216309 2020-09-09 07:32:20 -0700 AccessibilityMenuList and MenuListPopup notifications need to be posted asynchronously. 2020-09-09 10:42:07 -0700 1 1 1 Unclassified WebKit New Bugs WebKit Nightly Build Unspecified Unspecified RESOLVED FIXED InRadar P2 Normal --- 1 andresg_22 andresg_22 aboxhall apinheiro cfleizach dmazzoni ews-watchlist jcraig jdiggs samuel_white oldest_to_newest 1686961 0 andresg_22 2020-09-09 07:32:20 -0700 AccessibilityMenuList and MenuListPopup notifications need to be posted asynchronously. 1686964 1 408326 andresg_22 2020-09-09 07:50:50 -0700 Created attachment 408326 Patch 1686968 2 andresg_22 2020-09-09 07:56:27 -0700 Crash trace: Thread 0 Crashed:: Dispatch queue: com.apple.main-thread 0 com.apple.WebCore 0x00007fff39896673 WTFCrashWithInfo(int, char const*, char const*, int) + 19 1 com.apple.WebCore 0x00007fff396f7dc4 WebCore::Document::updateLayout() + 660 2 com.apple.WebCore 0x00007fff3a79b4a2 WebCore::AccessibilityObject::updateBackingStore() + 226 3 com.apple.WebCore 0x00007fff3b7ff3db -[WebAccessibilityObjectWrapperBase updateObjectBackingStore] + 59 4 com.apple.WebCore 0x00007fff3b80c157 -[WebAccessibilityObjectWrapper accessibilityIsIgnored] + 23 5 com.apple.AppKit 0x00007fff283094d6 __NSAccessibilityEntryPointIsAccessibilityElement_block_invoke + 286 6 com.apple.AppKit 0x00007fff2830937a NSAccessibilityPerformEntryPointBOOL + 16 7 com.apple.AppKit 0x00007fff27d723bd NSAccessibilityEntryPointIsAccessibilityElement + 93 8 com.apple.AppKit 0x00007fff27fd22c2 NSAccessibilityPostNotificationForObservedElementWithUserInfo + 217 9 com.apple.WebCore 0x00007fff3a7882cd WebCore::AccessibilityMenuList::didUpdateActiveOption(int) + 189 10 com.apple.WebCore 0x00007fff398453cb WebCore::RenderMenuList::setTextFromOption(int) + 1419 11 com.apple.WebCore 0x00007fff39762fbf WebCore::HTMLSelectElement::selectOption(int, unsigned int) + 511 12 com.apple.WebCore 0x00007fff3ad2c49d WebCore::HTMLOptionElement::insertedIntoAncestor(WebCore::Node::InsertionType, WebCore::ContainerNode&) + 157 13 com.apple.WebCore 0x00007fff3aa84b9a WebCore::notifyNodeInsertedIntoDocument(WebCore::ContainerNode&, WebCore::Node&, WebCore::TreeScopeChange, WTF::Vector<WTF::Ref<WebCore::Node, WTF::DumbPtrTraits<WebCore::Node> >, 11ul, WTF::CrashOnOverflow, 16ul, WTF::FastMalloc>&) + 58 14 com.apple.WebCore 0x00007fff3aa84a32 WebCore::notifyChildNodeInserted(WebCore::ContainerNode&, WebCore::Node&) + 130 15 com.apple.WebCore 0x00007fff3aa7e70e WebCore::ContainerNode::appendChildWithoutPreInsertionValidityCheck(WebCore::Node&) + 990 16 com.apple.WebCore 0x00007fff3ab175cd WebCore::Node::appendChild(WebCore::Node&) + 93 17 com.apple.WebCore 0x00007fff39f1bd72 WebCore::jsNodePrototypeFunctionAppendChild(JSC::JSGlobalObject*, JSC::CallFrame*) + 482 18 ??? 