224388 2021-04-09 13:38:00 -0700 UI process can assert in DisplayLink::decrementFullSpeedRequestClientCount() 2021-04-15 11:38:14 -0700 1 1 1 Unclassified WebKit WebKit2 Safari Technology Preview Unspecified Unspecified RESOLVED FIXED InRadar P2 Normal --- 1 simon.fraser simon.fraser kkinnunen simon.fraser thorton webkit-bug-importer oldest_to_newest 1748849 0 simon.fraser 2021-04-09 13:38:00 -0700 This can happen when we have a process swap between m_wheelEventActivityHysteresis start and stop. To reproduce: 1. Load a page 2. Scroll 3. Load another page that immediately triggers a rendering update 4. Wait a few seconds. 0 com.apple.JavaScriptCore 0x0000000143c9d1be WTFCrash + 14 (Assertions.cpp:305) 1 com.apple.WebKit 0x000000011a5f681b WTFCrashWithInfo(int, char const*, char const*, int) + 27 (Assertions.h:671) 2 com.apple.WebKit 0x000000011c0dbb52 WebKit::DisplayLink::decrementFullSpeedRequestClientCount(IPC::Connection&) + 290 (DisplayLink.cpp:177) 3 com.apple.WebKit 0x000000011b92894a WebKit::WebProcessPool::setDisplayLinkForDisplayWantsFullSpeedUpdates(IPC::Connection&, unsigned int, bool) + 170 (WebProcessPoolCocoa.mm:831) 4 com.apple.WebKit 0x000000011bb63c36 WebKit::WebPageProxy::wheelEventHysteresisUpdated(PAL::HysteresisState) + 214 (WebPageProxy.cpp:2712) 5 com.apple.WebKit 0x000000011bbc238e WebKit::WebPageProxy::WebPageProxy(WebKit::PageClient&, WebKit::WebProcessProxy&, WTF::Ref<API::PageConfiguration, WTF::RawPtrTraits<API::PageConfiguration> >&&)::$_6::operator()(PAL::HysteresisState) const + 30 (WebPageProxy.cpp:486) 6 com.apple.WebKit 0x000000011bbc2321 WTF::Detail::CallableWrapper<WebKit::WebPageProxy::WebPageProxy(WebKit::PageClient&, WebKit::WebProcessProxy&, WTF::Ref<API::PageConfiguration, WTF::RawPtrTraits<API::PageConfiguration> >&&)::$_6, void, PAL::HysteresisState>::call(PAL::HysteresisState) + 49 (Function.h:52) 7 com.apple.WebKit 0x000000011a5fc9c8 WTF::Function<void (PAL::HysteresisState)>::operator()(PAL::HysteresisState) const + 152 (Function.h:83) 8 com.apple.WebKit 0x000000011b6273a4 PAL::HysteresisActivity::hysteresisTimerFired() + 52 (HysteresisActivity.h:88) 9 com.apple.WebKit 0x000000011b627d37 decltype(*(std::__1::forward<PAL::HysteresisActivity*&>(fp0)).