146786 2015-07-09 08:42:54 -0700 DocumentLoader::detachFromFrame() is being called with no current Frame set 2015-07-10 08:46:42 -0700 1 1 1 Unclassified WebKit Page Loading 528+ (Nightly build) All All RESOLVED FIXED P2 Normal --- 1 beidson beidson commit-queue japhet joepeck ossy thorton oldest_to_newest 1108201 0 beidson 2015-07-09 08:42:54 -0700 DocumentLoader::detachFromFrame() is being called with no current Frame set We're seeing the crashes in <rdar://problem/21293082> Sample backtrace: > 1 com.apple.WebCore 0x7fff88ab2985 WebCore::DocumentLoader::detachFromFrame() + 0xa5 2 com.apple.WebCore 0x7fff88bc77ae WebCore::FrameLoader::clearProvisionalLoad() + 0x1e 3 com.apple.WebCore 0x7fff88a810e9 WebCore::FrameLoader::checkLoadCompleteForThisFrame() + 0x499 4 com.apple.WebCore 0x7fff88a80b86 WebCore::FrameLoader::checkLoadComplete() + 0x136 5 com.apple.WebCore 0x7fff88bc6657 WebCore::FrameLoader::receivedMainResourceError(WebCore::ResourceError const&) + 0x247 6 com.apple.WebCore 0x7fff88ae73b9 WebCore::CachedResource::checkNotify() + 0x99 7 com.apple.WebCore 0x7fff88bc6137 WebCore::SubresourceLoader::didFail(WebCore::ResourceError const&) + 0x177 8 com.apple.WebCore 0x7fff88aca3a5 WebCore::DocumentLoader::continueAfterContentPolicy(WebCore::PolicyAction) + 0x2a5 9 com.apple.WebCore 0x7fff88aca0ec WebCore::PolicyCallback::call(WebCore::PolicyAction) + 0x1c 10 com.apple.WebCore 0x7fff88aca0a3 WebCore::PolicyChecker::continueAfterContentPolicy(WebCore::PolicyAction) + 0x183 11 com.apple.WebKit 0x7fff8b60657a WebKit::WebFrame::didReceivePolicyDecision(unsigned long long, WebCore::PolicyAction, unsigned long long, unsigned long long) + 0xc0 12 com.apple.WebKit 0x7fff8b6078b3 WebKit::WebFrameLoaderClient::dispatchDecidePolicyForResponse(WebCore::ResourceResponse const&, WebCore::ResourceRequest const&, std::__1::function<void (WebCore::PolicyAction)>) + 0x2c3 13 com.apple.WebCore 0x7fff8956a1a6 WebCore::PolicyChecker::checkContentPolicy(WebCore::ResourceResponse const&, std::__1::function<void (WebCore::PolicyAction)>) + 0xe6 14 com.apple.WebCore 0x7fff88aa8b14 WebCore::DocumentLoader::responseReceived(WebCore::CachedResource*, WebCore::ResourceResponse const&) + 0x724 15 com.apple.WebCore 0x7fff88aa829d WebCore::CachedRawResource::responseReceived(WebCore::ResourceResponse