174473 2017-07-13 13:24:21 -0700 PageCache::removeAllItemsForPage(Page&) may reenter itself and cause crashes 2017-07-14 01:17:15 -0700 1 1 1 Unclassified WebKit WebCore Misc. WebKit Nightly Build Unspecified Unspecified RESOLVED FIXED InRadar P2 Normal --- 1 cdumez cdumez beidson commit-queue kling koivisto webkit-bug-importer oldest_to_newest 1328543 0 cdumez 2017-07-13 13:24:21 -0700 PageCache::removeAllItemsForPage(Page&) may reenter itself and cause crashes: Thread 6 name: WebThread Thread 6 Crashed: 0 WebCore 0x00000001941fb74c WebCore::PageCache::removeAllItemsForPage(WebCore::Page&) + 44 (CachedPage.h:45) 1 WebCore 0x00000001941f4e90 WebCore::Page::~Page() + 380 (Page.cpp:321) 2 WebCore 0x00000001941f4e90 WebCore::Page::~Page() + 380 (Page.cpp:321) 3 WebCore 0x0000000194513f1c WebCore::SVGImage::~SVGImage() + 64 (memory:2537) 4 WebCore 0x0000000194513f90 WebCore::SVGImage::~SVGImage() + 12 (SVGImage.cpp:72) 5 WebCore 0x00000001936e75a8 WebCore::CachedImage::~CachedImage() + 232 (RefCounted.h:145) 6 WebCore 0x00000001936e74b8 WebCore::CachedImage::~CachedImage() + 12 (CachedImage.cpp:82) 7 WebCore 0x000000019364b550 WebCore::CachedResource::unregisterHandle(WebCore::CachedResourceHandleBase*) + 184 (CachedResource.cpp:563) 8 WebCore 0x000000019364b488 WebCore::CachedResourceHandleBase::~CachedResourceHandleBase() + 32 (CachedResourceHandle.cpp:55) 9 WebCore 0x00000001936a511c WebCore::CachedResourceLoader::~CachedResourceLoader() + 428 (CachedResourceHandle.h:62) 10 WebCore 0x00000001936a4990 WebCore::Document::~Document() + 4120 (RefCounted.h:145) 11 WebCore 0x0000000193b681f4 WebCore::HTMLDocument::~HTMLDocument() + 12 (HTMLDocument.cpp:91) 12 WebCore 0x00000001936a375c WebCore::Node::~Node() + 172 (Document.h:325) 13 WebCore 0x000000019370b538 WebCore::HTMLSpanElement::~HTMLSpanElement() + 12 (HTMLElement.h:38) 14 WebCore 0x000000019369ed1c WebCore::Event::~Event() + 108 (EventTarget.h:65) 15 WebCore 0x000000019373cd34 WebCore::MouseEvent::~MouseEvent() + 104 (UIEventWithKeyState.h:31) 16 WebCore 0x00000001939d7358 WebCore::NavigationAction::~NavigationAction() + 144 (RefCounted.h:145) 17 WebCore 0x00000001936a00d4 WebCore::DocumentLoader::~DocumentLoader() + 1548 (NavigationAction.h:40) 18 WebKitLegacy 0x0000000194866d78 WebDocumentLoaderMac::~WebDocumentLoaderMac() + 84 (WebDocumentLoaderMac.h:40) 