0x00003e021dc011d8 0 + 68178809983448 19 com.apple.JavaScriptCore 0x00007fff2edaca4f llint_entry + 104267 20 com.apple.JavaScriptCore 0x00007fff2edacacf llint_entry + 104395 21 com.apple.JavaScriptCore 0x00007fff2edaca4f llint_entry + 104267 22 com.apple.JavaScriptCore 0x00007fff2edacacf llint_entry + 104395 23 ??? 0x00003e021e1cdccb 0 + 68178816064715 24 com.apple.JavaScriptCore 0x00007fff2edacacf llint_entry + 104395 25 com.apple.JavaScriptCore 0x00007fff2edacacf llint_entry + 104395 26 com.apple.JavaScriptCore 0x00007fff2edacacf llint_entry + 104395 27 com.apple.JavaScriptCore 0x00007fff2edacacf llint_entry + 104395 28 com.apple.JavaScriptCore 0x00007fff2edad77e llint_entry + 107642 29 ??? 0x00003e021dc9dd90 0 + 68178810625424 30 com.apple.JavaScriptCore 0x00007fff2edaca4f llint_entry + 104267 31 com.apple.JavaScriptCore 0x00007fff2edacacf llint_entry + 104395 32 com.apple.JavaScriptCore 0x00007fff2edacacf llint_entry + 104395 33 com.apple.JavaScriptCore 0x00007fff2ed9310f vmEntryToJavaScript + 216 34 com.apple.JavaScriptCore 0x00007fff2f3d1696 JSC::Interpreter::executeCall(JSC::JSGlobalObject*, JSC::JSObject*, JSC::CallData const&, JSC::JSValue, JSC::ArgList const&) + 518 35 com.apple.JavaScriptCore 0x00007fff2f69b465 JSC::boundThisNoArgsFunctionCall(JSC::JSGlobalObject*, JSC::CallFrame*) + 837 36 ??? 0x00003e021dc01a97 0 + 68178809985687 37 ??? 0x00003e021dc8e4f5 0 + 68178810561781 38 com.apple.JavaScriptCore 0x00007fff2ed9310f vmEntryToJavaScript + 216 39 com.apple.JavaScriptCore 0x00007fff2f3d1696 JSC::Interpreter::executeCall(JSC::JSGlobalObject*, JSC::JSObject*, JSC::CallData const&, JSC::JSValue, JSC::ArgList const&) + 518 40 com.apple.JavaScriptCore 0x00007fff2f5fb0c4 JSC::profiledCall(JSC::JSGlobalObject*, JSC::ProfilingReason, JSC::JSValue, JSC::CallData const&, JSC::JSValue, JSC::ArgList const&) + 164 41 com.apple.JavaScriptCore 0x00007fff2f6e40ef JSC::JSMicrotask::run(JSC::JSGlobalObject*) + 415 42 com.apple.WebCore 0x00007fff3a83af68 WebCore::JSMicrotaskCallback::call() + 104 43 com.apple.WebCore 0x00007fff3a83aecc WTF::Detail::CallableWrapper<WebCore::JSDOMWindowBase::queueMicrotaskToEventLoop(JSC::JSGlobalObject&, WTF::Ref<JSC::Microtask, WTF::DumbPtrTraits<JSC::Microtask> >&&)::$_36, void>::call() + 