const&) + 0xcd 16 com.apple.WebCore 0x7fff88aa8019 WebCore::SubresourceLoader::didReceiveResponse(WebCore::ResourceResponse const&) + 0x1b9 17 com.apple.WebKit 0x7fff8b6ab6c5 WebKit::WebResourceLoader::didReceiveResponse(WebCore::ResourceResponse const&, bool) + 0x41 Digging in deeper to the detachFromFrame() frame of the backtrace, the crash is dereferencing m_frame when calling InspectorInstrumentation::loaderDetachedFromFrame The null frame case means that either: 1 - The DocumentLoader is being detached twice 2 - The DocumentLoader is being detached before ever being attached. We can't quite figure out which. The ASSERT(m_frame) at the top of this method is still valid - it is a mistake for this case to ever happen. 1108275 1 256498 beidson 2015-07-09 11:55:15 -0700 Created attachment 256498 Patch v1 I'm still going deeper down the rabbit hole trying to theorize how this might happen, but this patch definitely stops this specific crash. 1108419 2 beidson 2015-07-09 15:32:01 -0700 https://trac.webkit.org/changeset/186642 1108538 3 ossy 2015-07-09 22:43:15 -0700 (In reply to comment #2) > https://trac.webkit.org/changeset/186642 It made 46 tests assert. 1108614 4 beidson 2015-07-10 08:09:50 -0700 (In reply to comment #3) > (In reply to comment #2) > > https://trac.webkit.org/changeset/186642 > > It made 46 tests assert. I've said it before, I'll say it again - EWS is useless in its current form :( 1108616 5 beidson 2015-07-10 08:15:22 -0700 ACK - DocumentLoaders in the page cache don't detach from their frame =/ Which means when we bring them out and attach to their new frame, they never undergo a formal "detach from frame" process =/ 1108617 6 beidson 2015-07-10 08:16:36 -0700 (In reply to comment #5) > ACK - DocumentLoaders in the page cache don't detach from their frame =/ > > Which means when we bring them out and attach to their new frame, they never > undergo a formal "detach from frame" process =/ I see, the clause I removed in the patch covered this - they can only ever come out to the frame they had when going in. This makes me feel a little better, but not super great. 