*fp()) std::__1::__invoke<void (PAL::HysteresisActivity::*&)(), PAL::HysteresisActivity*&, void>(void (PAL::HysteresisActivity::*&)(), PAL::HysteresisActivity*&) + 119 (type_traits:3688) 10 com.apple.WebKit 0x000000011b627cb0 std::__1::__bind_return<void (PAL::HysteresisActivity::*)(), std::__1::tuple<PAL::HysteresisActivity*>, std::__1::tuple<>, __is_valid_bind_return<void (PAL::HysteresisActivity::*)(), std::__1::tuple<PAL::HysteresisActivity*>, std::__1::tuple<> >::value>::type std::__1::__apply_functor<void (PAL::HysteresisActivity::*)(), std::__1::tuple<PAL::HysteresisActivity*>, 0ul, std::__1::tuple<> >(void (PAL::HysteresisActivity::*&)(), std::__1::tuple<PAL::HysteresisActivity*>&, std::__1::__tuple_indices<0ul>, std::__1::tuple<>&&) + 64 (functional:2852) 11 com.apple.WebKit 0x000000011b627c69 std::__1::__bind_return<void (PAL::HysteresisActivity::*)(), std::__1::tuple<PAL::HysteresisActivity*>, std::__1::tuple<>, __is_valid_bind_return<void (PAL::HysteresisActivity::*)(), std::__1::tuple<PAL::HysteresisActivity*>, std::__1::tuple<> >::value>::type std::__1::__bind<void (PAL::HysteresisActivity::*&)(), PAL::HysteresisActivity*&>::operator()<>() + 41 (functional:2885) 12 com.apple.WebKit 0x000000011b627bee WTF::Detail::CallableWrapper<std::__1::__bind<void (PAL::HysteresisActivity::*&)(), PAL::HysteresisActivity*&>, void>::call() + 30 (Function.h:52) 13 com.apple.WebKit 0x000000011a63dc32 WTF::Function<void ()>::operator()() const + 130 (Function.h:83) 14 com.apple.WebKit 0x000000011a63db7e WTF::RunLoop::Timer<PAL::HysteresisActivity>::fired() + 30 (RunLoop.h:187) 15 com.apple.JavaScriptCore 0x0000000143d5442c WTF::RunLoop::TimerBase::start(WTF::Seconds, bool)::$_1::operator()(__CFRunLoopTimer*, void*) const + 76 (RunLoopCF.cpp:126) 16 com.apple.JavaScriptCore 0x0000000143d543cd WTF::RunLoop::TimerBase::start(WTF::Seconds, bool)::$_1::__invoke(__CFRunLoopTimer*, void*) + 29 (RunLoopCF.cpp:119) 17 com.apple.CoreFoundation 0x00007fff204813c9 __CFRUNLOOP_IS_CALLING_OUT_TO_A_TIMER_CALLBACK_FUNCTION__ + 20 1748857 1 425648 simon.fraser 2021-04-09 14:00:19 -0700 Created attachment 425648 Patch 1750693 2 ews-feeder 2021-04-15 11:37:10 -0700 Committed r276036 (236580@main): <https://commits.webkit.org/236580@main> All reviewed patches have been landed. Closing bug and clearing flags on attachment 425648. 