91782 2012-07-19 14:11:31 -0700 [WK2] REGRESSION r122966: Crash when closing tab with Web Inspector open in WebKit::PageOverlay 2012-07-23 04:18:43 -0700 1 1 1 Unclassified WebKit Web Inspector (Deprecated) 528+ (Nightly build) Mac (Intel) OS X 10.7 RESOLVED FIXED Regression P1 Critical --- 0 kevin caseq caseq pfeldman rogulenko timothy webkit.review.bot oldest_to_newest 673901 0 kevin 2012-07-19 14:11:31 -0700 Since July 18th, I received a few crashes when closing a tab with the Web Inspector open in it I believe. I'm not yet sure of the exact circumstance to trigger the crash. Here's the first one. Date/Time: 2012-07-18 17:51:52.586 -0400 OS Version: Mac OS X 10.7.4 (11E53) Exception Type: EXC_BAD_ACCESS (SIGSEGV) Exception Codes: KERN_INVALID_ADDRESS at 0x0000000000000070 VM Regions Near 0x70: --> __TEXT 00000001082a8000-00000001082a9000 [ 4K] r-x/rwx SM=COW /Applications/WebKit.app/Contents/Frameworks/10.7/WebKit2.framework/WebProcess.app/Contents/MacOS/WebProcess Application Specific Information: objc[26923]: garbage collection is OFF Thread 0 Crashed:: Dispatch queue: com.apple.main-thread 0 com.apple.WebKit2 0x00000001084406ac WebKit::PageOverlay::bounds() const + 18 1 com.apple.WebKit2 0x0000000108440807 WebKit::PageOverlay::setNeedsDisplay() + 17 2 com.apple.WebKit2 0x00000001084941c8 WebKit::WebInspectorClient::highlight() + 92 3 com.apple.WebCore 0x0000000108f8ba3f WebCore::InspectorDOMAgent::clearFrontend() + 127 4 com.apple.WebCore 0x0000000108f78e69 WebCore::InspectorController::disconnectFrontend() + 121 5 com.apple.WebCore 0x0000000108f78dbe WebCore::InspectorController::inspectedPageDestroyed() + 14 6 com.apple.WebCore 0x0000000109346d0e WebCore::Page::~Page() + 350 7 com.apple.WebKit2 0x00000001084a70f8 WTF::OwnPtr<WebCore::Page>::clear() + 36 8 com.apple.WebKit2 0x00000001084a00db WebKit::WebPage::close() + 297 9 com.apple.WebKit2 0x000000010846943f WebKit::WebConnectionToUIProcess::didReceiveMessage(CoreIPC::Connection*, CoreIPC::MessageID, CoreIPC::ArgumentDecoder*) + 179 10 com.apple.WebKit2 0x000000010840cd91 CoreIPC::Connection::dispatchMessage(CoreIPC::Connection::Message<CoreIPC::ArgumentDecoder>&) + 175 11 com.apple.WebKit2 0x000000010840e2ab CoreIPC::Connection::dispatchOneMessage() + 139 12 com.apple.WebCore 0x00000001094d3f48 WebCore::RunLoop::performWork() + 312 13 com.apple.WebCore 0x00000001094d45a5 WebCore::RunLoop::performWork(void*) + 53 14 com.apple.CoreFoundation 0x00007fff8ab6c4f1 __CFRUNLOOP_IS_CALLING_OUT_TO_A_SOURCE0_PERFORM_FUNCTION__ + 17 15 com.apple.CoreFoundation 0x00007fff8ab6bd5d __CFRunLoopDoSources0 + 253 16 com.apple.CoreFoundation 0x00007fff8ab92b49 __CFRunLoopRun + 905 17 com.apple.CoreFoundation 0x00007fff8ab92486 CFRunLoopRunSpecific + 230 18 com.apple.HIToolbox 0x00007fff8a0834d3 RunCurrentEventLoopInMode + 277 19 com.apple.HIToolbox 0x00007fff8a08a781 ReceiveNextEventCommon + 355 20 com.apple.HIToolbox 0x00007fff8a08a60e BlockUntilNextEventMatchingListInMode + 62 21 com.apple.AppKit 0x00007fff92e84e31 _DPSNextEvent + 659 22 com.apple.AppKit 0x00007fff92e84735 -[NSApplication nextEventMatchingMask:untilDate:inMode:dequeue:] + 135 23 com.apple.AppKit 0x00007fff92e81071 -[NSApplication run] + 470 24 com.apple.WebCore 0x00000001094d4b83 WebCore::RunLoop::run() + 67 25 com.apple.WebKit2 0x00000001084e5c00 WebKit::WebProcessMain(WebKit::CommandLine