234739 2021-12-29 06:58:54 -0800 AX: web process crash with isolated tree mode enabled 2022-01-03 01:21:34 -0800 1 1 1 Unclassified WebKit Accessibility WebKit Nightly Build All All RESOLVED FIXED InRadar P2 Normal --- 1 cgarcia webkit-unassigned aboxhall andresg_22 apinheiro cfleizach dmazzoni ews-watchlist jcraig jdiggs samuel_white webkit-bug-importer oldest_to_newest 1827164 0 cgarcia 2021-12-29 06:58:54 -0800 #0 0x00007f6a18cad3fc in WebCore::AccessibilityObjectAtspi::attach(WebCore::AXCoreObject*) () from libwebkit2gtk-4.1.so.0 #1 0x00007f6a18ceb0ff in WebCore::AXIsolatedTree::createSubtree(WebCore::AXCoreObject&, WTF::ObjectIdentifier<WebCore::AXIDType>, bool) () from libwebkit2gtk-4.1.so.0 #2 0x00007f6a18ceb449 in WebCore::AXIsolatedTree::generateSubtree(WebCore::AXCoreObject&, WebCore::AXCoreObject*, bool) [clone .part.0] () from libwebkit2gtk-4.1.so.0 #3 0x00007f6a18cebf2c in WebCore::AXIsolatedTree::updateChildren(WebCore::AXCoreObject&) () from libwebkit2gtk-4.1.so.0 #4 0x00007f6a18c468bf in WebCore::AXObjectCache::updateIsolatedTree(WTF::Vector<std::pair<WTF::RefPtr<WebCore::AXCoreObject, WTF::RawPtrTraits<WebCore::AXCoreObject>, WTF::DefaultRefDerefTraits<WebCore::AXCoreObject> >, WebCore::AXObjectCache::AXNotification>, 0ul, WTF::CrashOnOverflow, 16ul, WTF::FastMalloc> const&) () from libwebkit2gtk-4.1.so.0 #5 0x00007f6a18c46afb in WebCore::AXObjectCache::notificationPostTimerFired() () from libwebkit2gtk-4.1.so.0 #6 0x00007f6a198b597f in WebCore::ThreadTimers::sharedTimerFiredInternal() [clone .part.0] () from libwebkit2gtk-4.1.so.0 #7 0x00007f6a1674bd15 in WTF::RunLoop::TimerBase::TimerBase(WTF::RunLoop&)::{lambda(void*)#1}::_FUN(void*) () from libjavascriptcoregtk-4.1.so.0 #8 0x00007f6a1674c2af in WTF::RunLoop::{lambda(_GSource*, int (*)(void*), void*)#1}::_FUN(_GSource*, int (*)(void*), void*) () from libjavascriptcoregtk-4.1.so.0 #9 0x00007f6a16b2e5c4 in g_main_dispatch (context=0x55bbde8f2260) at ../glib/gmain.c:3381 #10 g_main_context_dispatch (context=0x55bbde8f2260) at ../glib/gmain.c:4099 #11 0x00007f6a16b2e928 