1750694 3 webkit-bug-importer 2021-04-15 11:38:14 -0700 <rdar://problem/76714742> 425648 2021-04-09 14:00:19 -0700 2021-04-15 11:37:11 -0700 Patch bug-224388-20210409140019.patch text/plain 4808 simon.fraser U3VidmVyc2lvbiBSZXZpc2lvbjogMjc1NjU5CmRpZmYgLS1naXQgYS9Tb3VyY2UvV2ViS2l0L0No YW5nZUxvZyBiL1NvdXJjZS9XZWJLaXQvQ2hhbmdlTG9nCmluZGV4IDlkNWJmOGRiMDYyMWRmYWUx MWI3YTc1YzhjYzBhODhjMTcwZmE1MzEuLjUzNjcyNTY4YTAzMjJiMzU0M2RmYmJkYjcyZDYyN2U3 NzA5N2I4OGIgMTAwNjQ0Ci0tLSBhL1NvdXJjZS9XZWJLaXQvQ2hhbmdlTG9nCisrKyBiL1NvdXJj ZS9XZWJLaXQvQ2hhbmdlTG9nCkBAIC0xLDMgKzEsMjUgQEAKKzIwMjEtMDQtMDkgIFNpbW9uIEZy YXNlciAgPHNpbW9uLmZyYXNlckBhcHBsZS5jb20+CisKKyAgICAgICAgVUkgcHJvY2VzcyBjYW4g YXNzZXJ0IGluIERpc3BsYXlMaW5rOjpkZWNyZW1lbnRGdWxsU3BlZWRSZXF1ZXN0Q2xpZW50Q291 bnQoKQorICAgICAgICBodHRwczovL2J1Z3Mud2Via2l0Lm9yZy9zaG93X2J1Zy5jZ2k/aWQ9MjI0 Mzg4CisKKyAgICAgICAgUmV2aWV3ZWQgYnkgTk9CT0RZIChPT1BTISkuCisKKyAgICAgICAgVGhl IHN0YXJ0L3N0b3Agb2YgbV93aGVlbEV2ZW50QWN0aXZpdHlIeXN0ZXJlc2lzIGluIFdlYlBhZ2VQ cm94eSBjb3VsZCBjcm9zcworICAgICAgICBhIHByb2Nlc3Mgc3dhcCBib3VuZGFyeSwgcmVzdWx0 aW5nIGluIGEgZGVjcmVtZW50IGdldHRpbmcgc2VudCB0byB0aGUgbmV3IERpc3BsYXlMaW5rL2Nv bm5lY3Rpb24KKyAgICAgICAgcGFpciBmb3IgdGhlIG5ldyBwcm9jZXNzLCB3aGljaCBhc3NlcnRl ZC4KKworICAgICAgICBGaXggYnkgdGVsbGluZyB0aGUgRGlzcGxheUxpbmsgYWJvdXQgbmV3IHBy b2Nlc3NlcyB3aGVuIHdlJ3JlIGluIGFuIGFjdGl2ZSB3aGVlbAorICAgICAgICBldmVudCBzdGF0 ZS4KKworICAgICAgICAqIFVJUHJvY2Vzcy9XZWJQYWdlUHJveHkuY3BwOgorICAgICAgICAoV2Vi S2l0OjpXZWJQYWdlUHJveHk6OmZpbmlzaEF0dGFjaGluZ1RvV2ViUHJvY2Vzcyk6CisgICAgICAg IChXZWJLaXQ6OldlYlBhZ2VQcm94eTo6dXBkYXRlV2hlZWxFdmVudEFjdGl2aXR5QWZ0ZXJQcm9j ZXNzU3dhcCk6CisgICAgICAgICogVUlQcm9jZXNzL1dlYlBhZ2VQcm94eS5oOgorICAgICAgICAq IFdlYlByb2Nlc3MvV2ViUGFnZS9tYWMvRGlzcGxheVJlZnJlc2hNb25pdG9yTWFjLmNwcDoKKyAg ICAgICAgKFdlYktpdDo6RGlzcGxheVJlZnJlc2hNb25pdG9yTWFjOjpzdGFydE5vdGlmaWNhdGlv bk1lY2hhbmlzbSk6CisgICAgICAgIChXZWJLaXQ6OkRpc3BsYXlSZWZyZXNoTW9uaXRvck1hYzo6 c3RvcE5vdGlmaWNhdGlvbk1lY2hhbmlzbSk6CisKIDIwMjEtMDQtMDggIFNpaHVpIExpdSAgPHNp aHVpX2xpdUBhcHBsZS5jb20+CiAKICAgICAgICAgUmVtb3ZlIGxvZ2dpbmcgZm9yIGludmVzdGln YXRpbmcgaHR0cC90ZXN0cy9JbmRleGVkREIvc3RvcmFnZS1saW1pdC0xLmh0bWwgZmFpbHVyZQpk aWZmIC0tZ2l0IGEvU291cmNlL1dlYktpdC9VSVByb2Nlc3MvV2ViUGFnZVByb3h5LmNwcCBiL1Nv