159722 2016-07-13 09:37:40 -0700 v2: WebContent crash due to RELEASE_ASSERT(!m_inLoadPendingImages) in StyleResolver::~StyleResolver() 2016-07-13 12:19:31 -0700 1 1 1 Unclassified WebKit CSS WebKit Nightly Build Unspecified Unspecified RESOLVED FIXED InRadar P2 Normal --- 1 koivisto webkit-unassigned cdumez commit-queue esprehn+autocc kangil.han simon.fraser webkit-bug-importer oldest_to_newest 1210493 0 koivisto 2016-07-13 09:37:40 -0700 Thread 0 name: Dispatch queue: com.apple.main-thread Thread 0 Crashed ↩: 0 WebCore 0x000000018fa989dc WebCore::StyleResolver::~StyleResolver() + 500 (StyleResolver.cpp:318) 1 WebCore 0x000000018fa987bc WebCore::Document::clearStyleResolver() + 32 (memory:2525) 2 WebCore 0x000000018fa987bc WebCore::Document::clearStyleResolver() + 32 (memory:2525) 3 WebCore 0x000000018fc84fdc WebCore::AuthorStyleSheets::updateActiveStyleSheets(WebCore::AuthorStyleSheets::UpdateFlag) + 484 (AuthorStyleSheets.cpp:317) 4 WebCore 0x000000018fa976e8 WebCore::Document::styleResolverChanged(WebCore::StyleResolverUpdateFlag) + 116 (Document.cpp:3671) 5 WebKit 0x000000019466a324 WebKit::WebPage::viewportConfigurationChanged() + 196 (WebPageIOS.mm:2934) 6 WebKit 0x000000019465d5e0 WebKit::WebPage::mainFrameDidLayout() + 156 (WebPage.cpp:3807) 7 WebCore 0x000000018fadad1c WebCore::FrameView::performPostLayoutTasks() + 292 (FrameView.cpp:3198) 8 WebCore 0x000000018fad6ec4 WebCore::FrameView::layout(bool) + 3536 (FrameView.cpp:1493) 9 WebCore 0x000000018fad3bd4 WebCore::Document::implicitClose() + 788 (Document.cpp:2797) 10 WebCore 0x000000018fad2fd4 WebCore::FrameLoader::checkCompleted() + 352 (FrameLoader.cpp:869) 11 WebCore 0x000000018fb04a88 WebCore::CachedResourceLoader::loadDone(WebCore::CachedResource*, bool) + 124 (CachedResourceLoader.cpp:985) 12 WebCore 0x000000018fb06afc WebCore::SubresourceLoader::didCancel(WebCore::ResourceError const&) + 92 (SubresourceLoader.cpp:519) 13 WebCore 0x000000018fb06500 WebCore::ResourceLoader::cancel(WebCore::ResourceError const&) + 476 (ResourceLoader.cpp:598) 14 WebCore 0x000000018fb06298 WebCore::ResourceLoader::cancel() + 64 (ResourceLoader.cpp:554) 15 WebCore 0x0000000190817e10 WebCore::SubresourceLoader::willSendRequestInternal(WebCore::ResourceRequest&, WebCore::ResourceResponse const&) + 836 (SubresourceLoader.cpp:222) 16 WebCore 0x000000018fa78378 WebCore::ResourceLoader::init(WebCore::ResourceRequest const&) + 284 (ResourceLoader.cpp:146) 17 WebCore 0x000000018fa78114 WebCore::SubresourceLoader::init(WebCore::ResourceRequest