19 WebCore 0x00000001936f639c WebCore::CachedFrameBase::~CachedFrameBase() + 272 (RefCounted.h:145) 20 WebCore 0x00000001936f55b0 WebCore::CachedPage::~CachedPage() + 44 (CachedFrame.h:68) 21 WebCore 0x00000001941fb764 WebCore::PageCache::removeAllItemsForPage(WebCore::Page&) + 68 (memory:2537) 22 WebCore 0x00000001941f4e90 WebCore::Page::~Page() + 380 (Page.cpp:321) 23 WebKitLegacy 0x00000001949438cc WebKit::DeferredPageDestructor::tryDestruction() + 124 (memory:2537) 24 WebKitLegacy 0x0000000194939478 __29-[WebView(WebPrivate) _close]_block_invoke + 440 (WebView.mm:598) 25 WebCore 0x00000001946431d4 HandleRunSource(void*) + 704 (WebCoreThreadRun.cpp:99) 26 CoreFoundation 0x000000018ea7542c __CFRUNLOOP_IS_CALLING_OUT_TO_A_SOURCE0_PERFORM_FUNCTION__ + 24 (CFRunLoop.c:1943) 27 CoreFoundation 0x000000018ea74d04 __CFRunLoopDoSources0 + 388 (CFRunLoop.c:2008) 28 CoreFoundation 0x000000018ea729a8 __CFRunLoopRun + 744 (CFRunLoop.c:2821) 29 CoreFoundation 0x000000018e9a2da4 CFRunLoopRunSpecific + 424 (CFRunLoop.c:3113) 30 WebCore 0x0000000193674608 RunWebThread(void*) + 456 (WebCoreThread.mm:694) 31 libsystem_pthread.dylib 0x000000018db8968c _pthread_body + 240 (pthread.c:697) 32 libsystem_pthread.dylib 0x000000018db8959c _pthread_start + 284 (pthread.c:744) 33 libsystem_pthread.dylib 0x000000018db86cb4 thread_start + 4 This can happen when a Page containing an SVGImage is removed from PageCache and this results in the destruction of the SVGImage. Because the SVGImage has an internal utility Page, it will also call PageCache::removeAllItemsForPage(WebCore::Page&) upon destruction, causing us to reenter. 1328544 1 cdumez 2017-07-13 13:24:40 -0700 <rdar://problem/32177485> 1328545 2 315369 cdumez 2017-07-13 13:38:12 -0700 Created attachment 315369 Patch 1328567 3 315369 beidson 2017-07-13 14:31:23 -0700 Comment on attachment 315369 Patch Testable...? (Cause seems well understood) 1328568 4 cdumez 2017-07-13 14:33:41 -0700 (In reply to Brady Eidson from comment #3) > Comment on attachment 315369 [details] > Patch > > Testable...? (Cause seems well understood) Please read ChangeLog. 