145488 2015-05-29 20:17:53 -0700 Web Inspector: Crash closing a related tab with Web Inspector open while page is refreshing 2015-05-29 20:56:02 -0700 1 1 1 Unclassified WebKit Web Inspector 528+ (Nightly build) All All RESOLVED FIXED InRadar P2 Normal --- 1 joepeck joepeck andersca ap graouts joepeck jonowells mattbaker nvasilyev timothy webkit-bug-importer oldest_to_newest 1098307 0 joepeck 2015-05-29 20:17:53 -0700 * SUMMARY Crash closing a related tab with Web Inspector open while page is refreshing. * STEPS TO REPRODUCE 1. Inspect <https://www.tumblr.com> 2. Expand <head> in DOM Tree 3. Click URL from <link rel="icon" sizes="any" mask="" href="https://secure.assets.tumblr.com/images/tumblr_t_logo.svg?_v=fe2b348bb13d366e9e93d5bf6a8b2fdd"> to open new page in the same WebProcess 4. Refresh the tumblr.com page with the Web Inspector 5. Close Tab (⌘W) while the page is refreshing => occasionally a CRASH * CRASH Exception Type: EXC_BAD_ACCESS (SIGSEGV) Exception Codes: EXC_I386_GPFLT Thread 0 Crashed:: Dispatch queue: com.apple.main-thread 0 com.apple.WebKit std::__1::__function::__func<IPC::Connection::connectionDidClose()::$_8, std::__1::allocator<IPC::Connection::connectionDidClose()::$_8>, void ()>::operator()() + 28 1 com.apple.JavaScriptCore WTF::RunLoop::performWork() + 850 (RunLoop.cpp:106) 2 com.apple.JavaScriptCore WTF::RunLoop::performWork(void*) + 34 (RunLoopCF.cpp:39) 3 com.apple.CoreFoundation __CFRUNLOOP_IS_CALLING_OUT_TO_A_SOURCE0_PERFORM_FUNCTION__ + 17 4 com.apple.CoreFoundation __CFRunLoopDoSources0 + 269 5 com.apple.CoreFoundation __CFRunLoopRun + 927 6 com.apple.CoreFoundation CFRunLoopRunSpecific + 296 7 com.apple.HIToolbox RunCurrentEventLoopInMode + 235 8 com.apple.HIToolbox ReceiveNextEventCommon + 431 9 com.apple.HIToolbox _BlockUntilNextEventMatchingListInModeWithFilter + 71 10 com.apple.AppKit _DPSNextEvent + 978 11 com.apple.AppKit -[NSApplication nextEventMatchingMask:untilDate:inMode:dequeue:] + 346 12 com.apple.AppKit -[NSApplication run] + 594 13 com.apple.AppKit NSApplicationMain + 1832 14 libxpc.dylib _xpc_objc_main + 793 15 libxpc.dylib xpc_main + 490 16 com.apple.WebKit.WebContent.Development main + 21 (XPCServiceMain.Development.mm:90) 17 libdyld.dylib start + 1 * LLDB (Release) - Looks like the client is a garbage object, it never invalidated the connection properly. (lldb) Process 33413 stopped * thread #1: tid = 0x20b823, 0x0000000109ea6c8e