167673 2017-01-31 15:49:11 -0800 WebProcess crashes in int WTF::__throw_bad_variant_access<int> when expanding/shrinking a block selection 2017-02-04 18:21:17 -0800 1 1 1 Unclassified WebKit HTML Editing WebKit Nightly Build Unspecified Unspecified RESOLVED FIXED P2 Normal --- 1 enrica webkit-unassigned andersca darin thorton oldest_to_newest 1271959 0 enrica 2017-01-31 15:49:11 -0800 There are no reproducible steps for this crash but the crash log indicates that it occurs expanding/shrinking a block selection on iOS in Safari. Here is the stack trace of the crash: Thread 0 name: Dispatch queue: com.apple.main-thread Thread 0 Crashed ↩: 0 WebKit 0x00000001935ac708 int WTF::__throw_bad_variant_access<int>(char const*) + 36 (Variant.h:120) 1 WebKit 0x00000001935ac708 int WTF::__throw_bad_variant_access<int>(char const*) + 36 (Variant.h:120) 2 WebKit 0x000000019359fd88 WebKit::containsRange(WebCore::Range*, WebCore::Range*) + 324 (Variant.h:1808) 3 WebKit 0x000000019359f708 WebKit::WebPage::expandedRangeFromHandle(WebCore::Range*, WebKit::SelectionHandlePosition) + 560 (WebPageIOS.mm:1339) 4 WebKit 0x00000001935a0478 WebKit::WebPage::computeExpandAndShrinkThresholdsForHandle(WebCore::IntPoint const&, WebKit::SelectionHandlePosition, float&, float&) + 136 (WebPageIOS.mm:1526) 5 WebKit 0x00000001935a0ff0 WebKit::WebPage::updateSelectionWithTouches(WebCore::IntPoint const&, unsigned int, bool, unsigned long long) + 756 (WebPageIOS.mm:1744) 6 WebKit 0x00000001935b2b6c void IPC::handleMessage<Messages::WebPage::UpdateSelectionWithTouches, WebKit::WebPage, void (WebKit::WebPage::*)(WebCore::IntPoint const&, unsigned int, bool, unsigned long long)>(IPC::Decoder&, WebKit::WebPage*, void (WebKit::WebPage::*)(WebCore::IntPoint const&, unsigned int, bool, unsigned long long)) + 76 (HandleMessage.h:46) 7 WebKit 0x0000000193482828 IPC::MessageReceiverMap::dispatchMessage(IPC::Connection&, IPC::Decoder&) + 120 (MessageReceiverMap.cpp:123) 8 WebKit 0x0000000193611d8c WebKit::WebProcess::didReceiveMessage(IPC::Connection&, IPC::Decoder&) + 36 (WebProcess.cpp:638) 9 WebKit 0x0000000193448918 IPC::Connection::dispatchMessage(std::__1::unique_ptr<IPC::Decoder, std::__1::default_delete<IPC::Decoder> >) + 