76 44 com.apple.WebCore 0x00007fff3ab0b3c6 WebCore::MicrotaskQueue::performMicrotaskCheckpoint() + 134 45 com.apple.WebCore 0x00007fff3a82ef0d WebCore::JSExecState::didLeaveScriptContext(JSC::JSGlobalObject*) + 173 46 com.apple.WebCore 0x00007fff3a85956f WebCore::JSExecState::profiledEvaluate(JSC::JSGlobalObject*, JSC::ProfilingReason, JSC::SourceCode const&, JSC::JSValue, WTF::NakedPtr<JSC::Exception>&) + 127 47 com.apple.WebCore 0x00007fff3a859272 WebCore::ScriptController::evaluateInWorld(WebCore::ScriptSourceCode const&, WebCore::DOMWrapperWorld&) + 178 48 com.apple.WebCore 0x00007fff3a8595c8 WebCore::ScriptController::evaluateIgnoringException(WebCore::ScriptSourceCode const&) + 40 49 com.apple.WebCore 0x00007fff3ab3b950 WebCore::ScriptElement::executeClassicScript(WebCore::ScriptSourceCode const&) + 528 50 com.apple.WebCore 0x00007fff3ab064f8 WebCore::LoadableClassicScript::execute(WebCore::ScriptElement&) + 168 51 com.apple.WebCore 0x00007fff3ab3c07d WebCore::ScriptElement::executePendingScript(WebCore::PendingScript&) + 445 52 com.apple.WebCore 0x00007fff3ab3e571 WebCore::ScriptRunner::timerFired() + 1249 53 com.apple.WebCore 0x00007fff3b15c526 WTF::Detail::CallableWrapper<WebCore::ThreadTimers::setSharedTimer(WebCore::SharedTimer*)::$_0, void>::call() + 198 54 com.apple.WebCore 0x00007fff3965b01f WebCore::timerFired(__CFRunLoopTimer*, void*) + 31 ... 1686969 3 andresg_22 2020-09-09 07:57:12 -0700 <rdar://problem/68108824> 1687005 4 408326 cfleizach 2020-09-09 09:50:57 -0700 Comment on attachment 408326 Patch these are the last 3 PostSychrnously methods. Can we remove this argument now since it causes issues? 1687029 5 andresg_22 2020-09-09 10:21:58 -0700 (In reply to chris fleizach from comment #4) > Comment on attachment 408326 [details] > Patch > > these are the last 3 PostSychrnously methods. Can we remove this argument > now since it causes issues? Yes! doing that in a separate patch since we typically don't want to mix the cleanup work with the actual fix for this crash. Will submit the cleanup soon. 1687043 6 ews-feeder 2020-09-09 10:42:06 -0700 Committed r266787: <https://trac.webkit.org/changeset/266787> All reviewed patches have been landed. Closing bug and clearing flags on attachment 408326. 