1328573 5 beidson 2017-07-13 15:15:41 -0700 (In reply to Chris Dumez from comment #4) > (In reply to Brady Eidson from comment #3) > > Comment on attachment 315369 [details] > > Patch > > > > Testable...? (Cause seems well understood) > > Please read ChangeLog. Novel idea. I never read the ChangeLog before scanning for a test ;) 1328578 6 cdumez 2017-07-13 15:24:35 -0700 (In reply to Brady Eidson from comment #5) > (In reply to Chris Dumez from comment #4) > > (In reply to Brady Eidson from comment #3) > > > Comment on attachment 315369 [details] > > > Patch > > > > > > Testable...? (Cause seems well understood) > > > > Please read ChangeLog. > > Novel idea. I never read the ChangeLog before scanning for a test ;) Anyway, I tried hard and am open to ideas but getting the SVGImage to get destroyed at the right time is very tricky. 1328708 7 315369 commit-queue 2017-07-14 01:17:14 -0700 Comment on attachment 315369 Patch Clearing flags on attachment: 315369 Committed r219501: <http://trac.webkit.org/changeset/219501> 1328709 8 commit-queue 2017-07-14 01:17:15 -0700 All reviewed patches have been landed. Closing bug. 315369 2017-07-13 13:38:12 -0700 2017-07-14 01:17:14 -0700 Patch bug-174473-20170713133840.patch text/plain 4438 cdumez U3VidmVyc2lvbiBSZXZpc2lvbjogMjE5NDUzCmRpZmYgLS1naXQgYS9Tb3VyY2UvV2ViQ29yZS9D aGFuZ2VMb2cgYi9Tb3VyY2UvV2ViQ29yZS9DaGFuZ2VMb2cKaW5kZXggN2U2YWRiMmFjYWIxMmJi MTAxZTMwODg3ZGRkYTA2Y2ZmNGVlMTExYS4uMWJlOGUwZTFlMmEzOGVjNTE0ZGYzMTNhNGY4OGM3 OTA5ZDgyYTQ2ZSAxMDA2NDQKLS0tIGEvU291cmNlL1dlYkNvcmUvQ2hhbmdlTG9nCisrKyBiL1Nv dXJjZS9XZWJDb3JlL0NoYW5nZUxvZwpAQCAtMSwzICsxLDM4IEBACisyMDE3LTA3LTEzICBDaHJp cyBEdW1leiAgPGNkdW1lekBhcHBsZS5jb20+CisKKyAgICAgICAgUGFnZUNhY2hlOjpyZW1vdmVB bGxJdGVtc0ZvclBhZ2UoUGFnZSYpIG1heSByZWVudGVyIGl0c2VsZiBhbmQgY2F1c2UgY3Jhc2hl cworICAgICAgICBodHRwczovL2J1Z3Mud2Via2l0Lm9yZy9zaG93X2J1Zy5jZ2k/aWQ9MTc0NDcz CisgICAgICAgIDxyZGFyOi8vcHJvYmxlbS8zMjE3NzQ4NT4KKworICAgICAgICBSZXZpZXdlZCBi eSBOT0JPRFkgKE9PUFMhKS4KKworICAgICAgICBUaGlzIGNvdWxkIGhhcHBlbiB3aGVuIGEgUGFn ZSBjb250YWluaW5nIGFuIFNWR0ltYWdlIGlzIHJlbW92ZWQgZnJvbSBQYWdlQ2FjaGUgYW5kCisg ICAgICAgIHRoaXMgcmVzdWx0ZWQgaW4gdGhlIGRlc3RydWN0aW9uIG9mIHRoZSBTVkdJbWFnZS4g QmVjYXVzZSB0aGUgU1ZHSW1hZ2UgaGFzIGFuIGludGVybmFsCisgICAgICAgIHV0aWxpdHkgUGFn ZSwgaXQgd2lsbCBhbHNvIGNhbGwgUGFnZUNhY2hlOjpyZW1vdmVBbGxJdGVtc0ZvclBhZ2UoV2Vi Q29yZTo6UGFnZSYpIHVwb24KKyAgICAgICAgZGVzdHJ1Y3Rpb24sIGNhdXNpbmcgdXMgdG8gcmVl bnRlci4KKworICAgICAgICBBZGRyZXNzIHRoZSBpc3N1ZSBieSBub3QgY2FsbGluZyBQYWdlQ2Fj aGU6OnJlbW92ZUFsbEl0ZW1zRm9yUGFnZSgpIGZvciB1dGlsaXR5IHBhZ2VzCisgICAgICAgIHNp