const&) + 32 (SubresourceLoader.cpp:144) 18 WebCore 0x00000001908179f8 WebCore::SubresourceLoader::create(WebCore::Frame&, WebCore::CachedResource&, WebCore::ResourceRequest const&, WebCore::ResourceLoaderOptions const&) + 196 (SubresourceLoader.cpp:112) 19 WebKit 0x000000019464c724 WebKit::WebLoaderStrategy::loadResource(WebCore::Frame&, WebCore::CachedResource&, WebCore::ResourceRequest const&, WebCore::ResourceLoaderOptions const&) + 52 (WebLoaderStrategy.cpp:76) 20 WebCore 0x000000018fcb75ec WebCore::CachedResource::load(WebCore::CachedResourceLoader&, WebCore::ResourceLoaderOptions const&) + 1136 (CachedResource.cpp:291) 21 WebCore 0x000000018fa75288 WebCore::CachedResourceLoader::requestResource(WebCore::CachedResource::Type, WebCore::CachedResourceRequest&) + 2060 (CachedResourceLoader.cpp:642) 22 WebCore 0x000000018fb1268c WebCore::CachedResourceLoader::requestImage(WebCore::CachedResourceRequest&) + 284 (CachedResourceLoader.cpp:192) 23 WebCore 0x000000018fd729ac WebCore::CSSImageValue::cachedImage(WebCore::CachedResourceLoader&, WebCore::ResourceLoaderOptions const&) + 448 (CSSImageValue.cpp:89) 24 WebCore 0x000000019035c520 WebCore::Style::loadPendingImage(WebCore::Document&, WebCore::StyleImage const&, WebCore::Element const*, WebCore::Style::LoadPolicy) + 168 (StylePendingResources.cpp:60) 25 WebCore 0x000000019035c148 WebCore::Style::loadPendingResources(WebCore::Style::PendingResources const&, WebCore::Document&, WebCore::RenderStyle&, WebCore::Element const*) + 1876 (StylePendingResources.cpp:86) 26 WebCore 0x000000019080233c WebCore::StyleResolver::applyMatchedProperties(WebCore::StyleResolver::MatchResult const&, WebCore::Element const&, WebCore::StyleResolver::ShouldUseMatchedPropertiesCache) + 2316 (StyleResolver.cpp:2115) 27 WebCore 0x00000001908043e0 WebCore::StyleResolver::pseudoStyleForElement(WebCore::Element const&, WebCore::PseudoStyleRequest const&, WebCore::RenderStyle const&) + 596 (StyleResolver.cpp:650) 28 WebCore 0x000000019061fe84 WebCore::RenderElement::getCachedPseudoStyle(WebCore::PseudoId, WebCore::RenderStyle const*) const + 128 (RenderElement.cpp:1546) 29 WebCore 0x00000001906ec0d8 WebCore::RenderTreeUpdater::updateBeforeOrAfterPseudoElement(WebCore::Element&, WebCore::PseudoId) + 320 (RenderTreeUpdater.cpp:465) 30 WebCore 0x00000001906ec2e0 WebCore::RenderTreeUpdater::popParent() + 64 (RenderTreeUpdater.cpp:194) 31 WebCore 0x00000001906eb090 WebCore::RenderTreeUpdater::updateRenderTree(WebCore::ContainerNode&) + 736 (RenderTreeUpdater.cpp:207) 32 WebCore 0x00000001906ead50 WebCore::RenderTreeUpdater::commit(std::__1::unique_ptr<WebCore::Style::Update, std::__1::default_delete<WebCore::Style::Update> >) + 500 (RenderTreeUpdater.cpp:101) 33 WebCore 0x000000018fe09dd4 WebCore::Document::recalcStyle(WebCore::Style::Change) + 624 (Document.cpp:1926) 34 WebCore 0x000000018fad21b4 WebCore::Document::finishedParsing() + 340 (Document.cpp:1972) 35 WebCore 0x000000018facfb8c WebCore::HTMLDocumentParser::prepareToStopParsing() + 172 (HTMLDocumentParser.cpp:405) 36 WebCore 0x000000018facf0a8 WebCore::DocumentWriter::end() + 92 (DocumentWriter.cpp:272) 37 WebCore 0x000000018fac6d54 WebCore::DocumentLoader::finishedLoading(double) + 256 (DocumentLoader.cpp:437) 38 WebCore 0x000000018fb0437c WebCore::CachedResource::checkNotify() + 448 (CachedResource.cpp:307) 39 WebCore 0x000000018fcb5de8 WebCore::CachedRawResource::finishLoading(WebCore::SharedBuffer*) + 224 (CachedRawResource.cpp:103) 40 WebCore 0x000000018fb04060 WebCore::SubresourceLoader::didFinishLoading(double) + 1020 (SubresourceLoader.cpp:440) 41 WebKit 0x00000001946f7aa8 WebKit::WebResourceLoader::didFinishResourceLoad(double) + 216 (WebResourceLoader.cpp:158) 42 WebKit 0x00000001946f82e0 WebKit::WebResourceLoader::didReceiveWebResourceLoaderMessage(IPC::Connection&, IPC::MessageDecoder&) + 308 (HandleMessage.h:16) 43 WebKit 0x0000000194539194 IPC::Connection::dispatchMessage(std::__1::unique_ptr<IPC::MessageDecoder, std::__1::default_delete<IPC::MessageDecoder> >) + 160 (Connection.cpp:887) 44 WebKit 0x000000019453b770 IPC::Connection::dispatchOneMessage() + 204 (Connection.cpp:949) 1210494 1 koivisto 2016-07-13 09:38:14 -0700 rdar://problem/27306545 1210500 2 283540 koivisto 2016-07-13 10:00:47 -0700 Created attachment 283540 Patch 1210548 3 simon.fraser 2016-07-13 11:27:26 -0700 Shouldn't we instead try to avoid the call into FrameView::layout() under Document::recalcStyle(), which would require making something under the ResourceLoader::cancel() code path async? 1210551 4 koivisto 2016-07-13 11:34:28 -0700 (In reply to comment #3) > Shouldn't we instead try to avoid the call into FrameView::layout() under > Document::recalcStyle(), which would require making something under the > ResourceLoader::cancel() code path async? Yes but those are all complex and risky changes. 1210553 5 koivisto 2016-07-13 11:36:11 -0700 What we really want is to not trigger loads synchronously from the style resolver in the first place. 