164 (Connection.cpp:897) 10 WebKit 0x000000019344b104 IPC::Connection::dispatchOneMessage() + 232 (Connection.cpp:955) 11 JavaScriptCore 0x000000018e358c24 WTF::RunLoop::performWork() + 172 (Function.h:50) 12 JavaScriptCore 0x000000018e358efc WTF::RunLoop::performWork(void*) + 36 (RunLoopCF.cpp:38) rdar://problem/30229620 1272297 1 300358 enrica 2017-02-01 15:06:01 -0800 Created attachment 300358 Patch 1272304 2 enrica 2017-02-01 15:26:55 -0800 Committed revision 211538. 1273337 3 darin 2017-02-04 18:21:17 -0800 Thanks for fixing this; my fault. Can someone figure out how to make us a regression test for this? 300358 2017-02-01 15:06:01 -0800 2017-02-01 15:08:18 -0800 Patch variant-assert.txt text/plain 2801 enrica SW5kZXg6IFNvdXJjZS9XZWJLaXQyL0NoYW5nZUxvZwo9PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09Ci0tLSBTb3VyY2UvV2Vi S2l0Mi9DaGFuZ2VMb2cJKHJldmlzaW9uIDIxMTQ5OCkKKysrIFNvdXJjZS9XZWJLaXQyL0NoYW5n ZUxvZwkod29ya2luZyBjb3B5KQpAQCAtMSwzICsxLDIxIEBACisyMDE3LTAyLTAxICBFbnJpY2Eg Q2FzdWNjaSAgPGVucmljYUBhcHBsZS5jb20+CisKKyAgICAgICAgV2ViUHJvY2VzcyBjcmFzaGVz IGluICBpbnQgV1RGOjpfX3Rocm93X2JhZF92YXJpYW50X2FjY2VzczxpbnQ+IHdoZW4gZXhwYW5k aW5nL3Nocmlua2luZyBhIGJsb2NrIHNlbGVjdGlvbi4KKyAgICAgICAgaHR0cHM6Ly9idWdzLndl YmtpdC5vcmcvc2hvd19idWcuY2dpP2lkPTE2NzY3MworICAgICAgICByZGFyOi8vcHJvYmxlbS8z MDIyOTYyMAorCisgICAgICAgIFRoaXMgaXMgYSBzcGVjdWxhdGl2ZSBmaXggZm9yIGEgYnVnIHRo YXQgbWlnaHQgaGF2ZSBiZWVuIGludHJvZHVjZWQKKyAgICAgICAgd2l0aCBodHRwOi8vdHJhYy53 ZWJraXQub3JnL2NoYW5nZXNldC8yMDg0NzkuCisgICAgICAgIFRoZSBjb2RlIGluIGNvbnRhaW5z UmFuZ2UgaW5saW5lIGZ1Y3Rpb24gaW4gV2ViUGFnZUlPUy5tbSBoYXMgbm90IGJlZW4KKyAgICAg ICAgdXBkYXRlZCB3aGVuIHRoZSByZXR1cm4gdmFsdWUgb2YgUmFuZ2U6OmNvbXBhcmVCb3VuZGFy eVBvaW50cyB3YXMgY2hhbmdlZAorICAgICAgICB0byBFeGNlcHRpb25PcjxzaG9ydD4uCisgICAg ICAgIFNpbmNlIHRoZXJlIGlzIGFscmVhZHkgYSBtZXRob2QgY29udGFpbnNSYW5nZSBpbiB0aGUg UmFuZ2UgY2xhc3MgdGhhdAorICAgICAgICBkb2VzIHRoZSByaWdodCB0aGluZywgZXhwYW5kZWRS YW5nZUZyb21IYW5kbGUgbm93IHVzZXMgdGhhdC4KKworICAgICAgICAqIFdlYlByb2Nlc3MvV2Vi UGFnZS9pb3MvV2ViUGFnZUlPUy5tbToKKyAgICAgICAgKFdlYktpdDo6V2ViUGFnZTo6ZXhwYW5k ZWRSYW5nZUZyb21IYW5kbGUpOgorICAgICAgICAoV2ViS2l0Ojpjb250YWluc1JhbmdlKTogRGVs ZXRlZC4KKwogMjAxNy0wMi0wMSAgQW5kcmVhcyBLbGluZyAgPGFrbGluZ0BhcHBsZS5jb20+CiAK