dXJjZS9XZWJLaXQvVUlQcm9jZXNzL1dlYlBhZ2VQcm94eS5jcHAKaW5kZXggMWM0ZjU2MWQ3Yzg4 OWU5NWYzOTE3ODM4OWFhYmQyNzIzMjczNzRmYS4uOTQyZGY1NTU1ZmY4ZTQwZjI1ZGU4ZDc0OWE1 ZjMyMGIzY2IyY2NlOSAxMDA2NDQKLS0tIGEvU291cmNlL1dlYktpdC9VSVByb2Nlc3MvV2ViUGFn ZVByb3h5LmNwcAorKysgYi9Tb3VyY2UvV2ViS2l0L1VJUHJvY2Vzcy9XZWJQYWdlUHJveHkuY3Bw CkBAIC05ODAsNiArOTgwLDggQEAgdm9pZCBXZWJQYWdlUHJveHk6OmZpbmlzaEF0dGFjaGluZ1Rv V2ViUHJvY2VzcyhQcm9jZXNzTGF1bmNoUmVhc29uIHJlYXNvbikKICAgICByZW1vdGVJbnNwZWN0 b3JJbmZvcm1hdGlvbkRpZENoYW5nZSgpOwogI2VuZGlmCiAKKyAgICB1cGRhdGVXaGVlbEV2ZW50 QWN0aXZpdHlBZnRlclByb2Nlc3NTd2FwKCk7CisKICAgICBwYWdlQ2xpZW50KCkuZGlkUmVsYXVu Y2hQcm9jZXNzKCk7CiAgICAgbV9wYWdlTG9hZFN0YXRlLmRpZFN3YXBXZWJQcm9jZXNzZXMoKTsK ICAgICBpZiAocmVhc29uICE9IFByb2Nlc3NMYXVuY2hSZWFzb246OkluaXRpYWxQcm9jZXNzKQpA QCAtMjc1Myw2ICsyNzU1LDE2IEBAIHZvaWQgV2ViUGFnZVByb3h5Ojp3aGVlbEV2ZW50SHlzdGVy ZXNpc1VwZGF0ZWQoUEFMOjpIeXN0ZXJlc2lzU3RhdGUgc3RhdGUpCiB9CiAjZW5kaWYKIAordm9p ZCBXZWJQYWdlUHJveHk6OnVwZGF0ZVdoZWVsRXZlbnRBY3Rpdml0eUFmdGVyUHJvY2Vzc1N3YXAo KQoreworI2lmIEhBVkUoQ1ZESVNQTEFZTElOSykKKyAgICBpZiAobV93aGVlbEV2ZW50QWN0aXZp dHlIeXN0ZXJlc2lzLnN0YXRlKCkgPT0gUEFMOjpIeXN0ZXJlc2lzU3RhdGU6OlN0YXJ0ZWQpIHsK KyAgICAgICAgYm9vbCB3YW50c0Z1bGxTcGVlZFVwZGF0ZXMgPSB0cnVlOworICAgICAgICBwcm9j ZXNzKCkucHJvY2Vzc1Bvb2woKS5zZXREaXNwbGF5TGlua0ZvckRpc3BsYXlXYW50c0Z1bGxTcGVl ZFVwZGF0ZXMoKm1fcHJvY2Vzcy0+Y29ubmVjdGlvbigpLCAqbV9kaXNwbGF5SUQsIHdhbnRzRnVs bFNwZWVkVXBkYXRlcyk7CisgICAgfQorI2VuZGlmCit9CisKIHZvaWQgV2ViUGFnZVByb3h5Ojpz ZW5kV2hlZWxFdmVudChjb25zdCBXZWJXaGVlbEV2ZW50JiBldmVudCkKIHsKICNpZiBIQVZFKENW RElTUExBWUxJTkspCmRpZmYgLS1naXQgYS9Tb3VyY2UvV2ViS2l0L1VJUHJvY2Vzcy9XZWJQYWdl UHJveHkuaCBiL1NvdXJjZS9XZWJLaXQvVUlQcm9jZXNzL1dlYlBhZ2VQcm94eS5oCmluZGV4IDU5 MjhkMDVmYmJkOTdmNDM2NGM0Yjc3NTgyNjA0NThlMzc5ZTJjZDguLjM4OTJkM2RhYzExYzc1MWZj MGEzOWJhMTRmM2VmMjU1YzgwZmJjNmEgMTAwNjQ0Ci0tLSBhL1NvdXJjZS9XZWJLaXQvVUlQcm9j ZXNzL1dlYlBhZ2VQcm94eS5oCisrKyBiL1NvdXJjZS9XZWJLaXQvVUlQcm9jZXNzL1dlYlBhZ2VQ cm94eS5oCkBAIC0yMzA2LDYgKzIzMDYsNyBAQCBwcml2YXRlOgogI2lmIEhBVkUoQ1ZESVNQTEFZ TElOSykKICAgICB2b2lkIHdoZWVsRXZlbnRIeXN0ZXJlc2lzVXBkYXRlZChQQUw6Okh5c3RlcmVz aXNTdGF0ZSk7CiAjZW5kaWYKKyAgICB2b2lkIHVwZGF0ZVdoZWVsRXZlbnRBY3Rpdml0eUFmdGVy UHJvY2Vzc1N3YXAoKTsKIAogI2lmIEVOQUJMRShUT1VDSF9FVkVOVFMpCiAgICAgdm9pZCB1cGRh