154563 2016-02-22 16:11:11 -0800 REGRESSION (r196892): Crash in DocumentLoader::startLoadingMainResource() 2016-02-22 16:48:47 -0800 1 1 1 Unclassified WebKit Page Loading WebKit Local Build All All RESOLVED FIXED InRadar P2 Normal --- 154520 1 dbates dbates ap beidson bfulgham cdumez commit-queue japhet mkwst webkit-bug-importer oldest_to_newest 1167230 0 dbates 2016-02-22 16:11:11 -0800 Following <http://trac.webkit.org/changeset/196892> (bug #154520), the test LayoutTests/http/tests/security/contentSecurityPolicy/1.1/form-action-src-blocked.html crashes the WebContent process when run with GuardMalloc. For convenience, the following is the run-webkit-test command I used to reproduce this crash with a debug build of WebKit: Tools/Scripts/run-webkit-tests --debug -g LayoutTests/http/tests/security/contentSecurityPolicy/1.1/form-action-src-blocked.html 1167231 1 dbates 2016-02-22 16:11:33 -0800 Thread 0 Crashed:: Dispatch queue: com.apple.main-thread 0 com.apple.WebCore 0x00000001050a66d4 WebCore::DocumentLoader::startLoadingMainResource() + 932 1 com.apple.WebKit 0x0000000103b770ce WebKit::WebFrame::didReceivePolicyDecision(unsigned long long, WebCore::PolicyAction, unsigned long long, WebKit::DownloadID) + 192 2 com.apple.WebKit 0x0000000103bbc9d6 void IPC::handleMessage<Messages::WebPage::DidReceivePolicyDecision, WebKit::WebPage, void (WebKit::WebPage::*)(unsigned long long, unsigned long long, unsigned int, unsigned long long, WebKit::DownloadID)>(IPC::MessageDecoder&, WebKit::WebPage*, void (WebKit::WebPage::*)(unsigned long long, unsigned long long, unsigned int, unsigned long long, WebKit::DownloadID)) + 107 3 com.apple.WebKit 0x0000000103a887d1 IPC::MessageReceiverMap::dispatchMessage(IPC::Connection&, IPC::MessageDecoder&) + 113 4 com.apple.WebKit 0x0000000103bfe36e WebKit::WebProcess::didReceiveMessage(IPC::Connection&, IPC::MessageDecoder&) + 28 5 com.apple.WebKit 0x0000000103a4a52f IPC::Connection::dispatchMessage(std::__1::unique_ptr<IPC::MessageDecoder, std::__1::default_delete<IPC::MessageDecoder> >) + 127 6 com.apple.WebKit 0x0000000103a4ce4a IPC::Connection::dispatchOneMessage() + 126 7 com.apple.JavaScriptCore 0x0000000104daa2f5 WTF::RunLoop::performWork() + 437 8 com.apple.JavaScriptCore 0x0000000104daa6a2 WTF::RunLoop::performWork(void*) + 34 9 com.apple.CoreFoundation 0x00007fff9149afe1 __CFRUNLOOP_IS_CALLING_OUT_TO_A_SOURCE0_PERFORM_FUNCTION__ + 17 10 com.apple.CoreFoundation 0x00007fff9147a71c __CFRunLoopDoSources0 + 556 11 com.apple.CoreFoundation 0x00007fff91479c3f __CFRunLoopRun + 927 12 com.apple.CoreFoundation 0x00007fff91479638 CFRunLoopRunSpecific + 296 13 com.apple.HIToolbox 0x00007fff8c62a935 RunCurrentEventLoopInMode + 235 14 com.apple.HIToolbox 0x00007fff8c62a76f ReceiveNextEventCommon + 432 15 com.apple.HIToolbox 0x00007fff8c62a5af _BlockUntilNextEventMatchingListInModeWithFilter + 71 16 com.apple.AppKit 0x00007fff94f10f3a _DPSNextEvent + 1067 17 com.apple.AppKit 0x00007fff94f1036a -[NSApplication _nextEventMatchingEventMask:untilDate:inMode:dequeue:] + 454 18 com.apple.AppKit 0x00007fff94f04ec4 -[NSApplication run] + 682 19 com.apple.AppKit 0x00007fff94ece4ac NSApplicationMain + 1176 20 libxpc.dylib 0x00007fff9634a45e _xpc_objc_main + 793 21 libxpc.dylib 0x00007fff96348e8a xpc_main + 494 22 com.apple.WebKit.WebContent 0x000000010398e7df 0x10398d000 + 6111 23 libdyld.dylib 0x00007fff8f8a85ad start + 1 1167232 2 webkit-bug-importer 2016-02-22 16:12:22 -0800 <rdar://problem/24780678> 1167235 3 dbates 2016-02-22 16:17:24 -0800 This crash only seems to occur when using WebKit2 (why?). When the test is run using WebKitTestRunner (WebKit2) DocumentLoader::refCount() == 1 before calling DocumentLoader::willSendRequest() in DocumentLoader::startLoadingMainResource(). When run using DumpRenderTree (WebKit1) DocumentLoader::refCount() == 3 at the same position. 1167236 4 dbates 2016-02-22 16:18:39 -0800 Regardless of the ref count differences, DocumentLoader::startLoadingMainResource() should hold a ref of itself because DocumentLoader::willSendRequest() may deref us if we are the provisional loader and the load is cancelled. 1167241 5 271966 dbates 2016-02-22 16:32:41 -0800 Created attachment 271966 Patch 1167245 6 271966 dbates 2016-02-22 16:48:42 -0800 Comment on attachment 271966 Patch Clearing flags on attachment: 271966 Committed r196965: <http://trac.webkit.org/changeset/196965> 1167246 7 dbates 2016-02-22 16:48:47 -0800 All reviewed patches have been landed. Closing bug. 271966 2016-02-22 16:32:41 -0800 2016-02-22 16:48:42 -0800 Patch bug-154563-20160222163223.patch text/plain 2049 dbates U3VidmVyc2lvbiBSZXZpc2lvbjogMTk2ODkyCmRpZmYgLS1naXQgYS9Tb3VyY2UvV2ViQ29yZS9D aGFuZ2VMb2cgYi9Tb3VyY2UvV2ViQ29yZS9DaGFuZ2VMb2cKaW5kZXggNzczYTEzN2U2MGM4MjRh ZTE2ZjkzOTVjYTljZDdmNWFkMDY4ZDhlOS4uNzZkM2IyODFkYjYxNTdiMDIwMjEwMzFlMzRjOTM5 OTcwODczYmM3OSAxMDA2NDQKLS0tIGEvU291cmNlL1dlYkNvcmUvQ2hhbmdlTG9nCisrKyBiL1Nv