in g_main_context_iterate (context=0x55bbde8f2260, block=block@entry=1, dispatch=dispatch@entry=1, self=<optimized out>) at ../glib/gmain.c:4175 #12 0x00007f6a16b2ec03 in g_main_loop_run (loop=0x55bbdea74600) at ../glib/gmain.c:4373 #13 0x00007f6a1674c3d0 in WTF::RunLoop::run() () from libjavascriptcoregtk-4.1.so.0 #14 0x00007f6a1816f5ff in int WebKit::AuxiliaryProcessMain<WebKit::WebProcessMainGtk>(int, char**) () from libwebkit2gtk-4.1.so.0 #15 0x00007f6a16f877ed in __libc_start_main (main=0x55bbdcef46a0 <main>, argc=3, argv=0x7ffc8a5b7ae8, init=<optimized out>, fini=<optimized out>, rtld_fini=<optimized out>, stack_end=0x7ffc8a5b7ad8) at ../csu/libc-start.c:332 #16 0x000055bbdcef46da in _start () The wrapper we try to attach has already been deleted. This is what happens: 1.- children changed notification 2.- AXIsolatedTree::updateChildren() calls generateSubtree() to add a new child. 3.- generateSubtree() calls createSubtree() that creates the AXIsolatedObject 4.- AXIsolatedObject::initializeAttributeData() calls AccessibilityObject::computedLabel() to initialize the computed label property 5.- AccessibilityObject::computedLabel() calls updateBackingStore that triggers a layout 6.- The layout ends up removing the new node from the cache, causing the wrapper to be detached and destroyed. 7.- AXIsolatedObject::create() finishes and now axObject.wrapper() is nullptr when attachPlatformWrapper is called. I think we can just get rid of computedLabel for isolated objects, since that is only used by the inspector that uses the AccessibilityObject directly. 1827165 1 webkit-bug-importer 2021-12-29 06:59:09 -0800 <rdar://problem/86983058> 1827166 2 448070 cgarcia 2021-12-29 07:04:48 -0800 Created attachment 448070 Patch 1827173 3 448070 cfleizach 2021-12-29 08:26:06 -0800 Comment on attachment 448070 Patch View in context: https://bugs.webkit.org/attachment.cgi?id=448070&action=review > Source/WebCore/accessibility/isolatedtree/AXIsolatedObject.cpp:804 > + return { }; Can you add a comment explaining why we shouldn’t reach here 1827241 4 