1210571 6 283540 kling 2016-07-13 12:07:39 -0700 Comment on attachment 283540 Patch r=me It would be good to eventually move to a system where we gather all the loads we need to schedule and fire them at a later point instead of initiating them synchronously from loadPendingImages. That would sidestep the hackish situation Simon raised concerns about. 1210582 7 koivisto 2016-07-13 12:19:31 -0700 https://trac.webkit.org/r203172 283540 2016-07-13 10:00:47 -0700 2016-07-13 12:07:39 -0700 Patch load-pending-v2.patch text/plain 3376 koivisto SW5kZXg6IFNvdXJjZS9XZWJDb3JlL0NoYW5nZUxvZwo9PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09Ci0tLSBTb3VyY2UvV2Vi Q29yZS9DaGFuZ2VMb2cJKHJldmlzaW9uIDIwMzE2NCkKKysrIFNvdXJjZS9XZWJDb3JlL0NoYW5n ZUxvZwkod29ya2luZyBjb3B5KQpAQCAtMSwzICsxLDM5IEBACisyMDE2LTA3LTEzICBBbnR0aSBL b2l2aXN0byAgPGFudHRpQGFwcGxlLmNvbT4KKworICAgICAgICB2MjogV2ViQ29udGVudCBjcmFz aCBkdWUgdG8gUkVMRUFTRV9BU1NFUlQoIW1faW5Mb2FkUGVuZGluZ0ltYWdlcykgaW4gU3R5bGVS ZXNvbHZlcjo6flN0eWxlUmVzb2x2ZXIoKQorICAgICAgICBodHRwczovL2J1Z3Mud2Via2l0Lm9y Zy9zaG93X2J1Zy5jZ2k/aWQ9MTU5NzIyCisKKyAgICAgICAgUmV2aWV3ZWQgYnkgTk9CT0RZIChP T1BTISkuCisKKyAgICAgICAgV2UgaGF2ZSBjcmFzaGVzIHdoZXJlIGEgU3R5bGVSZXNvbHZlciBp cyBkZWxldGVkIHVuZGVybmVhdGggcHNldWRvU3R5bGVGb3JFbGVtZW50IChrZXkgcGFydHMgb2Yg dGhlIHN0YWNrKToKKworICAgICAgICAwICAgV2ViQ29yZTo6U3R5bGVSZXNvbHZlcjo6flN0eWxl UmVzb2x2ZXIKKyAgICAgICAgMyAgIFdlYkNvcmU6OkF1dGhvclN0eWxlU2hlZXRzOjp1cGRhdGVB Y3RpdmVTdHlsZVNoZWV0cworICAgICAgICA0ICAgV2ViQ29yZTo6RG9jdW1lbnQ6OnN0eWxlUmVz b2x2ZXJDaGFuZ2VkCisgICAgICAgIDUgICBXZWJLaXQ6OldlYlBhZ2U6OnZpZXdwb3J0Q29uZmln dXJhdGlvbkNoYW5nZWQoKQorICAgICAgICA2ICAgV2ViS2l0OjpXZWJQYWdlOjptYWluRnJhbWVE aWRMYXlvdXQoKQorICAgICAgICA5ICAgV2ViQ29yZTo6RnJhbWVMb2FkZXI6OmNoZWNrQ29tcGxl dGVkCisgICAgICAgIDEzICBXZWJDb3JlOjpSZXNvdXJjZUxvYWRlcjo6Y2FuY2VsCisgICAgICAg IDE5ICBXZWJLaXQ6OldlYkxvYWRlclN0cmF0ZWd5Ojpsb2FkUmVzb3VyY2UKKyAgICAgICAgMjQg IFdlYkNvcmU6OlN0eWxlOjpsb2FkUGVuZGluZ0ltYWdlCisgICAgICAgIDI3ICBXZWJDb3JlOjpT dHlsZVJlc29sdmVyOjpwc2V1ZG9TdHlsZUZvckVsZW1lbnQKKyAgICAgICAgMjkgIFdlYkNvcmU6 OlJlbmRlclRyZWVVcGRhdGVyOjp1cGRhdGVCZWZvcmVPckFmdGVyUHNldWRvRWxlbWVudAorICAg ICAgICAzMyAgV2ViQ29yZTo6RG9jdW1lbnQ6OnJlY2FsY1N0eWxlCisKKyAgICAgICAgVGhpcyBh cHBlYXJzIHRvIGJlIGhhcHBlbmluZyB3aGVuIGEgY29udGVudCBibG9ja2VyIGJsb2NrcyBhIHJl c291cmNlIGxvYWQgZm9yIGFuIGltYWdlIHJlZmVyZW5jZWQgZnJvbSBhIHN0eWxlc2hlZXQKKyAg ICAgICAgYW5kIHRyaWdnZXJzIHN5bmNocm9ub3VzIGNhbmNlbGxhdGlvbiBvZiB0aGUgbG9hZC4g V2l0aCBlbmdpbmUgaW4gc3VpdGFibGUgc3RhdGUgdGhpcyBjYW4gY2xlYXIgc3R5bGUgcmVzb2x2 