ICAgICAgICAgSW1wbGVtZW50IHRoZSBhbHdheXNSdW5zQXRCYWNrZ3JvdW5kUHJpb3JpdHkgV0sy IHNldHRpbmcgdXNpbmcgdGhyZWFkIFFvUy4KSW5kZXg6IFNvdXJjZS9XZWJLaXQyL1dlYlByb2Nl c3MvV2ViUGFnZS9pb3MvV2ViUGFnZUlPUy5tbQo9PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09Ci0tLSBTb3VyY2UvV2ViS2l0 Mi9XZWJQcm9jZXNzL1dlYlBhZ2UvaW9zL1dlYlBhZ2VJT1MubW0JKHJldmlzaW9uIDIxMTQ5OCkK KysrIFNvdXJjZS9XZWJLaXQyL1dlYlByb2Nlc3MvV2ViUGFnZS9pb3MvV2ViUGFnZUlPUy5tbQko d29ya2luZyBjb3B5KQpAQCAtMTI3MiwxNSArMTI3Miw2IEBAIHN0YXRpYyBpbmxpbmUgYm9vbCBy ZWN0c0Vzc2VudGlhbGx5VGhlU2EKICAgICAgICAgJiYgKGhlaWdodFJhdGlvID4gbWluTWFnbml0 dWRlUmF0aW8gJiYgeU9yaWdpblNoaWZ0UmF0aW8gPCBtYXhEaXNwbGFjZW1lbnRSYXRpbykpOwog fQogCi1zdGF0aWMgaW5saW5lIGJvb2wgY29udGFpbnNSYW5nZShSYW5nZSogZmlyc3QsIFJhbmdl KiBzZWNvbmQpCi17Ci0gICAgaWYgKCFmaXJzdCB8fCAhc2Vjb25kKQotICAgICAgICByZXR1cm4g ZmFsc2U7Ci0gICAgcmV0dXJuIGZpcnN0LT5jb21tb25BbmNlc3RvckNvbnRhaW5lcigpLT5vd25l ckRvY3VtZW50KCkgPT0gc2Vjb25kLT5jb21tb25BbmNlc3RvckNvbnRhaW5lcigpLT5vd25lckRv Y3VtZW50KCkKLSAgICAgICAgJiYgZmlyc3QtPmNvbXBhcmVCb3VuZGFyeVBvaW50cyhSYW5nZTo6 U1RBUlRfVE9fU1RBUlQsICpzZWNvbmQpLnJlbGVhc2VSZXR1cm5WYWx1ZSgpIDw9IDAKLSAgICAg ICAgJiYgZmlyc3QtPmNvbXBhcmVCb3VuZGFyeVBvaW50cyhSYW5nZTo6RU5EX1RPX0VORCwgKnNl Y29uZCkucmVsZWFzZVJldHVyblZhbHVlKCkgPj0gMDsKLX0KLQogc3RhdGljIGlubGluZSBSZWZQ dHI8UmFuZ2U+IHVuaW9uRE9NUmFuZ2VzKFJhbmdlKiByYW5nZUEsIFJhbmdlKiByYW5nZUIpCiB7 CiAgICAgaWYgKCFyYW5nZUIpCkBAIC0xMzUwLDkgKzEzNDEsOSBAQCBQYXNzUmVmUHRyPFJhbmdl PiBXZWJQYWdlOjpleHBhbmRlZFJhbmdlCiAgICAgICAgIGlmICghcmFuZ2VBdFBvc2l0aW9uIHx8 ICZjdXJyZW50UmFuZ2UtPm93bmVyRG9jdW1lbnQoKSAhPSAmcmFuZ2VBdFBvc2l0aW9uLT5vd25l ckRvY3VtZW50KCkpCiAgICAgICAgICAgICBjb250aW51ZTsKIAotICAgICAgICBpZiAoY29udGFp bnNSYW5nZShyYW5nZUF0UG9zaXRpb24uZ2V0KCksIGN1cnJlbnRSYW5nZSkpCisgICAgICAgIGlm IChyYW5nZUF0UG9zaXRpb24tPmNvbnRhaW5zKCpjdXJyZW50UmFuZ2UpKQogICAgICAgICAgICAg bmV3UmFuZ2UgPSByYW5nZUF0UG9zaXRpb247Ci0gICAgICAgIGVsc2UgaWYgKGNvbnRhaW5zUmFu Z2UoY3VycmVudFJhbmdlLCByYW5nZUF0UG9zaXRpb24uZ2V0KCkpKQorICAgICAgICBlbHNlIGlm IChjdXJyZW50UmFuZ2UtPmNvbnRhaW5zKCpyYW5nZUF0UG9zaXRpb24uZ2V0KCkpKQogICAgICAg ICAgICAgbmV3UmFuZ2UgPSBjdXJyZW50UmFuZ2U7CiAgICAgICAgIGVsc2UKICAgICAgICAgICAg IG5ld1JhbmdlID0gdW5pb25ET01SYW5nZXMoY3VycmVudFJhbmdlLCByYW5nZUF0UG9zaXRpb24u Z2V0KCkpOwo=