cgarcia 2021-12-30 07:13:25 -0800 (In reply to chris fleizach from comment #3) > Comment on attachment 448070 [details] > Patch > > View in context: > https://bugs.webkit.org/attachment.cgi?id=448070&action=review > > > Source/WebCore/accessibility/isolatedtree/AXIsolatedObject.cpp:804 > > + return { }; > > Can you add a comment explaining why we shouldn’t reach here Sure, I'll add it before landing. 1827242 5 cgarcia 2021-12-30 07:20:16 -0800 I've noticed a lot more layout tests failures with isolated tree mode enabled with this patch. The updateBackingStore call while creating isolated objects caused a layout + updateChildrenIfNeeded that made the isolated tree to be fully populated earlier. I still think the early layout is not desirable when creating the isolated tree, but had the side effect of having the full tree available soon. This will require more a11y tests to be async to pass with isolated tree. 1827654 6 cgarcia 2022-01-03 01:21:34 -0800 Committed r287533 (245668@trunk): <https://commits.webkit.org/245668@trunk> 448070 2021-12-29 07:04:48 -0800 2021-12-29 08:26:06 -0800 Patch wcore-ax-isolated-crash.diff text/plain 5270 cgarcia ZGlmZiAtLWdpdCBhL1NvdXJjZS9XZWJDb3JlL0NoYW5nZUxvZyBiL1NvdXJjZS9XZWJDb3JlL0No YW5nZUxvZwppbmRleCAzMjE1ZjZmMmEzYWQuLjFkOWY0YzQ3NjQ0MiAxMDA2NDQKLS0tIGEvU291 cmNlL1dlYkNvcmUvQ2hhbmdlTG9nCisrKyBiL1NvdXJjZS9XZWJDb3JlL0NoYW5nZUxvZwpAQCAt MSwzICsxLDI0IEBACisyMDIxLTEyLTI5ICBDYXJsb3MgR2FyY2lhIENhbXBvcyAgPGNnYXJjaWFA aWdhbGlhLmNvbT4KKworICAgICAgICBBWDogd2ViIHByb2Nlc3MgY3Jhc2ggd2l0aCBpc29sYXRl ZCB0cmVlIG1vZGUgZW5hYmxlZAorICAgICAgICBodHRwczovL2J1Z3Mud2Via2l0Lm9yZy9zaG93 X2J1Zy5jZ2k/aWQ9MjM0NzM5CisgICAgICAgIDxyZGFyOi8vcHJvYmxlbS84Njk4MzA1OD4KKwor ICAgICAgICBSZXZpZXdlZCBieSBOT0JPRFkgKE9PUFMhKS4KKworICAgICAgICBJdCBjYW4gaGFw cGVuIHRoYXQgYSBuZXcgbm9kZSBiZWluZyBhZGRlZCBpcyByZW1vdmVkIGJ5IEFYSXNvbGF0ZWRP YmplY3QgY29uc3RydWN0b3Igd2hlbiBpbml0aWFsaXppbmcKKyAgICAgICAgQ29tcHV0ZWRMYWJl bCBwcm9wZXJ0eSwgYmVjYXVzZSBBY2Nlc3NpYmlsaXR5T2JqZWN0Ojpjb21wdXRlZExhYmVsKCkg Y2FsbHMgdXBkYXRlQmFja2luZ1N0b3JlKCkgdGhhdCBjYW4gdHJpZ2dlcgorICAgICAgICBhIGxh