bmNlIHRob3NlIGNhbm5vdCBiZSBpbiBQYWdlQ2FjaGUgaW4gdGhlIGZpcnN0IHBsYWNlLgorCisg ICAgICAgIEFsc28gYWRkIGFzc2VydGlvbnMgdG8gbWFrZSBzdXJlOgorICAgICAgICAxLiBXZSBu ZXZlciBpbnNlcnQgYSB1dGlsaXR5IHBhZ2UgaW50byBQYWdlQ2FjaGUKKyAgICAgICAgMi4gUGFn ZUNhY2hlOjpyZW1vdmVBbGxJdGVtc0ZvclBhZ2UoKSBkb2VzIG5vdCByZWVudGVyCisKKyAgICAg ICAgTm8gbmV3IHRlc3RzLCBiZWNhdXNlIEkgd2FzIHVuYWJsZSB0byB3cml0ZSBhIHRlc3Qgd2hp Y2ggcmVwcm9kdWNlZCB0aGUgY3Jhc2guIFRoaXMKKyAgICAgICAgaXMgaW4gdGhlb3J5IHRlc3Rh YmxlIHVzaW5nIGFuIEFQSSB0ZXN0IHdoaWNoIGVuYWJsZXMgUGFnZUNhY2hlLCBsb2FkcyBhIHBh Z2UKKyAgICAgICAgY29udGFpbmluZyBhbiBTVkdJbWFnZSwgbmF2aWdhdGVzIGF3YXkgZnJvbSB0 aGlzIHBhZ2Ugc28gdGhhdCBpdCBnb2VzIGludG8gUGFnZUNhY2hlLAorICAgICAgICBhbmQgdGhl biBjYWxscyBbV2ViVmlldyBfY2xvc2VdLiBIb3dldmVyLCB3aGVuIEkgdHJpZWQgd3JpdGluZyBz dWNoIHRlc3QsIEkgY291bGQKKyAgICAgICAgbm90IGdldCB0aGUgU1ZHSW1hZ2UgdG8gZ2V0IGRl c3Ryb3llZCB3aGlsZSBQYWdlQ2FjaGU6OnJlbW92ZUFsbEl0ZW1zRm9yUGFnZSgpIGlzCisgICAg ICAgIGNhbGxlZCBmb3IgdGhlIHRvcC1sZXZlbCBwYWdlIGZvciBzb21lIHJlYXNvbi4gU29tZXRo aW5nIHNlZW1zIHRvIGJlIGtlZXBpbmcgdGhlCisgICAgICAgIFNWR0ltYWdlIGFsaXZlIGxvbmdl ci4gSSB0cmllZCBkaXNhYmxpbmcgdGhlIE1lbW9yeUNhY2hlIGJ1dCBpdCBkaWQgbm90IGhlbHAu CisKKyAgICAgICAgKiBoaXN0b3J5L1BhZ2VDYWNoZS5jcHA6CisgICAgICAgIChXZWJDb3JlOjpQ YWdlQ2FjaGU6OmFkZElmQ2FjaGVhYmxlKToKKyAgICAgICAgKFdlYkNvcmU6OlBhZ2VDYWNoZTo6 cmVtb3ZlQWxsSXRlbXNGb3JQYWdlKToKKyAgICAgICAgKiBoaXN0b3J5L1BhZ2VDYWNoZS5oOgor ICAgICAgICAqIHBhZ2UvUGFnZS5jcHA6CisgICAgICAgIChXZWJDb3JlOjpQYWdlOjp+UGFnZSk6 CisKIDIwMTctMDctMTMgIFphbiBEb2JlcnNlayAgPHpkb2JlcnNla0BpZ2FsaWEuY29tPgogCiAg ICAgICAgIFtHQ3J5cHRdIEltcGxlbWVudCBDcnlwdG9LZXlSU0EgU1BLSSBleHBvcnRzCmRpZmYg LS1naXQgYS9Tb3VyY2UvV2ViQ29yZS9oaXN0b3J5L1BhZ2VDYWNoZS5jcHAgYi9Tb3VyY2UvV2Vi Q29yZS9oaXN0b3J5L1BhZ2VDYWNoZS5jcHAKaW5kZXggNGIzNDdkZTQxOWMzMDJmOTdjMWE2MTdl OWU5ZTc4YjE3OWI5MDdiZC4uZmM3MjBlOGRhMTk5NTZjZDc5YWMxMjcxNDM3NmFiMWRlYTE1Yjlj YyAxMDA2NDQKLS0tIGEvU291cmNlL1dlYkNvcmUvaGlzdG9yeS9QYWdlQ2FjaGUuY3BwCisrKyBi L1NvdXJjZS9XZWJDb3JlL2hpc3RvcnkvUGFnZUNhY2hlLmNwcApAQCAtNDA5LDYgKzQwOSw4IEBA IHZvaWQgUGFnZUNhY2hlOjphZGRJZkNhY2hlYWJsZShIaXN0b3J5SXRlbSYgaXRlbSwgUGFnZSog cGFnZSkKICAgICBpZiAoIXBhZ2UgfHwgIWNhbkNhY2hlKCpwYWdlKSkKICAgICAgICAgcmV0dXJu OwogCisgICAgQVNTRVJUX1dJVEhfTUVTU0FHRSghcGFnZS0+aXNVdGlsaXR5UGFnZSgpLCAiVXRp bGl0eSBwYWdlcyBzdWNoIGFzIFNWR0ltYWdlIHBhZ2VzIHNob3VsZCBuZXZlciBnbyBpbnRvIFBh