408326 2020-09-09 07:50:50 -0700 2020-09-09 10:42:07 -0700 Patch bug-216309-20200909105049.patch text/plain 3770 andresg_22 U3VidmVyc2lvbiBSZXZpc2lvbjogMjY2NzIwCmRpZmYgLS1naXQgYS9Tb3VyY2UvV2ViQ29yZS9D aGFuZ2VMb2cgYi9Tb3VyY2UvV2ViQ29yZS9DaGFuZ2VMb2cKaW5kZXggYTI4MThmYzAyMmU2NzAw MTI1ZDM0MzVhMTM3ZDFiNDA4ZjA4NjdkMi4uMTU2N2Q1NTQzZjM5YWIwMzFjMTQxYjdjYTdkNGZj YjBjZWNmNTI5NSAxMDA2NDQKLS0tIGEvU291cmNlL1dlYkNvcmUvQ2hhbmdlTG9nCisrKyBiL1Nv dXJjZS9XZWJDb3JlL0NoYW5nZUxvZwpAQCAtMSwzICsxLDIyIEBACisyMDIwLTA5LTA5ICBBbmRy ZXMgR29uemFsZXogIDxhbmRyZXNnXzIyQGFwcGxlLmNvbT4KKworICAgICAgICBBY2Nlc3NpYmls aXR5TWVudUxpc3QgYW5kIE1lbnVMaXN0UG9wdXAgbm90aWZpY2F0aW9ucyBuZWVkIHRvIGJlIHBv c3RlZCBhc3luY2hyb25vdXNseS4KKyAgICAgICAgaHR0cHM6Ly9idWdzLndlYmtpdC5vcmcvc2hv d19idWcuY2dpP2lkPTIxNjMwOQorICAgICAgICA8cmRhcjovL3Byb2JsZW0vNjgxMDg4MjQ+CisK KyAgICAgICAgUmV2aWV3ZWQgYnkgTk9CT0RZIChPT1BTISkuCisKKyAgICAgICAgTWVudUxpc3Qg bm90aWZpY2F0aW9ucyB3ZXJlIHBvc3RlZCBzeW5jaHJvbm91c2x5IHdoaWNoIHRyaWdnZXJzIGEg RE9NCisgICAgICAgIGxheW91dCBhbmQgc3R5bGUgdXBkYXRlIGluIHRoZSBtaWRkbGUgb2YgYW4g b25nb2luZyBET00gbXV0YXRpb24gdXBkYXRlLgorICAgICAgICBUaGlzIGlzIHVubmVjZXNzYXJ5 IGFuZCwgZnVydGhlcm1vcmUsIGNhdXNlcyBjcmFzaGVzIHNpbmNlIHRoZSBET00KKyAgICAgICAg bGF5b3V0IHVwZGF0ZSBjYW5ub3QgYmUgcmUtZW50cmFudC4gVGhpcyBjaGFuZ2UgbWFrZXMgdGhl c2UKKyAgICAgICAgbm90aWZpY2F0aW9ucyBhc3luY2hyb25vdXMuCisKKyAgICAgICAgKiBhY2Nl c3NpYmlsaXR5L0FjY2Vzc2liaWxpdHlNZW51TGlzdC5jcHA6CisgICAgICAgIChXZWJDb3JlOjpB Y2Nlc3NpYmlsaXR5TWVudUxpc3Q6OmRpZFVwZGF0ZUFjdGl2ZU9wdGlvbik6CisgICAgICAgICog YWNjZXNzaWJpbGl0eS9BY2Nlc3NpYmlsaXR5TWVudUxpc3RQb3B1cC5jcHA6CisgICAgICAgIChX ZWJDb3JlOjpBY2Nlc3NpYmlsaXR5TWVudUxpc3RQb3B1cDo6ZGlkVXBkYXRlQWN0aXZlT3B0aW9u KToKKwogMjAyMC0wOS0wOCAgUm9iIEJ1aXMgIDxyYnVpc0BpZ2FsaWEuY29tPgogCiAgICAgICAg IEZpeCBjcmFzaCBpbiBpbWFnZS1sb2FkaW5nLWxhenktc2xvdy5odG1sIFdQVCB0ZXN0CmRpZmYg LS1naXQgYS9Tb3VyY2UvV2ViQ29yZS9hY2Nlc3NpYmlsaXR5L0FjY2Vzc2liaWxpdHlNZW51TGlz dC5jcHAgYi9Tb3VyY2UvV2ViQ29yZS9hY2Nlc3NpYmlsaXR5L0FjY2Vzc2liaWxpdHlNZW51TGlz dC5jcHAKaW5kZXggNDk2ZGVhNTQ1MWU3MzIwNjY5MjBiM2IyOTk3MWVhNWRjYTQzZDNlNS4uMWVh NDQ4YTQ1Y2NhODVhMTk0ZDcyOTUxZjZhMWJiMTViMzU3ZjJiNCAxMDA2NDQKLS0tIGEvU291cmNl L1dlYkNvcmUvYWNjZXNzaWJpbGl0eS9BY2Nlc3NpYmlsaXR5TWVudUxpc3QuY3BwCisrKyBiL1Nv dXJjZS9XZWJDb3JlL2FjY2Vzc2liaWxpdHkvQWNjZXNzaWJpbGl0eU1lbnVMaXN0LmNwcApAQCAt MTE3LDcgKzExNyw2IEBAIGJvb2wgQWNjZXNzaWJpbGl0eU1lbnVMaXN0OjpjYW5TZXRGb2N1c0F0 dHJpYnV0ZSgpIGNvbnN0CiB2b2lkIEFjY2Vzc2liaWxpdHlNZW51TGlzdDo6ZGlkVXBkYXRlQWN0 aXZlT3B0aW9uKGludCBvcHRpb25JbmRleCkKIHsKICAgICBSZWY8RG9jdW1lbnQ+IGRvY3VtZW50 KG1fcmVuZGVyZXItPmRvY3VtZW50KCkpOwotICAgIEFYT2JqZWN0Q2FjaGUqIGNhY2hlID0gZG9j dW1lbnQtPmF4T2JqZWN0Q2FjaGUoKTsKIAogICAgIGNvbnN0IGF1dG8mIGNoaWxkT2JqZWN0cyA9 IGNoaWxkcmVuKCk7CiAgICAgaWYgKCFjaGlsZE9iamVjdHMuaXNFbXB0eSgpKSB7CkBAIC0xMzYs