eW91dC4gV2UgZG9uJ3QgcmVhbGx5IG5lZWQgQ29tcHV0ZWRMYWJlbCBwcm9wZXJ0eSBmb3IgaXNv bGF0ZWQgb2JqZWN0cyBiZWNhdXNlIEFjY2Vzc2liaWxpdHlPYmplY3Q6OmNvbXB1dGVkTGFiZWwo KQorICAgICAgICBpcyBvbmx5IHVzZWQgYnkgdGhlIGluc3BlY3RvciB0aGF0IHVzZXMgQWNjZXNz aWJpbGl0eU9iamVjdCBkaXJlY3RseS4KKworICAgICAgICAqIGFjY2Vzc2liaWxpdHkvaXNvbGF0 ZWR0cmVlL0FYSXNvbGF0ZWRPYmplY3QuY3BwOgorICAgICAgICAoV2ViQ29yZTo6QVhJc29sYXRl ZE9iamVjdDo6aW5pdGlhbGl6ZUF0dHJpYnV0ZURhdGEpOiBSZW1vdmUgQ29tcHV0ZWRMYWJlbCBw cm9wZXJ0eSBpbml0aWFsaXphdGlvbi4KKyAgICAgICAgKFdlYkNvcmU6OkFYSXNvbGF0ZWRPYmpl Y3Q6OmNvbXB1dGVkTGFiZWwpOiBBc3NlcnQgaWYgY2FsbGVkLgorICAgICAgICAqIGFjY2Vzc2li aWxpdHkvaXNvbGF0ZWR0cmVlL0FYSXNvbGF0ZWRPYmplY3QuaDoKKyAgICAgICAgKiBhY2Nlc3Np YmlsaXR5L2lzb2xhdGVkdHJlZS9BWElzb2xhdGVkVHJlZS5jcHA6CisgICAgICAgIChXZWJDb3Jl OjpBWElzb2xhdGVkVHJlZTo6Y3JlYXRlU3VidHJlZSk6IEFkZCBhbiBhc3NlcnQgdG8gZW5zdXJl IHRoZSB3cmFwcGVyIGlzIHN0aWxsIHZhbGlkIGFmdGVyIEFYSXNvbGF0ZWRPYmplY3Q6OmNyZWF0 ZSgpLgorICAgICAgICAqIGFjY2Vzc2liaWxpdHkvaXNvbGF0ZWR0cmVlL0FYSXNvbGF0ZWRUcmVl Lmg6CisKIDIwMjEtMTItMjkgIENhcmxvcyBHYXJjaWEgQ2FtcG9zICA8Y2dhcmNpYUBpZ2FsaWEu Y29tPgogCiAgICAgICAgIFtHVEtdW2ExMXldIFdlYiBwcm9jZXNzIGNyYXNoZXMgaW4gc29tZSBz aXRlcyBoYXZpbmcgU1ZHIGltYWdlcwpkaWZmIC0tZ2l0IGEvU291cmNlL1dlYkNvcmUvYWNjZXNz aWJpbGl0eS9pc29sYXRlZHRyZWUvQVhJc29sYXRlZE9iamVjdC5jcHAgYi9Tb3VyY2UvV2ViQ29y ZS9hY2Nlc3NpYmlsaXR5L2lzb2xhdGVkdHJlZS9BWElzb2xhdGVkT2JqZWN0LmNwcAppbmRleCBh ZmU4ZWZjMjU5YmIuLjk1Zjk5ZTYyMTA2YSAxMDA2NDQKLS0tIGEvU291cmNlL1dlYkNvcmUvYWNj ZXNzaWJpbGl0eS9pc29sYXRlZHRyZWUvQVhJc29sYXRlZE9iamVjdC5jcHAKKysrIGIvU291cmNl L1dlYkNvcmUvYWNjZXNzaWJpbGl0eS9pc29sYXRlZHRyZWUvQVhJc29sYXRlZE9iamVjdC5jcHAK QEAgLTIwMCw3ICsyMDAsNiBAQCB2b2lkIEFYSXNvbGF0ZWRPYmplY3Q6OmluaXRpYWxpemVBdHRy aWJ1dGVEYXRhKEFYQ29yZU9iamVjdCYgY29yZU9iamVjdCwgYm9vbCBpcwogICAgIHNldE9iamVj dFByb3BlcnR5KEFYUHJvcGVydHlOYW1lOjpWZXJ0aWNhbFNjcm9sbEJhciwgb2JqZWN0LnNjcm9s bEJhcihBY2Nlc3NpYmlsaXR5T3JpZW50YXRpb246OlZlcnRpY2FsKSk7CiAgICAgc2V0T2JqZWN0 UHJvcGVydHkoQVhQcm9wZXJ0eU5hbWU6Okhvcml6b250YWxTY3JvbGxCYXIsIG9iamVjdC5zY3Jv bGxCYXIoQWNjZXNzaWJpbGl0eU9yaWVudGF0aW9uOjpIb3Jpem9udGFsKSk7CiAgICAgc2V0UHJv