1108619 7 ossy 2015-07-10 08:24:40 -0700 (In reply to comment #4) > (In reply to comment #3) > > (In reply to comment #2) > > > https://trac.webkit.org/changeset/186642 > > > > It made 46 tests assert. > > I've said it before, I'll say it again - EWS is useless in its current form > :( I wouldn't say if EWS is useless. But it isn't able to catch assertions yet, because we have only release bots and not debug bots too. You can inspire your company to setup debug EWS bots too. ;) Anyway you can (or should) watch the buildbots after landing. 1108620 8 beidson 2015-07-10 08:29:49 -0700 (In reply to comment #7) > (In reply to comment #4) > > (In reply to comment #3) > > > (In reply to comment #2) > > > > https://trac.webkit.org/changeset/186642 > > > > > > It made 46 tests assert. > > > > I've said it before, I'll say it again - EWS is useless in its current form > > :( > > I wouldn't say if EWS is useless. But it isn't able to catch assertions > yet, because we have only release bots and not debug bots too. This is one aspect of the automation paradox. If the automation doesn't do the whole job, then relying on it at all causes problems. > > You can inspire your company to setup debug EWS bots too. ;) My comment was actually a flippant reminder to those who know that I've been asking for 100% EWS coverage for a few years now :) > Anyway you can (or should) watch the buildbots after landing. The other aspect of the automation paradox - Relying on the automation at all causes us to lose our expertise in doing things manually. :) That said, we have bot watchers, non of which who pinged me... yikes! Anyways, a fix is on its way. 1108621 9 beidson 2015-07-10 08:46:42 -0700 https://trac.webkit.org/changeset/186677 to restore the frame equality check and resolve the assert. 256498 2015-07-09 11:55:15 -0700 2015-07-09 15:03:12 -0700 Patch v1 patch text/plain 5467 beidson ZGlmZiAtLWdpdCBhL1NvdXJjZS9XZWJDb3JlL0NoYW5nZUxvZyBiL1NvdXJjZS9XZWJDb3JlL0No YW5nZUxvZwppbmRleCAwMWRjODYzLi5jYTQ3NjM3IDEwMDY0NAotLS0gYS9Tb3VyY2UvV2ViQ29y ZS9DaGFuZ2VMb2cKKysrIGIvU291cmNlL1dlYkNvcmUvQ2hhbmdlTG9nCkBAIC0xLDMgKzEsMjQg QEAKKzIwMTUtMDctMDkgIEJyYWR5IEVpZHNvbiAgPGJlaWRzb25AYXBwbGUuY29tPgorCisgICAg ICAgIERvY3VtZW50TG9hZGVyOjpkZXRhY2hGcm9tRnJhbWUoKSBpcyBiZWluZyBjYWxsZWQgd2l0 aCBubyBjdXJyZW50IEZyYW1lIHNldC4KKyAgICAgICAgPHJkYXI6Ly9wcm9ibGVtLzIxMjkzMDgy PiBhbmQgaHR0cHM6Ly9idWdzLndlYmtpdC5vcmcvc2hvd19idWcuY2dpP2lkPTE0Njc4NiAKKwor