204796 2019-12-03 08:33:48 -0800 [iOS 13] Crash in NetworkProcessProxy::takeUploadAssertion 2020-02-28 17:25:53 -0800 1 1 1 Unclassified WebKit Page Loading WebKit Nightly Build Unspecified Unspecified RESOLVED FIXED InRadar P2 Normal --- 1 ajuma cdumez achristensen beidson cdumez commit-queue ggaren youennf oldest_to_newest 1595021 0 ajuma 2019-12-03 08:33:48 -0800 Chrome for iOS is getting a moderate number of crashes reported in NetworkProcessProxy::takeUploadAssertion, which seem to be from WebProcessPool::setWebProcessHasUploads calling takeUploadAssertion on a null m_networkProcess. We don't have steps to reproduce, but this happens most commonly on https://www.homedepot.com, on various product pages and search pages (e.g., https://www.homedepot.com/p/Supreme-Oil-Supreme-Deep-Frying-Oil-with-PNT-Oil-384-fl-oz-1879/202532163, https://www.homedepot.com/s/fence%2520staples?searchtype=suggest&NCNI-5). All reports are from iOS 13.0 and above, including 13.3 beta. Would checking for a null m_networkProcess in WebProcessPool::setWebProcessHasUploads be an appropriate fix? Here's a crash stack: EXC_BAD_ACCESS / KERN_INVALID_ADDRESS @ 0x00000020 ] 0x00000001cb9d6958 (WebKit + 0x00329958 ) WebKit::NetworkProcessProxy::takeUploadAssertion() 0x00000001cb93f6cc (WebKit + 0x002926cc ) WebKit::WebProcessPool::setWebProcessHasUploads(WTF::ObjectIdentifier<WebCore::ProcessIdentifierType>) 0x00000001cb93f6cc (WebKit + 0x002926cc ) WebKit::WebProcessPool::setWebProcessHasUploads(WTF::ObjectIdentifier<WebCore::ProcessIdentifierType>) 0x00000001cbba9bdc (WebKit + 0x004fcbdc ) WebKit::WebProcessPool::didReceiveMessage(IPC::Connection&, IPC::Decoder&) 0x00000001cb6f50e4 (WebKit + 0x000480e4 ) IPC::MessageReceiverMap::dispatchMessage(IPC::Connection&, IPC::Decoder&) 0x00000001cb94264c (WebKit + 0x0029564c ) WebKit::WebProcessProxy::didReceiveMessage(IPC::Connection&, IPC::Decoder&) 0x00000001cb6df73c (WebKit + 0x0003273c ) IPC::Connection::dispatchMessage(std::__1::unique_ptr<IPC::Decoder, std::__1::default_delete<IPC::Decoder> >) 0x00000001cb6e258c (WebKit + 0x0003558c ) IPC::Connection::dispatchIncomingMessages() 0x00000001d2da4a68 (JavaScriptCore + 0x00036a68 ) WTF::RunLoop::performWork() 0x00000001d2da4d28 (JavaScriptCore + 0x00036d28 ) WTF::RunLoop::performWork(void*) 1595022 1 cdumez 2019-12-03 08:43:37 -0800 (In reply to Ali Juma from comment #0) > Chrome for iOS is getting a moderate number of crashes reported in > NetworkProcessProxy::takeUploadAssertion, which seem to be from > WebProcessPool::setWebProcessHasUploads calling takeUploadAssertion on a > null m_networkProcess. > > We don't have steps to reproduce, but this happens most commonly on > https://www.homedepot.com, on various product pages and search pages (e.g., > https://www.homedepot.com/p/Supreme-Oil-Supreme-Deep-Frying-Oil-with-PNT-Oil- > 384-fl-oz-1879/202532163, > https://www.homedepot.com/s/fence%2520staples?searchtype=suggest&NCNI-5). > > All reports are from iOS 13.0 and above, including 13.3 beta. > > Would checking for a null m_networkProcess in > WebProcessPool::setWebProcessHasUploads be an appropriate fix? In my opinion, we should call ensureNetworkProcess() instead of doing a null-check, but Brady wrote this piece for code I believe so he may know better. 