WebKit`std::__1::__function::__func<IPC::Connection::connectionDidClose()::$_8, std::__1::allocator<IPC::Connection::connectionDidClose()::$_8>, void ()>::operator()() [inlined] IPC::Connection::connectionDidClose()::$_8::operator()() const + 24 at Connection.cpp:781, queue = 'com.apple.main-thread', stop reason = EXC_BAD_ACCESS (code=EXC_I386_GPFLT) frame #0: 0x0000000109ea6c8e WebKit`std::__1::__function::__func<IPC::Connection::connectionDidClose()::$_8, std::__1::allocator<IPC::Connection::connectionDidClose()::$_8>, void ()>::operator()() [inlined] IPC::Connection::connectionDidClose()::$_8::operator()() const + 24 at Connection.cpp:781 778 Client* client = connection->m_client; 779 connection->m_client = nullptr; 780 -> 781 client->didClose(*connection); 782 }); 783 } 784 (lldb) p client (IPC::Connection::Client *) $0 = 0x00007fcfd0529118 (lldb) p client (IPC::Connection::Client) $11 = {} 1098308 1 joepeck 2015-05-29 20:18:23 -0700 <rdar://problem/21142346> 1098309 2 joepeck 2015-05-29 20:21:16 -0700 FWIW, the case where we would close without invalidating is under WebPage::close(): * thread #1: tid = 0x246321, 0x00000001093baa81 WebKit`WebKit::WebInspector::~WebInspector(this=0x00007ffce6442a58) + 71 at WebInspector.cpp:78, queue = 'com.apple.main-thread', stop reason = breakpoint 1.1 * frame #0: 0x00000001093baa81 WebKit`WebKit::WebInspector::~WebInspector(this=0x00007ffce6442a58) + 71 at WebInspector.cpp:78 frame #1: 0x000000010949e506 WebKit`-[WKObject dealloc](self=0x00007ffce6442a40, _cmd=<unavailable>) + 25 at WKObject.mm:40 frame #2: 0x00007fff99d2e89c libobjc.A.dylib`objc_object::sidetable_release(bool) + 236 frame #3: 0x00007fff8c942db0 CoreFoundation`CFRelease + 304 frame #4: 0x00000001093d9c7f WebKit`WebKit::WebPage::close() [inlined] void WTF::derefIfNotNull<WebKit::WebInspector>(ptr=<unavailable>) + 231 at PassRefPtr.h:42 frame #5: 0x00000001093d9c75 WebKit`WebKit::WebPage::close() [inlined] WTF::RefPtr<WebKit::WebInspector>::~RefPtr() at RefPtr.h:59 frame #6: 0x00000001093d9c75 WebKit`WebKit::WebPage::close() [inlined] WTF::RefPtr<WebKit::WebInspector>::~RefPtr() at RefPtr.h:59 frame #7: 0x00000001093d9c75 WebKit`WebKit::WebPage::close() [inlined] WTF::RefPtr<WebKit::WebInspector>::operator=(WebKit::WebInspector*) + 18 at RefPtr.h:142 frame #8: 0x00000001093d9c63 WebKit`WebKit::WebPage::close(this=0x00007ffce6809410) + 203 at WebPage.cpp:925 frame #9: 0x00000001093f4cad WebKit`WebKit::WebPage::didReceiveWebPageMessage(IPC::Connection&, IPC::MessageDecoder&) [inlined] void