ICAgICAgICBSZXZpZXdlZCBieSBOT0JPRFkgKE9PUFMhKS4KKworICAgICAgICBObyBuZXcgdGVz dHMgKFVua25vd24gaG93IHRvIHJlcHJvZHVjZSkuCisKKyAgICAgICAgKiBsb2FkZXIvRG9jdW1l bnRMb2FkZXIuY3BwOgorICAgICAgICAoV2ViQ29yZTo6RG9jdW1lbnRMb2FkZXI6OmF0dGFjaFRv RnJhbWUpOgorICAgICAgICAoV2ViQ29yZTo6RG9jdW1lbnRMb2FkZXI6OmRldGFjaEZyb21GcmFt ZSk6IE51bGwgY2hlY2sgbV9mcmFtZSBiZWZvcmUgZGVyZWZlcmVuY2luZyBpdC4KKyAgICAgICAg KFdlYkNvcmU6OkRvY3VtZW50TG9hZGVyOjpzZXRGcmFtZSk6IERlbGV0ZWQsIHJlbmFtZWQgdG8g YXR0YWNoVG9GcmFtZSgpLCBhbmQgdGFrZSdzCisgICAgICAgICAgYSBGcmFtZSYgaW5zdGVhZCBv ZiBhIEZyYW1lKi4KKyAgICAgICAgKiBsb2FkZXIvRG9jdW1lbnRMb2FkZXIuaDoKKyAgICAgICAg CisgICAgICAgICogbG9hZGVyL0ZyYW1lTG9hZGVyLmNwcDoKKyAgICAgICAgKFdlYkNvcmU6OkZy YW1lTG9hZGVyOjppbml0Rm9yU3ludGhlc2l6ZWREb2N1bWVudCk6IHNldEZyYW1lIGlzIG5vdyBh dHRhY2hUb0ZyYW1lLgorICAgICAgICAoV2ViQ29yZTo6RnJhbWVMb2FkZXI6OnNldFBvbGljeURv Y3VtZW50TG9hZGVyKTogRGl0dG8uCisgICAgICAgIChXZWJDb3JlOjpGcmFtZUxvYWRlcjo6dHJh bnNpdGlvblRvQ29tbWl0dGVkKTogRGl0dG8uCisKIDIwMTUtMDctMDkgIERhcmluIEFkbGVyICA8 ZGFyaW5AYXBwbGUuY29tPgogCiAgICAgICAgIFJFR1JFU1NJT04gKHIxODI4NjYpOiByZXBlYXRl ZCBwcm9tcHRzIGZvciBwYXNzd29yZCBvbiBpbnRlcm5hbCBBcHBsZSB3ZWJzaXRlIHVzaW5nIHdv cmtlcnMKZGlmZiAtLWdpdCBhL1NvdXJjZS9XZWJDb3JlL2xvYWRlci9Eb2N1bWVudExvYWRlci5j cHAgYi9Tb3VyY2UvV2ViQ29yZS9sb2FkZXIvRG9jdW1lbnRMb2FkZXIuY3BwCmluZGV4IDUyYWU5 MDAuLjJhMzNlMjQgMTAwNjQ0Ci0tLSBhL1NvdXJjZS9XZWJDb3JlL2xvYWRlci9Eb2N1bWVudExv YWRlci5jcHAKKysrIGIvU291cmNlL1dlYkNvcmUvbG9hZGVyL0RvY3VtZW50TG9hZGVyLmNwcApA QCAtODk5LDEzICs4OTksMTEgQEAgdm9pZCBEb2N1bWVudExvYWRlcjo6Y2hlY2tMb2FkQ29tcGxl dGUoKQogICAgIG1fZnJhbWUtPmRvY3VtZW50KCktPmRvbVdpbmRvdygpLT5maW5pc2hlZExvYWRp bmcoKTsKIH0KIAotdm9pZCBEb2N1bWVudExvYWRlcjo6c2V0RnJhbWUoRnJhbWUqIGZyYW1lKQor dm9pZCBEb2N1bWVudExvYWRlcjo6YXR0YWNoVG9GcmFtZShGcmFtZSYgZnJhbWUpCiB7Ci0gICAg aWYgKG1fZnJhbWUgPT0gZnJhbWUpCi0gICAgICAgIHJldHVybjsKLSAgICBBU1NFUlQoZnJhbWUg JiYgIW1fZnJhbWUpOwotICAgIG1fZnJhbWUgPSBmcmFtZTsKLSAgICBtX3dyaXRlci5zZXRGcmFt ZShmcmFtZSk7CisgICAgQVNTRVJUKCFtX2ZyYW1lKTsKKyAgICBtX2ZyYW1lID0gJmZyYW1lOwor ICAgIG1fd3JpdGVyLnNldEZyYW1lKCZmcmFtZSk7CiAgICAgYXR0YWNoVG9GcmFtZSgpOwogfQog CkBAIC05MzAsNyArOTI4LDE0IEBAIHZvaWQgRG9jdW1lbnRMb2FkZXI6OmRldGFjaEZyb21GcmFt ZSgpCiAjZW5kaWYKIAogICAgIG1fYXBwbGljYXRpb25DYWNoZUhvc3QtPnNldERPTUFwcGxpY2F0 aW9uQ2FjaGUobnVsbHB0cik7Ci0gICAgSW5zcGVjdG9ySW5zdHJ1bWVudGF0aW9uOjpsb2FkZXJE