTestRunner 0x0000000102bd8234 0x102bd4000 + 16948 11 libdyld.dylib 0x00007fff988535ad start + 1 rdar://problem/20741111 1090084 1 251971 ap 2015-04-29 11:20:45 -0700 Created attachment 251971 proposed fix 1090133 2 251971 commit-queue 2015-04-29 12:56:49 -0700 Comment on attachment 251971 proposed fix Clearing flags on attachment: 251971 Committed r183572: <http://trac.webkit.org/changeset/183572> 1090134 3 commit-queue 2015-04-29 12:56:54 -0700 All reviewed patches have been landed. Closing bug. 251971 2015-04-29 11:20:45 -0700 2015-04-29 12:56:49 -0700 proposed fix ForceRepaintCallback.txt text/plain 2363 ap SW5kZXg6IFRvb2xzL0NoYW5nZUxvZwo9PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09Ci0tLSBUb29scy9DaGFuZ2VMb2cJKHJl dmlzaW9uIDE4MzU2MSkKKysrIFRvb2xzL0NoYW5nZUxvZwkod29ya2luZyBjb3B5KQpAQCAtMSwz ICsxLDE2IEBACisyMDE1LTA0LTI5ICBBbGV4ZXkgUHJvc2t1cnlha292ICA8YXBAYXBwbGUuY29t PgorCisgICAgICAgIFVzZS1hZnRlci1mcmVlIHdoZW4gaW52YWxpZGF0aW5nIFdLUGFnZUZvcmNl UmVwYWludCBjYWxsYmFjaworICAgICAgICBodHRwczovL2J1Z3Mud2Via2l0Lm9yZy9zaG93X2J1 Zy5jZ2k/aWQ9MTQ0NDAxCisgICAgICAgIHJkYXI6Ly9wcm9ibGVtLzIwNzQxMTExCisKKyAgICAg ICAgUmV2aWV3ZWQgYnkgTk9CT0RZIChPT1BTISkuCisKKyAgICAgICAgKiBXZWJLaXRUZXN0UnVu bmVyL1Rlc3RDb250cm9sbGVyLmg6IChXVFI6OlRlc3RDb250cm9sbGVyOjppc0N1cnJlbnRJbnZv Y2F0aW9uKTogQWRkZWQuCisKKyAgICAgICAgKiBXZWJLaXRUZXN0UnVubmVyL1Rlc3RJbnZvY2F0 aW9uLmNwcDogKFdUUjo6VGVzdEludm9jYXRpb246OmZvcmNlUmVwYWludERvbmVDYWxsYmFjayk6 CisgICAgICAgIERvbid0IGRvIGFueXRoaW5nIG9uIGVycm9yLCBiZWNhdXNlIHRoZSBjb250ZXh0 IG1heSBiZSBhIHN0YWxlIHBvaW50ZXIgbm93LgorCiAyMDE1LTA0LTI5ICBBbGV4ZXkgUHJvc2t1 cnlha292ICA8YXBAYXBwbGUuY29tPgogCiAgICAgICAgIGZhc3QvZnJhbWVzL2ZsYXR0ZW5pbmcv aWZyYW1lLWZsYXR0ZW5pbmctcmVzaXplLWV2ZW50LWNvdW50Lmh0bWwgdGltZXMgb3V0IG9uIFlv c2VtaXRlIFdLMgpJbmRleDogVG9vbHMvV2ViS2l0VGVzdFJ1bm5lci9UZXN0Q29udHJvbGxlci5o Cj09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT0KLS0tIFRvb2xzL1dlYktpdFRlc3RSdW5uZXIvVGVzdENvbnRyb2xsZXIuaAko cmV2aXNpb24gMTgzNTM0KQorKysgVG9vbHMvV2ViS2l0VGVzdFJ1bm5lci9UZXN0Q29udHJvbGxl ci5oCSh3b3JraW5nIGNvcHkpCkBAIC0xMTcsNiArMTE3LDggQEAgcHVibGljOgogCiAgICAgdm9p ZCBzZXRTaG91bGRMb2dIaXN0b3J5Q2xpZW50Q2FsbGJhY2tzKGJvb2wgc2hvdWxkTG9nKSB7IG1f c2hvdWxkTG9nSGlzdG9yeUNsaWVudENhbGxiYWNrcyA9IHNob3VsZExvZzsgfQogCisgICAgYm9v bCBpc0N1cnJlbnRJbnZvY2F0aW9uKFRlc3RJbnZvY2F0aW9uKiBpbnZvY2F0aW9uKSBjb25zdCB7 IHJldHVybiBpbnZvY2F0aW9uID09IG1fY3VycmVudEludm9jYXRpb24uZ2V0KCk7IH0KKwogcHJp dmF0ZToKICAgICB2b2lkIGluaXRpYWxpemUoaW50IGFyZ2MsIGNvbnN0IGNoYXIqIGFyZ3ZbXSk7 CiAgICAgdm9pZCBjcmVhdGVXZWJWaWV3V2l0aE9wdGlvbnMoV0tEaWN0aW9uYXJ5UmVmKTsKSW5k ZXg6IFRvb2xzL1dlYktpdFRlc3RSdW5uZXIvVGVzdEludm9jYXRpb24uY3BwCj09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT0K LS0tIFRvb2xzL1dlYktpdFRlc3RSdW5uZXIvVGVzdEludm9jYXRpb24uY3BwCShyZXZpc2lvbiAx ODM1MzQpCisrKyBUb29scy9XZWJLaXRUZXN0UnVubmVyL1Rlc3RJbnZvY2F0aW9uLmNwcAkod29y a2luZyBjb3B5KQpAQCAtMjQ1LDkgKzI0NSwxNSBAQCB2b2lkIFRlc3RJbnZvY2F0aW9uOjpkdW1w KGNvbnN0IGNoYXIqIHRlCiAgICAgZmZsdXNoKHN0ZGVycik7CiB9CiAKLXZvaWQgVGVzdEludm9j YXRpb246OmZvcmNlUmVwYWludERvbmVDYWxsYmFjayhXS0Vycm9yUmVmLCB2b2lkKiBjb250ZXh0 KQordm9pZCBUZXN0SW52b2NhdGlvbjo6Zm9yY2VSZXBhaW50RG9uZUNhbGxiYWNrKFdLRXJyb3JS ZWYgZXJyb3IsIHZvaWQqIGNvbnRleHQpCiB7CisgICAgLy8gVGhlIGNvbnRleHQgbWF5IG5vdCBi ZSB2YWxpZCBhbnkgbW9yZSwgZS5nLiBpZiBXZWJLaXQgaXMgaW52YWxpZGF0aW5nIGNhbGxiYWNr cyBhdCBwcm9jZXNzIGV4aXQuCisgICAgaWYgKGVycm9yKQorICAgICAgICByZXR1cm47CisKICAg ICBUZXN0SW52b2NhdGlvbiogdGVzdEludm9jYXRpb24gPSBzdGF0aWNfY2FzdDxUZXN0SW52b2Nh dGlvbio+KGNvbnRleHQpOworICAgIFJFTEVBU0VfQVNTRVJUKFRlc3RDb250cm9sbGVyOjpzaW5n bGV0b24oKS5pc0N1cnJlbnRJbnZvY2F0aW9uKHRlc3RJbnZvY2F0aW9uKSk7CisKICAgICB0ZXN0 SW52b2NhdGlvbi0+bV9nb3RSZXBhaW50ID0gdHJ1ZTsKICAgICBUZXN0Q29udHJvbGxlcjo6c2lu Z2xldG9uKCkubm90aWZ5RG9uZSgpOwogfQo=