IPC::callMemberFunctionImpl<WebKit::WebPage, void (WebKit::WebPage::*)(), std::__1::tuple<> >(object=0x00007ffce6809410)(), std::__1::tuple<>&&, std::index_sequence<>) + 8 at HandleMessage.h:16 frame #10: 0x00000001093f4ca5 WebKit`WebKit::WebPage::didReceiveWebPageMessage(IPC::Connection&, IPC::MessageDecoder&) [inlined] void IPC::callMemberFunction<WebKit::WebPage, void (WebKit::WebPage::*)(), std::__1::tuple<>, std::make_index_sequence<0ul> >(std::__1::tuple<>&&, WebKit::WebPage*, void (WebKit::WebPage::*)()) at HandleMessage.h:22 frame #11: 0x00000001093f4ca5 WebKit`WebKit::WebPage::didReceiveWebPageMessage(IPC::Connection&, IPC::MessageDecoder&) [inlined] void IPC::handleMessage<Messages::WebPage::Close, WebKit::WebPage, void (WebKit::WebPage::*)()>(decoder=<unavailable>)()) at HandleMessage.h:92 frame #12: 0x00000001093f4ca5 WebKit`WebKit::WebPage::didReceiveWebPageMessage(this=0x00007ffce6809410, connection=<unavailable>, decoder=<unavailable>) + 5585 at WebPageMessageReceiver.cpp:655 This does: if (m_inspector) { m_inspector->disconnectFromPage(); m_inspector = nullptr; } And disconnectFromPage just does close() without going further to invalidate. We could make disconnectFromPage invalidate, but I figure putting it in the destructor we are guaranteed it will happen no matter how we destruct. 1098310 3 253948 joepeck 2015-05-29 20:24:24 -0700 Created attachment 253948 [PATCH] Proposed Fix 1098311 4 253949 joepeck 2015-05-29 20:25:47 -0700 Created attachment 253949 [PATCH] Proposed Fix 1098315 5 joepeck 2015-05-29 20:56:02 -0700 Committed r185030: <http://trac.webkit.org/changeset/185030> 253948 2015-05-29 20:24:24 -0700 2015-05-29 20:25:47 -0700 [PATCH] Proposed Fix proposed-fix.patch text/plain 2023 joepeck ZGlmZiAtLWdpdCBhL1NvdXJjZS9XZWJLaXQyL0NoYW5nZUxvZyBiL1NvdXJjZS9XZWJLaXQyL0No YW5nZUxvZwppbmRleCA1OWVjMGU1Li42ZjI3MjIxIDEwMDY0NAotLS0gYS9Tb3VyY2UvV2ViS2l0 Mi9DaGFuZ2VMb2cKKysrIGIvU291cmNlL1dlYktpdDIvQ2hhbmdlTG9nCkBAIC0xLDMgKzEsMTkg QEAKKzIwMTUtMDUtMjkgIEpvc2VwaCBQZWNvcmFybyAgPHBlY29yYXJvQGFwcGxlLmNvbT4KKwor ICAgICAgICBXZWIgSW5zcGVjdG9yOiBDcmFzaCBjbG9zaW5nIGEgcmVsYXRlZCB0YWIgd2l0aCBX ZWIgSW5zcGVjdG9yIG9wZW4gd2hpbGUgcGFnZSBpcyByZWZyZXNoaW5nCisgICAgICAgIGh0dHBz Oi8vYnVncy53ZWJraXQub3JnL3Nob3dfYnVnLmNnaT9pZD0xNDU0ODgKKworICAgICAgICBSZXZp ZXdlZCBieSBOT0JPRFkgKE9PUFMhKS4KKworICAgICAgICAqIFdlYlByb2Nlc3MvV2ViUGFnZS9X ZWJJbnNwZWN0b3IuaDoKKyAgICAgICAgKiBXZWJQcm9jZXNzL1dlYlBhZ2UvV2ViSW5zcGVjdG9y