dXJjZS9XZWJDb3JlL0NoYW5nZUxvZwpAQCAtMSwzICsxLDIyIEBACisyMDE2LTAyLTIyICBEYW5p ZWwgQmF0ZXMgIDxkYWJhdGVzQGFwcGxlLmNvbT4KKworICAgICAgICBSRUdSRVNTSU9OIChyMTk2 ODkyKTogQ3Jhc2ggaW4gRG9jdW1lbnRMb2FkZXI6OnN0YXJ0TG9hZGluZ01haW5SZXNvdXJjZSgp CisgICAgICAgIGh0dHBzOi8vYnVncy53ZWJraXQub3JnL3Nob3dfYnVnLmNnaT9pZD0xNTQ1NjMK KyAgICAgICAgPHJkYXI6Ly9wcm9ibGVtLzI0NzgwNjc4PgorCisgICAgICAgIFJldmlld2VkIGJ5 IE5PQk9EWSAoT09QUyEpLgorCisgICAgICAgIEZpeGVzIGFuIGlzc3VlIHdoZXJlIHRoZSBwcm92 aXNpb25hbCBsb2FkZXIgbWF5IGJlIGRlYWxsb2NhdGVkIHdoZW4gc3RhcnRpbmcKKyAgICAgICAg YSBsb2FkLiBPbmUgZXhhbXBsZSB3aGVyZSB0aGlzIGNhbiBvY2N1ciBpcyB3aGVuIGNhbmNlbGxp bmcgdGhlIHByb3Zpc2lvbmFsIGxvYWQKKyAgICAgICAgYXMgcGFydCBvZiBhIGZvcm0gc3VibWlz c2lvbiBiZWNhdXNlIHRoZSBDb250ZW50IFNlY3VyaXR5IFBvbGljeSBvZiB0aGUgcGFnZQorICAg ICAgICBibG9ja3MgdGhlIHN1Ym1pc3Npb24gKGl0IHZpb2xhdGVzIHRoZSBkaXJlY3RpdmUgZm9y bS1hY3Rpb24pLgorCisgICAgICAgIFRoaXMgY3Jhc2ggaXMgY292ZXJlZCBieSB0aGUgdGVzdCBo dHRwL3Rlc3RzL3NlY3VyaXR5L2NvbnRlbnRTZWN1cml0eVBvbGljeS8xLjEvZm9ybS1hY3Rpb24t c3JjLWJsb2NrZWQuaHRtbC4KKworICAgICAgICAqIGxvYWRlci9Eb2N1bWVudExvYWRlci5jcHA6 CisgICAgICAgIChXZWJDb3JlOjpEb2N1bWVudExvYWRlcjo6c3RhcnRMb2FkaW5nTWFpblJlc291 cmNlKTogVGFrZSBhIHJlZiBiZWZvcmUgY2FsbGluZworICAgICAgICBEb2N1bWVudExvYWRlcjo6 d2lsbFNlbmRSZXF1ZXN0KCkuCisKIDIwMTYtMDItMjEgIERhbmllbCBCYXRlcyAgPGRhYmF0ZXNA YXBwbGUuY29tPgogCiAgICAgICAgIENTUDogRW5hYmxlIGZvcm0tYWN0aW9uIGRpcmVjdGl2ZSBi eSBkZWZhdWx0CmRpZmYgLS1naXQgYS9Tb3VyY2UvV2ViQ29yZS9sb2FkZXIvRG9jdW1lbnRMb2Fk ZXIuY3BwIGIvU291cmNlL1dlYkNvcmUvbG9hZGVyL0RvY3VtZW50TG9hZGVyLmNwcAppbmRleCAw M2NmNDQ5NmMwMzI0NTE2MWQ1OGVkY2EzYmZhYzljZTBjNDU2ODY5Li41ZTVlY2E4NWM5ODdhOTIy NGU4ODgzNTVlNmZhOTNhZmI0OTk2ZWMxIDEwMDY0NAotLS0gYS9Tb3VyY2UvV2ViQ29yZS9sb2Fk ZXIvRG9jdW1lbnRMb2FkZXIuY3BwCisrKyBiL1NvdXJjZS9XZWJDb3JlL2xvYWRlci9Eb2N1bWVu dExvYWRlci5jcHAKQEAgLTE0NjQsNiArMTQ2NCw4IEBAIHZvaWQgRG9jdW1lbnRMb2FkZXI6OnN0 YXJ0TG9hZGluZ01haW5SZXNvdXJjZSgpCiAgICAgQVNTRVJUKHRpbWluZygpLm5hdmlnYXRpb25T dGFydCgpKTsKICAgICBBU1NFUlQoIXRpbWluZygpLmZldGNoU3RhcnQoKSk7CiAgICAgdGltaW5n KCkubWFya0ZldGNoU3RhcnQoKTsKKworICAgIFJlZjxEb2N1bWVudExvYWRlcj4gcHJvdGVjdCgq dGhpcyk7IC8vIHdpbGxTZW5kUmVxdWVzdCgpIG1heSBkZWFsbG9jYXRlIHRoZSBwcm92aXNpb25h bCBsb2FkZXIgKHdoaWNoIG1heSBiZSB1cykgaWYgaXQgY2FuY2VscyB0aGUgbG9hZC4KICAgICB3 aWxsU2VuZFJlcXVlc3QobV9yZXF1ZXN0LCBSZXNvdXJjZVJlc3BvbnNlKCkpOwogCiAgICAgLy8g d2lsbFNlbmRSZXF1ZXN0KCkgbWF5IGxlYWQgdG8gb3VyIEZyYW1lIGJlaW5nIGRldGFjaGVkIG9y IGNhbmNlbGxpbmcgdGhlIGxvYWQgdmlhIG51bGxpbmcgdGhlIFJlc291cmNlUmVxdWVzdC4K