Z2VDYWNoZSIpOworCiAgICAgc2V0UGFnZUNhY2hlU3RhdGUoKnBhZ2UsIERvY3VtZW50OjpBYm91 dFRvRW50ZXJQYWdlQ2FjaGUpOwogCiAgICAgLy8gRm9jdXMgdGhlIG1haW4gZnJhbWUsIGRlZm9j dXNpbmcgYSBmb2N1c2VkIHN1YmZyYW1lIChpZiB3ZSBoYXZlIG9uZSkuIFdlIGRvIHRoaXMgaGVy ZSwKQEAgLTQ2Miw2ICs0NjQsMTEgQEAgc3RkOjp1bmlxdWVfcHRyPENhY2hlZFBhZ2U+IFBhZ2VD YWNoZTo6dGFrZShIaXN0b3J5SXRlbSYgaXRlbSwgUGFnZSogcGFnZSkKIAogdm9pZCBQYWdlQ2Fj aGU6OnJlbW92ZUFsbEl0ZW1zRm9yUGFnZShQYWdlJiBwYWdlKQogeworI2lmICFBU1NFUlRfRElT QUJMRUQKKyAgICBBU1NFUlRfV0lUSF9NRVNTQUdFKCFtX2lzSW5SZW1vdmVBbGxJdGVtc0ZvclBh Z2UsICJXZSBzaG91bGQgbm90IHJlZW50ZXIgdGhpcyBtZXRob2QiKTsKKyAgICBTZXRGb3JTY29w ZTxib29sPiBpblJlbW92ZUFsbEl0ZW1zRm9yUGFnZVNjb3BlIHsgbV9pc0luUmVtb3ZlQWxsSXRl bXNGb3JQYWdlLCB0cnVlIH07CisjZW5kaWYKKwogICAgIGZvciAoYXV0byBpdCA9IG1faXRlbXMu YmVnaW4oKTsgaXQgIT0gbV9pdGVtcy5lbmQoKTspIHsKICAgICAgICAgLy8gSW5jcmVtZW50IGl0 ZXJhdG9yIGZpcnN0IHNvIGl0IHN0YXlzIHZhbGlkIGFmdGVyIHRoZSByZW1vdmFsLgogICAgICAg ICBhdXRvIGN1cnJlbnQgPSBpdDsKZGlmZiAtLWdpdCBhL1NvdXJjZS9XZWJDb3JlL2hpc3Rvcnkv UGFnZUNhY2hlLmggYi9Tb3VyY2UvV2ViQ29yZS9oaXN0b3J5L1BhZ2VDYWNoZS5oCmluZGV4IDQ5 Yjc5Njg3ZjEyYWJlYWI1ZjkzMGEwY2E0MzY2ODU3YjBhMDEzMzIuLjUxYzFlMDU0N2UwMTM2ZWRm ODY5NDk4NTE5N2Q2YWQ1ODhiZjQ5MWMgMTAwNjQ0Ci0tLSBhL1NvdXJjZS9XZWJDb3JlL2hpc3Rv cnkvUGFnZUNhY2hlLmgKKysrIGIvU291cmNlL1dlYkNvcmUvaGlzdG9yeS9QYWdlQ2FjaGUuaApA QCAtNzgsNiArNzgsMTAgQEAgcHJpdmF0ZToKICAgICBMaXN0SGFzaFNldDxSZWZQdHI8SGlzdG9y eUl0ZW0+PiBtX2l0ZW1zOwogICAgIHVuc2lnbmVkIG1fbWF4U2l6ZSB7MH07CiAKKyNpZiAhQVNT RVJUX0RJU0FCTEVECisgICAgYm9vbCBtX2lzSW5SZW1vdmVBbGxJdGVtc0ZvclBhZ2UgeyBmYWxz ZSB9OworI2VuZGlmCisKICAgICBmcmllbmQgY2xhc3MgV1RGOjpOZXZlckRlc3Ryb3llZDxQYWdl Q2FjaGU+OwogfTsKIApkaWZmIC0tZ2l0IGEvU291cmNlL1dlYkNvcmUvcGFnZS9QYWdlLmNwcCBi L1NvdXJjZS9XZWJDb3JlL3BhZ2UvUGFnZS5jcHAKaW5kZXggZGYwN2ZiMTVmNzg5NmY2YTJmYjA4 NzVjYWU2NzFiOWRmMTBjZDU3Yi4uZmJmNDhkNmNlNGE2ZWQ0OWExYzcwOWYyNTk1MGQzMzNhNTUw ZjIxMCAxMDA2NDQKLS0tIGEvU291cmNlL1dlYkNvcmUvcGFnZS9QYWdlLmNwcAorKysgYi9Tb3Vy Y2UvV2ViQ29yZS9wYWdlL1BhZ2UuY3BwCkBAIC0zMzEsNyArMzMxLDggQEAgUGFnZTo6flBhZ2Uo KQogICAgICAgICBtX3Njcm9sbGluZ0Nvb3JkaW5hdG9yLT5wYWdlRGVzdHJveWVkKCk7CiAKICAg ICBiYWNrRm9yd2FyZCgpLmNsb3NlKCk7Ci0gICAgUGFnZUNhY2hlOjpzaW5nbGV0b24oKS5yZW1v dmVBbGxJdGVtc0ZvclBhZ2UoKnRoaXMpOworICAgIGlmICghaXNVdGlsaXR5UGFnZSgpKQorICAg ICAgICBQYWdlQ2FjaGU6OnNpbmdsZXRvbigpLnJlbW92ZUFsbEl0ZW1zRm9yUGFnZSgqdGhpcyk7 CiAKICNpZm5kZWYgTkRFQlVHCiAgICAgcGFnZUNvdW50ZXIuZGVjcmVtZW50KCk7Cg==