ZXRhY2hlZEZyb21GcmFtZSgqbV9mcmFtZSwgKnRoaXMpOworCisgICAgLy8gRXZlbiB0aG91Z2gg d2UgQVNTRVJUIGF0IHRoZSB0b3Agb2YgdGhpcyBtZXRob2QgdGhhdCB3ZSBoYXZlIGFuIG1fZnJh bWUsIHdlJ3JlIHNlZWluZyBjcmFzaGVzIHdoZXJlIG1fZnJhbWUgaXMgbnVsbC4KKyAgICAvLyBU aGlzIG1lYW5zIGVpdGhlciB0aGF0IGEgRG9jdW1lbnRMb2FkZXIgaXMgZGV0YWNoaW5nIHR3aWNl LCBvciBpcyBkZXRhY2hpbmcgYmVmb3JlIGV2ZXIgaGF2aW5nIGF0dGFjaGVkLgorICAgIC8vIFVu dGlsIHdlIGZpZ3VyZSBvdXQgaG93IHRoYXQgaXMgaGFwcGVuaW5nLCBudWxsIGNoZWNrIG1fZnJh bWUgYmVmb3JlIGRlcmVmZXJlbmNpbmcgaXQgaGVyZS4KKyAgICAvLyA8cmRhcjovL3Byb2JsZW0v MjEyOTMwODI+IGFuZCBodHRwczovL2J1Z3Mud2Via2l0Lm9yZy9zaG93X2J1Zy5jZ2k/aWQ9MTQ2 Nzg2CisgICAgaWYgKG1fZnJhbWUpCisgICAgICAgIEluc3BlY3Rvckluc3RydW1lbnRhdGlvbjo6 bG9hZGVyRGV0YWNoZWRGcm9tRnJhbWUoKm1fZnJhbWUsICp0aGlzKTsKKwogICAgIG1fZnJhbWUg PSBudWxscHRyOwogICAgIC8vIFRoZSBjYWxsIHRvIHN0b3BMb2FkaW5nKCkgYWJvdmUgc2hvdWxk IGhhdmUgY2FuY2VsZWQgYW55IHBlbmRpbmcgY29udGVudCBwb2xpY3kgY2hlY2suCiAgICAgQVNT RVJUX1dJVEhfTUVTU0FHRSghbV93YWl0aW5nRm9yQ29udGVudFBvbGljeSwgIlRoZSBjb250ZW50 IHBvbGljeSBjYWxsYmFjayBuZWVkcyBhIHZhbGlkIGZyYW1lLiIpOwpkaWZmIC0tZ2l0IGEvU291 cmNlL1dlYkNvcmUvbG9hZGVyL0RvY3VtZW50TG9hZGVyLmggYi9Tb3VyY2UvV2ViQ29yZS9sb2Fk ZXIvRG9jdW1lbnRMb2FkZXIuaAppbmRleCA5MzVlODgxLi4yODlhNDg2IDEwMDY0NAotLS0gYS9T b3VyY2UvV2ViQ29yZS9sb2FkZXIvRG9jdW1lbnRMb2FkZXIuaAorKysgYi9Tb3VyY2UvV2ViQ29y ZS9sb2FkZXIvRG9jdW1lbnRMb2FkZXIuaApAQCAtODgsMTAgKzg4LDkgQEAgbmFtZXNwYWNlIFdl YkNvcmUgewogICAgICAgICB9CiAgICAgICAgIFdFQkNPUkVfRVhQT1JUIHZpcnR1YWwgfkRvY3Vt ZW50TG9hZGVyKCk7CiAKLSAgICAgICAgV0VCQ09SRV9FWFBPUlQgdm9pZCBzZXRGcmFtZShGcmFt ZSopOworICAgICAgICB2b2lkIGF0dGFjaFRvRnJhbWUoRnJhbWUmKTsKICAgICAgICAgRnJhbWUq IGZyYW1lKCkgY29uc3QgeyByZXR1cm4gbV9mcmFtZTsgfQogCi0gICAgICAgIFdFQkNPUkVfRVhQ T1JUIHZpcnR1YWwgdm9pZCBhdHRhY2hUb0ZyYW1lKCk7CiAgICAgICAgIFdFQkNPUkVfRVhQT1JU IHZpcnR1YWwgdm9pZCBkZXRhY2hGcm9tRnJhbWUoKTsKIAogICAgICAgICBXRUJDT1JFX0VYUE9S VCBGcmFtZUxvYWRlciogZnJhbWVMb2FkZXIoKSBjb25zdDsKQEAgLTI4MSw2ICsyODAsOCBAQCBu YW1lc3BhY2UgV2ViQ29yZSB7CiAgICAgcHJvdGVjdGVkOgogICAgICAgICBXRUJDT1JFX0VYUE9S VCBEb2N1bWVudExvYWRlcihjb25zdCBSZXNvdXJjZVJlcXVlc3QmLCBjb25zdCBTdWJzdGl0dXRl RGF0YSYpOwogCisgICAgICAgIFdFQkNPUkVfRVhQT1JUIHZpcnR1YWwgdm9pZCBhdHRhY2hUb0Zy YW1lKCk7CisKICAgICAgICAgYm9vbCBtX2RlZmVyTWFpblJlc291cmNlRGF0YUxvYWQ7CiAKICAg