cGVydHkoQVhQcm9wZXJ0eU5hbWU6OkFSSUFSb2xlQXR0cmlidXRlLCBzdGF0aWNfY2FzdDxpbnQ+ KG9iamVjdC5hcmlhUm9sZUF0dHJpYnV0ZSgpKSk7Ci0gICAgc2V0UHJvcGVydHkoQVhQcm9wZXJ0 eU5hbWU6OkNvbXB1dGVkTGFiZWwsIG9iamVjdC5jb21wdXRlZExhYmVsKCkuaXNvbGF0ZWRDb3B5 KCkpOwogICAgIHNldFByb3BlcnR5KEFYUHJvcGVydHlOYW1lOjpQbGFjZWhvbGRlclZhbHVlLCBv YmplY3QucGxhY2Vob2xkZXJWYWx1ZSgpLmlzb2xhdGVkQ29weSgpKTsKICAgICBzZXRQcm9wZXJ0 eShBWFByb3BlcnR5TmFtZTo6RXhwYW5kZWRUZXh0VmFsdWUsIG9iamVjdC5leHBhbmRlZFRleHRW YWx1ZSgpLmlzb2xhdGVkQ29weSgpKTsKICAgICBzZXRQcm9wZXJ0eShBWFByb3BlcnR5TmFtZTo6 U3VwcG9ydHNFeHBhbmRlZFRleHRWYWx1ZSwgb2JqZWN0LnN1cHBvcnRzRXhwYW5kZWRUZXh0VmFs dWUoKSk7CkBAIC03OTksNiArNzk4LDEyIEBAIHZvaWQgQVhJc29sYXRlZE9iamVjdDo6c2V0Q2Fy ZXRCcm93c2luZ0VuYWJsZWQoYm9vbCB2YWx1ZSkKIH0KICNlbmRpZgogCitTdHJpbmcgQVhJc29s YXRlZE9iamVjdDo6Y29tcHV0ZWRMYWJlbCgpCit7CisgICAgQVNTRVJUX05PVF9SRUFDSEVEKCk7 CisgICAgcmV0dXJuIHsgfTsKK30KKwogU1JHQkE8dWludDhfdD4gQVhJc29sYXRlZE9iamVjdDo6 Y29sb3JWYWx1ZSgpIGNvbnN0CiB7CiAgICAgcmV0dXJuIGNvbG9yQXR0cmlidXRlVmFsdWUoQVhQ cm9wZXJ0eU5hbWU6OkNvbG9yVmFsdWUpLnRvU1JHQkFMb3NzeTx1aW50OF90PigpOwpkaWZmIC0t Z2l0IGEvU291cmNlL1dlYkNvcmUvYWNjZXNzaWJpbGl0eS9pc29sYXRlZHRyZWUvQVhJc29sYXRl ZE9iamVjdC5oIGIvU291cmNlL1dlYkNvcmUvYWNjZXNzaWJpbGl0eS9pc29sYXRlZHRyZWUvQVhJ c29sYXRlZE9iamVjdC5oCmluZGV4IDUzYmI3OTEyZmI2Yy4uNDhhNjc4YzA3YTQzIDEwMDY0NAot LS0gYS9Tb3VyY2UvV2ViQ29yZS9hY2Nlc3NpYmlsaXR5L2lzb2xhdGVkdHJlZS9BWElzb2xhdGVk T2JqZWN0LmgKKysrIGIvU291cmNlL1dlYkNvcmUvYWNjZXNzaWJpbGl0eS9pc29sYXRlZHRyZWUv QVhJc29sYXRlZE9iamVjdC5oCkBAIC0yNjEsNyArMjYxLDcgQEAgcHJpdmF0ZToKICAgICBBWENv cmVPYmplY3QqIHRpdGxlVUlFbGVtZW50KCkgY29uc3Qgb3ZlcnJpZGUgeyByZXR1cm4gb2JqZWN0 QXR0cmlidXRlVmFsdWUoQVhQcm9wZXJ0eU5hbWU6OlRpdGxlVUlFbGVtZW50KTsgfQogICAgIEFY Q29yZU9iamVjdCogc2Nyb2xsQmFyKEFjY2Vzc2liaWxpdHlPcmllbnRhdGlvbikgb3ZlcnJpZGU7 CiAgICAgQWNjZXNzaWJpbGl0eVJvbGUgYXJpYVJvbGVBdHRyaWJ1dGUoKSBjb25zdCBvdmVycmlk ZSB7IHJldHVybiBzdGF0aWNfY2FzdDxBY2Nlc3NpYmlsaXR5Um9sZT4oaW50QXR0cmlidXRlVmFs dWUoQVhQcm9wZXJ0eU5hbWU6OkFSSUFSb2xlQXR0cmlidXRlKSk7IH0KLSAgICBTdHJpbmcgY29t cHV0ZWRMYWJlbCgpIG92ZXJyaWRlIHsgcmV0dXJuIHN0cmluZ0F0dHJpYnV0ZVZhbHVlKEFYUHJv