1595401 2 ap 2019-12-04 00:11:34 -0800 rdar://problem/52720009&52720030 1624084 3 392009 cdumez 2020-02-28 13:06:58 -0800 Created attachment 392009 Patch 1624196 4 392009 commit-queue 2020-02-28 17:25:51 -0800 Comment on attachment 392009 Patch Clearing flags on attachment: 392009 Committed r257675: <https://trac.webkit.org/changeset/257675> 1624197 5 commit-queue 2020-02-28 17:25:53 -0800 All reviewed patches have been landed. Closing bug. 392009 2020-02-28 13:06:58 -0800 2020-02-28 17:25:51 -0800 Patch bug-204796-20200228130657.patch text/plain 1972 cdumez U3VidmVyc2lvbiBSZXZpc2lvbjogMjU3NjUzCmRpZmYgLS1naXQgYS9Tb3VyY2UvV2ViS2l0L0No YW5nZUxvZyBiL1NvdXJjZS9XZWJLaXQvQ2hhbmdlTG9nCmluZGV4IDQwYTc1NzE0ZWJlODRkM2Nh MzU1MDYzNjYyODhhZWRjMjZmMmNkZTQuLjQzMzdjZTk0OWRlNmJiMjViMjhmY2ZjOWJhYjhmMzRl MmEyZDlkNTUgMTAwNjQ0Ci0tLSBhL1NvdXJjZS9XZWJLaXQvQ2hhbmdlTG9nCisrKyBiL1NvdXJj ZS9XZWJLaXQvQ2hhbmdlTG9nCkBAIC0xLDMgKzEsMTYgQEAKKzIwMjAtMDItMjggIENocmlzIER1 bWV6ICA8Y2R1bWV6QGFwcGxlLmNvbT4KKworICAgICAgICBbaU9TIDEzXSBDcmFzaCBpbiBOZXR3 b3JrUHJvY2Vzc1Byb3h5Ojp0YWtlVXBsb2FkQXNzZXJ0aW9uCisgICAgICAgIGh0dHBzOi8vYnVn cy53ZWJraXQub3JnL3Nob3dfYnVnLmNnaT9pZD0yMDQ3OTYKKworICAgICAgICBSZXZpZXdlZCBi eSBOT0JPRFkgKE9PUFMhKS4KKworICAgICAgICAqIFVJUHJvY2Vzcy9XZWJQcm9jZXNzUG9vbC5j cHA6CisgICAgICAgIChXZWJLaXQ6OldlYlByb2Nlc3NQb29sOjpzZXRXZWJQcm9jZXNzSGFzVXBs b2Fkcyk6CisgICAgICAgIElmIHRoZSBuZXR3b3JrIHByb2Nlc3MgaGFzIHByZXZpb3VzbHkgY3Jh c2hlZCwgV2ViUHJvY2Vzc1Bvb2w6Om1fbmV0d29ya1Byb2Nlc3MgbWF5IGJlIG51bGwKKyAgICAg ICAgd2hlbiBXZWJQcm9jZXNzUG9vbDo6c2V0V2ViUHJvY2Vzc0hhc1VwbG9hZHMoKSBpcyBjYWxs ZWQuIEFzIGEgcmVzdWx0LCB3ZSBzaG91bGQgY2FsbAorICAgICAgICBlbnN1cmVOZXR3b3JrUHJv Y2VzcygpIGluc3RlYWQgb2YgZGVyZWZlcmVuY2luZyBtX25ldHdvcmtQcm9jZXNzIHVuY29uZGl0 aW9uYWxseS4KKwogMjAyMC0wMi0yOCAgQnJlbnQgRnVsZ2hhbSAgPGJmdWxnaGFtQGFwcGxlLmNv bT4KIAogICAgICAgICBbaU9TXSBSZW1vdmUgYWNjZXNzIHRvIHRoZSAiY29tLmFwcGxlLmxzZC5v cGVuIiBtYWNoIHNlcnZpY2UgZnJvbSB0aGUgV2ViQ29udGVudCBwcm9jZXNzCmRpZmYgLS1naXQg YS9Tb3VyY2UvV2ViS2l0L1VJUHJvY2Vzcy9XZWJQcm9jZXNzUG9vbC5jcHAgYi9Tb3VyY2UvV2Vi S2l0L1VJUHJvY2Vzcy9XZWJQcm9jZXNzUG9vbC5jcHAKaW5kZXggYTJkYTM5YTBhYjhjOGY5ODJj ODFkNGJjNjU3ZmM2NDg1MjY1ZjQ4YS4uZWFiYzg5N2JiM2U2NDM1YjBlNjg2OGI1ZDM2ZTUyZjVh ZGFhZWY1NCAxMDA2NDQKLS0tIGEvU291cmNlL1dlYktpdC9VSVByb2Nlc3MvV2ViUHJvY2Vzc1Bv b2wuY3BwCisrKyBiL1NvdXJjZS9XZWJLaXQvVUlQcm9jZXNzL1dlYlByb2Nlc3NQb29sLmNwcApA QCAtMjM0Myw4ICsyMzQzLDcgQEAgdm9pZCBXZWJQcm9jZXNzUG9vbDo6c2V0V2ViUHJvY2Vzc0hh c1VwbG9hZHMoUHJvY2Vzc0lkZW50aWZpZXIgcHJvY2Vzc0lEKQogICAgIGlmIChtX3Byb2Nlc3Nl c1dpdGhVcGxvYWRzLmlzRW1wdHkoKSkgewogICAgICAgICBXRUJQUk9DRVNTUE9PTF9SRUxFQVNF X0xPRyhQcm9jZXNzU3VzcGVuc2lvbiwgInNldFdlYlByb2Nlc3NIYXNVcGxvYWRzOiBUaGUgbnVt YmVyIG9mIHVwbG9hZHMgaW4gcHJvZ3Jlc3MgaXMgbm93IG9uZS4gVGFraW5nIE5ldHdvcmtpbmcg YW5kIFVJIHByb2Nlc3MgYXNzZXJ0aW9ucy4iKTsKIAotICAgICAgICBBU1NFUlQobV9uZXR3b3Jr UHJvY2Vzcyk7Ci0gICAgICAgIG1fbmV0d29ya1Byb2Nlc3MtPnRha2VVcGxvYWRBc3NlcnRpb24o KTsKKyAgICAgICAgZW5zdXJlTmV0d29ya1Byb2Nlc3MoKS50YWtlVXBsb2FkQXNzZXJ0aW9uKCk7 CiAgICAgICAgIAogICAgICAgICBBU1NFUlQoIW1fdWlQcm9jZXNzVXBsb2FkQXNzZXJ0aW9uKTsK ICAgICAgICAgbV91aVByb2Nlc3NVcGxvYWRBc3NlcnRpb24gPSBtYWtlVW5pcXVlPFByb2Nlc3NB c3NlcnRpb24+KGdldEN1cnJlbnRQcm9jZXNzSUQoKSwgIldlYktpdCB1cGxvYWRzIl9zLCBBc3Nl cnRpb25TdGF0ZTo6VW5ib3VuZGVkTmV0d29ya2luZyk7Cg==