ICBwcml2YXRlOgpkaWZmIC0tZ2l0IGEvU291cmNlL1dlYkNvcmUvbG9hZGVyL0ZyYW1lTG9hZGVy LmNwcCBiL1NvdXJjZS9XZWJDb3JlL2xvYWRlci9GcmFtZUxvYWRlci5jcHAKaW5kZXggZDdmY2Yx My4uOTAxYjY3NiAxMDA2NDQKLS0tIGEvU291cmNlL1dlYkNvcmUvbG9hZGVyL0ZyYW1lTG9hZGVy LmNwcAorKysgYi9Tb3VyY2UvV2ViQ29yZS9sb2FkZXIvRnJhbWVMb2FkZXIuY3BwCkBAIC0yNzYs NyArMjc2LDcgQEAgdm9pZCBGcmFtZUxvYWRlcjo6aW5pdEZvclN5bnRoZXNpemVkRG9jdW1lbnQo Y29uc3QgVVJMJikKICAgICAvLyBGcmFtZUxvYWRlcjo6Y2hlY2tDb21wbGV0ZWQoKSB3aWxsIG92 ZXJ3cml0ZSB0aGUgVVJMIG9mIHRoZSBkb2N1bWVudCB0byBiZSBhY3RpdmVEb2N1bWVudExvYWRl cigpLT5kb2N1bWVudFVSTCgpLgogCiAgICAgUmVmUHRyPERvY3VtZW50TG9hZGVyPiBsb2FkZXIg PSBtX2NsaWVudC5jcmVhdGVEb2N1bWVudExvYWRlcihSZXNvdXJjZVJlcXVlc3QoVVJMKFBhcnNl ZFVSTFN0cmluZywgZW1wdHlTdHJpbmcoKSkpLCBTdWJzdGl0dXRlRGF0YSgpKTsKLSAgICBsb2Fk ZXItPnNldEZyYW1lKCZtX2ZyYW1lKTsKKyAgICBsb2FkZXItPmF0dGFjaFRvRnJhbWUobV9mcmFt ZSk7CiAgICAgbG9hZGVyLT5zZXRSZXNwb25zZShSZXNvdXJjZVJlc3BvbnNlKFVSTCgpLCBBU0NJ SUxpdGVyYWwoInRleHQvaHRtbCIpLCAwLCBTdHJpbmcoKSkpOwogICAgIGxvYWRlci0+c2V0Q29t bWl0dGVkKHRydWUpOwogICAgIHNldERvY3VtZW50TG9hZGVyKGxvYWRlci5nZXQoKSk7CkBAIC0x Njk3LDcgKzE2OTcsNyBAQCB2b2lkIEZyYW1lTG9hZGVyOjpzZXRQb2xpY3lEb2N1bWVudExvYWRl cihEb2N1bWVudExvYWRlciogbG9hZGVyKQogICAgICAgICByZXR1cm47CiAKICAgICBpZiAobG9h ZGVyKQotICAgICAgICBsb2FkZXItPnNldEZyYW1lKCZtX2ZyYW1lKTsKKyAgICAgICAgbG9hZGVy LT5hdHRhY2hUb0ZyYW1lKG1fZnJhbWUpOwogICAgIGlmIChtX3BvbGljeURvY3VtZW50TG9hZGVy CiAgICAgICAgICAgICAmJiBtX3BvbGljeURvY3VtZW50TG9hZGVyICE9IG1fcHJvdmlzaW9uYWxE b2N1bWVudExvYWRlcgogICAgICAgICAgICAgJiYgbV9wb2xpY3lEb2N1bWVudExvYWRlciAhPSBt X2RvY3VtZW50TG9hZGVyKQpAQCAtMTkzNyw3ICsxOTM3LDcgQEAgdm9pZCBGcmFtZUxvYWRlcjo6 dHJhbnNpdGlvblRvQ29tbWl0dGVkKENhY2hlZFBhZ2UqIGNhY2hlZFBhZ2UpCiAgICAgICAgICAg ICBpZiAoY2FjaGVkUGFnZSkgewogICAgICAgICAgICAgICAgIERvY3VtZW50TG9hZGVyKiBjYWNo ZWREb2N1bWVudExvYWRlciA9IGNhY2hlZFBhZ2UtPmRvY3VtZW50TG9hZGVyKCk7CiAgICAgICAg ICAgICAgICAgQVNTRVJUKGNhY2hlZERvY3VtZW50TG9hZGVyKTsKLSAgICAgICAgICAgICAgICBj YWNoZWREb2N1bWVudExvYWRlci0+c2V0RnJhbWUoJm1fZnJhbWUpOworICAgICAgICAgICAgICAg IGNhY2hlZERvY3VtZW50TG9hZGVyLT5hdHRhY2hUb0ZyYW1lKG1fZnJhbWUpOwogICAgICAgICAg ICAgICAgIG1fY2xpZW50LnRyYW5zaXRpb25Ub0NvbW1pdHRlZEZyb21DYWNoZWRGcmFtZShjYWNo ZWRQYWdlLT5jYWNoZWRNYWluRnJhbWUoKSk7CiAgICAgICAgICAgICB9IGVsc2UKICAgICAgICAg ICAgICAgICBtX2NsaWVudC50cmFuc2l0aW9uVG9Db21taXR0ZWRGb3JOZXdQYWdlKCk7Cg==