LmNwcDoKKyAgICAgICAgKFdlYktpdDo6V2ViSW5zcGVjdG9yOjp+V2ViSW5zcGVjdG9yKToKKyAg ICAgICAgRW5zdXJlLCBubyBtYXR0ZXIgaG93IHdlIGNsb3NlLCB0aGF0IHdlIGhhdmUgaW52YWxp ZGF0ZWQgdGhlCisgICAgICAgIGZyb250ZW5kIGNvbm5lY3Rpb24gb2Ygd2hpY2ggd2UgYXJlIHRo ZSBjbGllbnQuCisKKyAgICAgICAgKFdlYktpdDo6V2ViSW5zcGVjdG9yOjpjcmVhdGVJbnNwZWN0 b3JQYWdlKToKKyAgICAgICAgVGhpcyBtZW1iZXIgdmFyaWFibGUgd2lsbCBuZXZlciBiZSBudWxs LgorCiAyMDE1LTA1LTI4ICBBbGV4ZXkgUHJvc2t1cnlha292ICA8YXBAYXBwbGUuY29tPgogCiAg ICAgICAgIENsZWFuIHVwIFZpc2l0ZWRMaW5rUHJvdmlkZXIgdGVhcmRvd24KZGlmZiAtLWdpdCBh L1NvdXJjZS9XZWJLaXQyL1dlYlByb2Nlc3MvV2ViUGFnZS9XZWJJbnNwZWN0b3IuY3BwIGIvU291 cmNlL1dlYktpdDIvV2ViUHJvY2Vzcy9XZWJQYWdlL1dlYkluc3BlY3Rvci5jcHAKaW5kZXggNWFm YWVlMy4uMWVhOTEyOCAxMDA2NDQKLS0tIGEvU291cmNlL1dlYktpdDIvV2ViUHJvY2Vzcy9XZWJQ YWdlL1dlYkluc3BlY3Rvci5jcHAKKysrIGIvU291cmNlL1dlYktpdDIvV2ViUHJvY2Vzcy9XZWJQ YWdlL1dlYkluc3BlY3Rvci5jcHAKQEAgLTY4LDEyICs2OCwxNSBAQCBXZWJJbnNwZWN0b3I6Oldl Ykluc3BlY3RvcihXZWJQYWdlKiBwYWdlKQogewogfQogCitXZWJJbnNwZWN0b3I6On5XZWJJbnNw ZWN0b3IoKQoreworICAgIGlmIChtX2Zyb250ZW5kQ29ubmVjdGlvbikKKyAgICAgICAgbV9mcm9u dGVuZENvbm5lY3Rpb24tPmludmFsaWRhdGUoKTsKK30KKwogLy8gQ2FsbGVkIGZyb20gV2ViSW5z cGVjdG9yQ2xpZW50CiB2b2lkIFdlYkluc3BlY3Rvcjo6Y3JlYXRlSW5zcGVjdG9yUGFnZShib29s IHVuZGVyVGVzdCkKIHsKLSAgICBpZiAoIW1fcGFnZSkKLSAgICAgICAgcmV0dXJuOwotCiAjaWYg T1MoREFSV0lOKQogICAgIG1hY2hfcG9ydF90IGxpc3RlbmluZ1BvcnQ7CiAgICAgbWFjaF9wb3J0 X2FsbG9jYXRlKG1hY2hfdGFza19zZWxmKCksIE1BQ0hfUE9SVF9SSUdIVF9SRUNFSVZFLCAmbGlz dGVuaW5nUG9ydCk7CmRpZmYgLS1naXQgYS9Tb3VyY2UvV2ViS2l0Mi9XZWJQcm9jZXNzL1dlYlBh Z2UvV2ViSW5zcGVjdG9yLmggYi9Tb3VyY2UvV2ViS2l0Mi9XZWJQcm9jZXNzL1dlYlBhZ2UvV2Vi SW5zcGVjdG9yLmgKaW5kZXggZWQ4NWM5MDkuLjFhMDExOTkgMTAwNjQ0Ci0tLSBhL1NvdXJjZS9X ZWJLaXQyL1dlYlByb2Nlc3MvV2ViUGFnZS9XZWJJbnNwZWN0b3IuaAorKysgYi9Tb3VyY2UvV2Vi S2l0Mi9XZWJQcm9jZXNzL1dlYlBhZ2UvV2ViSW5zcGVjdG9yLmgKQEAgLTkxLDYgKzkxLDcgQEAg cHJpdmF0ZToKICAgICBmcmllbmQgY2xhc3MgV2ViSW5zcGVjdG9yQ2xpZW50OwogCiAgICAgZXhw bGljaXQgV2ViSW5zcGVjdG9yKFdlYlBhZ2UqKTsKKyAgICB+V2ViSW5zcGVjdG9yKCk7CiAKICAg ICBib29sIGNhbkF0dGFjaFdpbmRvdygpOwogCg== 253949 2015-05-29 20:25:47 -0700 2015-05-29 20:45:51 -0700 [PATCH] Proposed Fix better-1.patch text/plain 2031 joepeck ZGlmZiAtLWdpdCBhL1NvdXJjZS9XZWJLaXQyL0NoYW5nZUxvZyBiL1NvdXJjZS9XZWJLaXQyL0No YW5nZUxvZwppbmRleCA1OWVjMGU1Li42ZjI3MjIxIDEwMDY0NAotLS0gYS9Tb3VyY2UvV2ViS2l0 Mi9DaGFuZ2VMb2cKKysrIGIvU291cmNlL1dlYktpdDIvQ2hhbmdlTG9nCkBAIC0xLDMgKzEsMTkg QEAKKzIwMTUtMDUtMjkgIEpvc2VwaCBQZWNvcmFybyAgPHBlY29yYXJvQGFwcGxlLmNvbT4KKwor