dGVUb3VjaEV2ZW50VHJhY2tpbmcoY29uc3QgV2ViVG91Y2hFdmVudCYpOwpkaWZmIC0tZ2l0IGEv U291cmNlL1dlYktpdC9XZWJQcm9jZXNzL1dlYlBhZ2UvbWFjL0Rpc3BsYXlSZWZyZXNoTW9uaXRv ck1hYy5jcHAgYi9Tb3VyY2UvV2ViS2l0L1dlYlByb2Nlc3MvV2ViUGFnZS9tYWMvRGlzcGxheVJl ZnJlc2hNb25pdG9yTWFjLmNwcAppbmRleCAyMGFlMzNiMzMzY2JkMWYyYzQxMWE3YzliMGIxYThl OTBiYmI0MDM0Li5iNzAyZDc5MmE5OGY0NzEzYzM5NzAzMGM0ZDhhMGQxNjExYWNkMDA4IDEwMDY0 NAotLS0gYS9Tb3VyY2UvV2ViS2l0L1dlYlByb2Nlc3MvV2ViUGFnZS9tYWMvRGlzcGxheVJlZnJl c2hNb25pdG9yTWFjLmNwcAorKysgYi9Tb3VyY2UvV2ViS2l0L1dlYlByb2Nlc3MvV2ViUGFnZS9t YWMvRGlzcGxheVJlZnJlc2hNb25pdG9yTWFjLmNwcApAQCAtNzEsNyArNzEsNyBAQCBib29sIERp c3BsYXlSZWZyZXNoTW9uaXRvck1hYzo6c3RhcnROb3RpZmljYXRpb25NZWNoYW5pc20oKQogICAg IGlmIChtX2Rpc3BsYXlMaW5rSXNBY3RpdmUpCiAgICAgICAgIHJldHVybiB0cnVlOwogCi0gICAg TE9HX1dJVEhfU1RSRUFNKERpc3BsYXlMaW5rLCBzdHJlYW0gPDwgIltXZWIgXSBEaXNwbGF5UmVm cmVzaE1vbml0b3JNYWM6OnJlcXVlc3RSZWZyZXNoQ2FsbGJhY2sgZm9yIGRpc3BsYXkgIiA8PCBk aXNwbGF5SUQoKSA8PCAiIC0gc3RhcnRpbmciKTsKKyAgICBMT0dfV0lUSF9TVFJFQU0oRGlzcGxh eUxpbmssIHN0cmVhbSA8PCAiW1dlYl0gRGlzcGxheVJlZnJlc2hNb25pdG9yTWFjOjpyZXF1ZXN0 UmVmcmVzaENhbGxiYWNrIGZvciBkaXNwbGF5ICIgPDwgZGlzcGxheUlEKCkgPDwgIiAtIHN0YXJ0 aW5nIik7CiAgICAgV2ViUHJvY2Vzczo6c2luZ2xldG9uKCkucGFyZW50UHJvY2Vzc0Nvbm5lY3Rp b24oKS0+c2VuZChNZXNzYWdlczo6V2ViUHJvY2Vzc1Byb3h5OjpTdGFydERpc3BsYXlMaW5rKG1f b2JzZXJ2ZXJJRCwgZGlzcGxheUlEKCksIG1heENsaWVudFByZWZlcnJlZEZyYW1lc1BlclNlY29u ZCgpLnZhbHVlT3IoRnVsbFNwZWVkRnJhbWVzUGVyU2Vjb25kKSksIDApOwogICAgIGlmICghbV9y dW5Mb29wT2JzZXJ2ZXIpIHsKICAgICAgICAgLy8gVGhlIFJ1bkxvb3BPYnNlcnZlciByZXBlYXRz LgpAQCAtOTEsNyArOTEsNyBAQCB2b2lkIERpc3BsYXlSZWZyZXNoTW9uaXRvck1hYzo6c3RvcE5v dGlmaWNhdGlvbk1lY2hhbmlzbSgpCiAgICAgaWYgKCFtX2Rpc3BsYXlMaW5rSXNBY3RpdmUpCiAg ICAgICAgIHJldHVybjsKIAotICAgIExPR19XSVRIX1NUUkVBTShEaXNwbGF5TGluaywgc3RyZWFt IDw8ICJEaXNwbGF5UmVmcmVzaE1vbml0b3JNYWM6OnJlcXVlc3RSZWZyZXNoQ2FsbGJhY2sgLSBz dG9wcGluZyIpOworICAgIExPR19XSVRIX1NUUkVBTShEaXNwbGF5TGluaywgc3RyZWFtIDw8ICJb V2ViXSBEaXNwbGF5UmVmcmVzaE1vbml0b3JNYWM6OnJlcXVlc3RSZWZyZXNoQ2FsbGJhY2sgLSBz dG9wcGluZyIpOwogICAgIFdlYlByb2Nlc3M6OnNpbmdsZXRvbigpLnBhcmVudFByb2Nlc3NDb25u ZWN0aW9uKCktPnNlbmQoTWVzc2FnZXM6OldlYlByb2Nlc3NQcm94eTo6U3RvcERpc3BsYXlMaW5r KG1fb2JzZXJ2ZXJJRCwgZGlzcGxheUlEKCkpLCAwKTsKICAgICBtX3J1bkxvb3BPYnNlcnZlci0+ aW52YWxpZGF0ZSgpOwogICAgIAo=