cGVydHlOYW1lOjpDb21wdXRlZExhYmVsKTsgfQorICAgIFN0cmluZyBjb21wdXRlZExhYmVsKCkg b3ZlcnJpZGU7CiAgICAgaW50IHRleHRMZW5ndGgoKSBjb25zdCBvdmVycmlkZSB7IHJldHVybiBp bnRBdHRyaWJ1dGVWYWx1ZShBWFByb3BlcnR5TmFtZTo6VGV4dExlbmd0aCk7IH0KICAgICBjb25z dCBTdHJpbmcgcGxhY2Vob2xkZXJWYWx1ZSgpIGNvbnN0IG92ZXJyaWRlIHsgcmV0dXJuIHN0cmlu Z0F0dHJpYnV0ZVZhbHVlKEFYUHJvcGVydHlOYW1lOjpQbGFjZWhvbGRlclZhbHVlKTsgfQogICAg IFN0cmluZyBleHBhbmRlZFRleHRWYWx1ZSgpIGNvbnN0IG92ZXJyaWRlIHsgcmV0dXJuIHN0cmlu Z0F0dHJpYnV0ZVZhbHVlKEFYUHJvcGVydHlOYW1lOjpFeHBhbmRlZFRleHRWYWx1ZSk7IH0KZGlm ZiAtLWdpdCBhL1NvdXJjZS9XZWJDb3JlL2FjY2Vzc2liaWxpdHkvaXNvbGF0ZWR0cmVlL0FYSXNv bGF0ZWRUcmVlLmNwcCBiL1NvdXJjZS9XZWJDb3JlL2FjY2Vzc2liaWxpdHkvaXNvbGF0ZWR0cmVl L0FYSXNvbGF0ZWRUcmVlLmNwcAppbmRleCA0MGIyOTRmYmMzZTQuLjkxYTc5ZTNkYzlmYyAxMDA2 NDQKLS0tIGEvU291cmNlL1dlYkNvcmUvYWNjZXNzaWJpbGl0eS9pc29sYXRlZHRyZWUvQVhJc29s YXRlZFRyZWUuY3BwCisrKyBiL1NvdXJjZS9XZWJDb3JlL2FjY2Vzc2liaWxpdHkvaXNvbGF0ZWR0 cmVlL0FYSXNvbGF0ZWRUcmVlLmNwcApAQCAtMjA5LDYgKzIwOSw4IEBAIFJlZjxBWElzb2xhdGVk T2JqZWN0PiBBWElzb2xhdGVkVHJlZTo6Y3JlYXRlU3VidHJlZShBWENvcmVPYmplY3QmIGF4T2Jq ZWN0LCBBWElECiAgICAgICAgIHJldHVybiBvYmplY3Q7CiAgICAgfQogCisgICAgQVNTRVJUKGF4 T2JqZWN0LndyYXBwZXIoKSk7CisKICAgICBOb2RlQ2hhbmdlIG5vZGVDaGFuZ2UgeyBvYmplY3Qs IG51bGxwdHIgfTsKICAgICBpZiAoYXR0YWNoV3JhcHBlcikKICAgICAgICAgb2JqZWN0LT5hdHRh Y2hQbGF0Zm9ybVdyYXBwZXIoYXhPYmplY3Qud3JhcHBlcigpKTsKZGlmZiAtLWdpdCBhL1NvdXJj ZS9XZWJDb3JlL2FjY2Vzc2liaWxpdHkvaXNvbGF0ZWR0cmVlL0FYSXNvbGF0ZWRUcmVlLmggYi9T b3VyY2UvV2ViQ29yZS9hY2Nlc3NpYmlsaXR5L2lzb2xhdGVkdHJlZS9BWElzb2xhdGVkVHJlZS5o CmluZGV4IDI1Y2RjYzg5ZWZmYS4uM2EyY2VjOTNmYjM5IDEwMDY0NAotLS0gYS9Tb3VyY2UvV2Vi Q29yZS9hY2Nlc3NpYmlsaXR5L2lzb2xhdGVkdHJlZS9BWElzb2xhdGVkVHJlZS5oCisrKyBiL1Nv dXJjZS9XZWJDb3JlL2FjY2Vzc2liaWxpdHkvaXNvbGF0ZWR0cmVlL0FYSXNvbGF0ZWRUcmVlLmgK QEAgLTk2LDcgKzk2LDYgQEAgZW51bSBjbGFzcyBBWFByb3BlcnR5TmFtZSA6IHVpbnQxNl90IHsK ICAgICBDb2x1bW5IZWFkZXJzLAogICAgIENvbHVtbkluZGV4LAogICAgIENvbHVtbkluZGV4UmFu Z2UsCi0gICAgQ29tcHV0ZWRMYWJlbCwKICAgICBDb21wdXRlZFJvbGVTdHJpbmcsCiAgICAgQ29u dGVudHMsCiAgICAgQ3VycmVudFN0YXRlLAo=