ICAgICAgICBXZWIgSW5zcGVjdG9yOiBDcmFzaCBjbG9zaW5nIGEgcmVsYXRlZCB0YWIgd2l0aCBX ZWIgSW5zcGVjdG9yIG9wZW4gd2hpbGUgcGFnZSBpcyByZWZyZXNoaW5nCisgICAgICAgIGh0dHBz Oi8vYnVncy53ZWJraXQub3JnL3Nob3dfYnVnLmNnaT9pZD0xNDU0ODgKKworICAgICAgICBSZXZp ZXdlZCBieSBOT0JPRFkgKE9PUFMhKS4KKworICAgICAgICAqIFdlYlByb2Nlc3MvV2ViUGFnZS9X ZWJJbnNwZWN0b3IuaDoKKyAgICAgICAgKiBXZWJQcm9jZXNzL1dlYlBhZ2UvV2ViSW5zcGVjdG9y LmNwcDoKKyAgICAgICAgKFdlYktpdDo6V2ViSW5zcGVjdG9yOjp+V2ViSW5zcGVjdG9yKToKKyAg ICAgICAgRW5zdXJlLCBubyBtYXR0ZXIgaG93IHdlIGNsb3NlLCB0aGF0IHdlIGhhdmUgaW52YWxp ZGF0ZWQgdGhlCisgICAgICAgIGZyb250ZW5kIGNvbm5lY3Rpb24gb2Ygd2hpY2ggd2UgYXJlIHRo ZSBjbGllbnQuCisKKyAgICAgICAgKFdlYktpdDo6V2ViSW5zcGVjdG9yOjpjcmVhdGVJbnNwZWN0 b3JQYWdlKToKKyAgICAgICAgVGhpcyBtZW1iZXIgdmFyaWFibGUgd2lsbCBuZXZlciBiZSBudWxs LgorCiAyMDE1LTA1LTI4ICBBbGV4ZXkgUHJvc2t1cnlha292ICA8YXBAYXBwbGUuY29tPgogCiAg ICAgICAgIENsZWFuIHVwIFZpc2l0ZWRMaW5rUHJvdmlkZXIgdGVhcmRvd24KZGlmZiAtLWdpdCBh L1NvdXJjZS9XZWJLaXQyL1dlYlByb2Nlc3MvV2ViUGFnZS9XZWJJbnNwZWN0b3IuY3BwIGIvU291 cmNlL1dlYktpdDIvV2ViUHJvY2Vzcy9XZWJQYWdlL1dlYkluc3BlY3Rvci5jcHAKaW5kZXggNWFm YWVlMy4uMWVhOTEyOCAxMDA2NDQKLS0tIGEvU291cmNlL1dlYktpdDIvV2ViUHJvY2Vzcy9XZWJQ YWdlL1dlYkluc3BlY3Rvci5jcHAKKysrIGIvU291cmNlL1dlYktpdDIvV2ViUHJvY2Vzcy9XZWJQ YWdlL1dlYkluc3BlY3Rvci5jcHAKQEAgLTY4LDEyICs2OCwxNSBAQCBXZWJJbnNwZWN0b3I6Oldl Ykluc3BlY3RvcihXZWJQYWdlKiBwYWdlKQogewogfQogCitXZWJJbnNwZWN0b3I6On5XZWJJbnNw ZWN0b3IoKQoreworICAgIGlmIChtX2Zyb250ZW5kQ29ubmVjdGlvbikKKyAgICAgICAgbV9mcm9u dGVuZENvbm5lY3Rpb24tPmludmFsaWRhdGUoKTsKK30KKwogLy8gQ2FsbGVkIGZyb20gV2ViSW5z cGVjdG9yQ2xpZW50CiB2b2lkIFdlYkluc3BlY3Rvcjo6Y3JlYXRlSW5zcGVjdG9yUGFnZShib29s IHVuZGVyVGVzdCkKIHsKLSAgICBpZiAoIW1fcGFnZSkKLSAgICAgICAgcmV0dXJuOwotCiAjaWYg T1MoREFSV0lOKQogICAgIG1hY2hfcG9ydF90IGxpc3RlbmluZ1BvcnQ7CiAgICAgbWFjaF9wb3J0 X2FsbG9jYXRlKG1hY2hfdGFza19zZWxmKCksIE1BQ0hfUE9SVF9SSUdIVF9SRUNFSVZFLCAmbGlz dGVuaW5nUG9ydCk7CmRpZmYgLS1naXQgYS9Tb3VyY2UvV2ViS2l0Mi9XZWJQcm9jZXNzL1dlYlBh Z2UvV2ViSW5zcGVjdG9yLmggYi9Tb3VyY2UvV2ViS2l0Mi9XZWJQcm9jZXNzL1dlYlBhZ2UvV2Vi SW5zcGVjdG9yLmgKaW5kZXggZWQ4NWM5MDkuLjc0ZWI3ZWEgMTAwNjQ0Ci0tLSBhL1NvdXJjZS9X ZWJLaXQyL1dlYlByb2Nlc3MvV2ViUGFnZS9XZWJJbnNwZWN0b3IuaAorKysgYi9Tb3VyY2UvV2Vi S2l0Mi9XZWJQcm9jZXNzL1dlYlBhZ2UvV2ViSW5zcGVjdG9yLmgKQEAgLTkxLDYgKzkxLDcgQEAg cHJpdmF0ZToKICAgICBmcmllbmQgY2xhc3MgV2ViSW5zcGVjdG9yQ2xpZW50OwogCiAgICAgZXhw bGljaXQgV2ViSW5zcGVjdG9yKFdlYlBhZ2UqKTsKKyAgICB2aXJ0dWFsIH5XZWJJbnNwZWN0b3Io KTsKIAogICAgIGJvb2wgY2FuQXR0YWNoV2luZG93KCk7CiAK