ZXIuCisKKyAgICAgICAgTm8gdGVzdCwgZG9uJ3Qga25vdyBob3cgdG8gbWFrZSBvbmUuIFRoaXMg aXMgdmVyeSB0aW1pbmcgYW5kIGVuZ2luZSBzdGF0ZSBkZXBlbmRlbnQuCisKKyAgICAgICAgKiBk b20vQXV0aG9yU3R5bGVTaGVldHMuY3BwOgorICAgICAgICAoV2ViQ29yZTo6QXV0aG9yU3R5bGVT aGVldHM6OnVwZGF0ZUFjdGl2ZVN0eWxlU2hlZXRzKToKKworICAgICAgICBXZSBoYXZlIGFuIGV4 aXN0aW5nIGNoZWNrIGhlcmUgdGhhdCBwcmV2ZW50cyBkZXN0cnVjdGlvbiBvZiB0aGUgc3R5bGUg cmVzb2x2ZXIgd2hlbiB3ZSBhcmUgaW4gdGhlIG1pZGRsZSBvZgorICAgICAgICBhIHN0eWxlIHJl c29sdXRpb24uIEhvd2V2ZXIgdGhlIG9sZCBpblN0eWxlUmVjYWxjKCkgYml0IG5vIGxvbmdlciBj b3ZlcnMgdGhlIHJlbmRlciB0cmVlIHVwZGF0ZSBwaGFzZS4gUHNldWRvCisgICAgICAgIGVsZW1l bnRzIGFyZSByZXNvbHZlZCBkdXJpbmcgcmVuZGVyIHRyZWUgdXBkYXRlLgorCisgICAgICAgIEZp eCBieSBhZGRpbmcgYSBjaGVjayBmb3IgaW5SZW5kZXJUcmVlVXBkYXRlKCkgYml0IHRvby4KKwog MjAxNi0wNy0xMyAgRnJlZGVyaWMgV2FuZyAgPGZ3YW5nQGlnYWxpYS5jb20+CiAKICAgICAgICAg VGhlIGRpc3BsYXkgcHJvcGVydHkgb2YgbWFueSBNYXRoTUwgZWxlbWVudHMgY2FuIG5vdCBiZSBv dmVycmlkZW4gYnkgcGFnZSBhdXRob3JzCkluZGV4OiBTb3VyY2UvV2ViQ29yZS9kb20vQXV0aG9y U3R5bGVTaGVldHMuY3BwCj09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT0KLS0tIFNvdXJjZS9XZWJDb3JlL2RvbS9BdXRob3JT dHlsZVNoZWV0cy5jcHAJKHJldmlzaW9uIDIwMzAyOSkKKysrIFNvdXJjZS9XZWJDb3JlL2RvbS9B dXRob3JTdHlsZVNoZWV0cy5jcHAJKHdvcmtpbmcgY29weSkKQEAgLTI5MSwxMCArMjkxLDEwIEBA IHN0YXRpYyB2b2lkIGZpbHRlckVuYWJsZWROb25lbXB0eUNTU1N0eWwKIAogYm9vbCBBdXRob3JT dHlsZVNoZWV0czo6dXBkYXRlQWN0aXZlU3R5bGVTaGVldHMoVXBkYXRlRmxhZyB1cGRhdGVGbGFn KQogewotICAgIGlmIChtX2RvY3VtZW50LmluU3R5bGVSZWNhbGMoKSkgewotICAgICAgICAvLyBT VkcgPHVzZT4gZWxlbWVudCBtYXkgbWFuYWdlIHRvIGludmFsaWRhdGUgc3R5bGUgc2VsZWN0b3Ig aW4gdGhlIG1pZGRsZSBvZiBhIHN0eWxlIHJlY2FsYy4KLSAgICAgICAgLy8gaHR0cHM6Ly9idWdz LndlYmtpdC5vcmcvc2hvd19idWcuY2dpP2lkPTU0MzQ0Ci0gICAgICAgIC8vIEZJWE1FOiBUaGlz IHNob3VsZCBiZSBmaXhlZCBpbiBTVkcgYW5kIHRoZSBjYWxsIHNpdGUgcmVwbGFjZWQgYnkgQVNT RVJUKCFtX2luU3R5bGVSZWNhbGMpLgorICAgIGlmIChtX2RvY3VtZW50LmluU3R5bGVSZWNhbGMo KSB8fCBtX2RvY3VtZW50LmluUmVuZGVyVHJlZVVwZGF0ZSgpKSB7CisgICAgICAgIC8vIFByb3Rl Y3QgYWdhaW5zdCBkZWxldGluZyBzdHlsZSByZXNvbHZlciBpbiB0aGUgbWlkZGxlIG9mIGEgc3R5 bGUgcmVzb2x1dGlvbi4KKyAgICAgICAgLy8gQ3Jhc2ggc3RhY2tzIGluZGljYXRlIHdlIGNhbiBn ZXQgaGVyZSB3aGVuIHJlc291cmNlIGxvYWQgZmFpbHMgc3luY2hyb25vdXNseSAoZm9yIGV4YW1w bGUgZHVlIHRvIGNvbnRlbnQgYmxvY2tpbmcpLgorICAgICAgICAvLyBGSVhNRTogVGhlc2Uga2lu ZCBvZiBjYXNlcyBzaG91bGQgYmUgZWxpbWluYXRlZCBhbmQgdGhpcyBwYXRoIHJlcGxhY2VkIGJ5 IGFuIGFzc2VydC4KICAgICAgICAgbV9wZW5kaW5nVXBkYXRlVHlwZSA9IEZ1bGxVcGRhdGU7CiAg ICAgICAgIG1fZG9jdW1lbnQuc2NoZWR1bGVGb3JjZWRTdHlsZVJlY2FsYygpOwogICAgICAgICBy ZXR1cm4gZmFsc2U7Cg==