NyArMTM1LDggQEAgdm9pZCBBY2Nlc3NpYmlsaXR5TWVudUxpc3Q6OmRpZFVwZGF0ZUFjdGl2ZU9w dGlvbihpbnQgb3B0aW9uSW5kZXgpCiAgICAgICAgICAgICBkb3duY2FzdDxBY2Nlc3NpYmlsaXR5 TWVudUxpc3RQb3B1cD4oKmNoaWxkT2JqZWN0c1swXSkuZGlkVXBkYXRlQWN0aXZlT3B0aW9uKG9w dGlvbkluZGV4KTsKICAgICB9CiAKLSAgICBjYWNoZS0+cG9zdE5vdGlmaWNhdGlvbih0aGlzLCBk b2N1bWVudC5wdHIoKSwgQVhPYmplY3RDYWNoZTo6QVhNZW51TGlzdFZhbHVlQ2hhbmdlZCwgVGFy Z2V0RWxlbWVudCwgUG9zdFN5bmNocm9ub3VzbHkpOworICAgIGlmIChhdXRvKiBjYWNoZSA9IGRv Y3VtZW50LT5heE9iamVjdENhY2hlKCkpCisgICAgICAgIGNhY2hlLT5wb3N0Tm90aWZpY2F0aW9u KHRoaXMsIGRvY3VtZW50LnB0cigpLCBBWE9iamVjdENhY2hlOjpBWE1lbnVMaXN0VmFsdWVDaGFu Z2VkLCBUYXJnZXRFbGVtZW50LCBQb3N0QXN5bmNocm9ub3VzbHkpOwogfQogCiB9IC8vIG5hbWVz cGFjZSBXZWJDb3JlCmRpZmYgLS1naXQgYS9Tb3VyY2UvV2ViQ29yZS9hY2Nlc3NpYmlsaXR5L0Fj Y2Vzc2liaWxpdHlNZW51TGlzdFBvcHVwLmNwcCBiL1NvdXJjZS9XZWJDb3JlL2FjY2Vzc2liaWxp dHkvQWNjZXNzaWJpbGl0eU1lbnVMaXN0UG9wdXAuY3BwCmluZGV4IDgxYjZjMWQ0ODM4NmFlMWMz NTMwYjZmMzJkOTg2NDdhNWVmYjM1ZTguLmU3NGE0ODJlMjFhMWNiM2U2N2VkNmE1MGNlZTE5MDI0 ZmE0N2JiNTcgMTAwNjQ0Ci0tLSBhL1NvdXJjZS9XZWJDb3JlL2FjY2Vzc2liaWxpdHkvQWNjZXNz aWJpbGl0eU1lbnVMaXN0UG9wdXAuY3BwCisrKyBiL1NvdXJjZS9XZWJDb3JlL2FjY2Vzc2liaWxp dHkvQWNjZXNzaWJpbGl0eU1lbnVMaXN0UG9wdXAuY3BwCkBAIC0xMjQsMTEgKzEyNCwxMiBAQCB2 b2lkIEFjY2Vzc2liaWxpdHlNZW51TGlzdFBvcHVwOjpkaWRVcGRhdGVBY3RpdmVPcHRpb24oaW50 IG9wdGlvbkluZGV4KQogICAgIEFTU0VSVF9BUkcob3B0aW9uSW5kZXgsIG9wdGlvbkluZGV4ID49 IDApOwogICAgIEFTU0VSVF9BUkcob3B0aW9uSW5kZXgsIG9wdGlvbkluZGV4IDwgc3RhdGljX2Nh c3Q8aW50PihtX2NoaWxkcmVuLnNpemUoKSkpOwogCi0gICAgQVhPYmplY3RDYWNoZSogY2FjaGUg PSBheE9iamVjdENhY2hlKCk7CiAgICAgUmVmUHRyPEFYQ29yZU9iamVjdD4gY2hpbGQgPSBtX2No aWxkcmVuW29wdGlvbkluZGV4XS5nZXQoKTsKIAotICAgIGNhY2hlLT5wb3N0Tm90aWZpY2F0aW9u KGNoaWxkLmdldCgpLCBkb2N1bWVudCgpLCBBWE9iamVjdENhY2hlOjpBWEZvY3VzZWRVSUVsZW1l bnRDaGFuZ2VkLCBUYXJnZXRFbGVtZW50LCBQb3N0U3luY2hyb25vdXNseSk7Ci0gICAgY2FjaGUt PnBvc3ROb3RpZmljYXRpb24oY2hpbGQuZ2V0KCksIGRvY3VtZW50KCksIEFYT2JqZWN0Q2FjaGU6 OkFYTWVudUxpc3RJdGVtU2VsZWN0ZWQsIFRhcmdldEVsZW1lbnQsIFBvc3RTeW5jaHJvbm91c2x5 KTsKKyAgICBpZiAoYXV0byogY2FjaGUgPSBheE9iamVjdENhY2hlKCkpIHsKKyAgICAgICAgY2Fj aGUtPnBvc3ROb3RpZmljYXRpb24oY2hpbGQuZ2V0KCksIGRvY3VtZW50KCksIEFYT2JqZWN0Q2Fj aGU6OkFYRm9jdXNlZFVJRWxlbWVudENoYW5nZWQsIFRhcmdldEVsZW1lbnQsIFBvc3RBc3luY2hy b25vdXNseSk7CisgICAgICAgIGNhY2hlLT5wb3N0Tm90aWZpY2F0aW9uKGNoaWxkLmdldCgpLCBk b2N1bWVudCgpLCBBWE9iamVjdENhY2hlOjpBWE1lbnVMaXN0SXRlbVNlbGVjdGVkLCBUYXJnZXRF bGVtZW50LCBQb3N0QXN5bmNocm9ub3VzbHkpOworICAgIH0KIH0KIAogfSAvLyBuYW1lc3BhY2Ug V2ViQ29yZQo=