const&) + 2695 26 com.apple.WebKit2 0x000000010849889b WebKitMain + 305 27 com.apple.WebProcess 0x00000001082a8e5e main + 214 28 com.apple.WebProcess 0x00000001082a8d80 start + 52 673906 1 kevin 2012-07-19 14:27:10 -0700 Ok, here's how to reproduce. Open a site. Open the web inspector. I'm using Command-Option-I. Click in the web page portion of the screen so the Inspector portion lightens and becomes inactive. Then click in the Inspector portion again so it darkens and becomes active. Then close the window or tab. Crash. 673919 2 kevin 2012-07-19 14:40:45 -0700 Clarification - The Web Inspector needs to be opened to the Elements tab when clicking back and forth. The other tabs seem to handle the clicking fine. 674735 3 timothy 2012-07-20 10:58:54 -0700 More than likely this was caused by: http://trac.webkit.org/changeset/122966 675217 4 153665 caseq 2012-07-21 03:05:51 -0700 Created attachment 153665 Patch 675225 5 153665 pfeldman 2012-07-21 03:36:46 -0700 Comment on attachment 153665 Patch View in context: https://bugs.webkit.org/attachment.cgi?id=153665&action=review > Source/WebCore/inspector/DOMNodeHighlighter.cpp:536 > + update(); This change will only mask the crash - it will still happen in case there was a highlighted node upon page destruction. > Source/WebKit2/WebProcess/WebPage/PageOverlay.cpp:70 > + if (!frameView) So this seems to be fixing crash, but we should not be getting here from the page destructor. The proper fix would be to mute InspectorOverlay from within InspectorController::inspectedPageDestroyed(). 675227 6 153667 pfeldman 2012-07-21 03:57:18 -0700 Created attachment 153667 Patch 675232 7 pfeldman 2012-07-21 04:10:22 -0700 > The proper fix would be to mute InspectorOverlay from within InspectorController::inspectedPageDestroyed(). I take this back - we would still need to report hideHighlight to the client upon destruction. Submitted a proper fix. 675560 8 153667 yurys 2012-07-23 02:30:45 -0700 Comment on attachment 153667 Patch View in context: https://bugs.webkit.org/attachment.cgi?id=153667&action=review > Source/WebCore/inspector/DOMNodeHighlighter.cpp:567 > + if ((m_highlightData && (m_highlightData->rect || m_highlightData->node)) || !m_pausedInDebuggerMessage.isNull()) Consider extracting this logic into hasHighlightData() as it is used used in InspectorOverlay::drawHighlight as well. 675605 9 153667 webkit.review.bot 2012-07-23 04:18:39 -0700 Comment on attachment 153667 Patch Clearing flags on attachment: 153667 Committed r123328: <http://trac.webkit.org/changeset/123328> 675606 10 webkit.review.bot 2012-07-23 04:18:43 -0700 All reviewed patches have been landed. Closing bug. 153665 2012-07-21 03:05:51 -0700 2012-07-21 03:57:11 -0700 Patch bug-91782-20120721140545.patch text/plain 3577 caseq U3VidmVyc2lvbiBSZXZpc2lvbjogMTIzMjg5CmRpZmYgLS1naXQgYS9Tb3VyY2UvV2ViQ29yZS9D aGFuZ2VMb2cgYi9Tb3VyY2UvV2ViQ29yZS9DaGFuZ2VMb2cKaW5kZXggYzY1NzhjYjQ5OGU0ZDll ZTNlOWY0NTAwMDBiYjU0ODcwYTE1ZjQ5Mi4uNTc5NmRhMzM2Y2IyMjEzYjU4ZjAyNjA4ODgyNjMy MjM4Njc2MjIyMCAxMDA2NDQKLS0tIGEvU291cmNlL1dlYkNvcmUvQ2hhbmdlTG9nCisrKyBiL1Nv dXJjZS9XZWJDb3JlL0NoYW5nZUxvZwpAQCAtMSwzICsxLDE3IEBACisyMDEyLTA3LTIxICBBbmRy ZXkgS29zeWFrb3YgIDxjYXNlcUBjaHJvbWl1bS5vcmc+CisKKyAgICAgICAgW1dLMl0gUkVHUkVT U0lPTiAocjEyMjkxOS1yMTIyOTY5KTogQ3Jhc2ggd2hlbiBjbG9zaW5nIHRhYiB3aXRoIFdlYiBJ bnNwZWN0b3Igb3BlbiBpbiBXZWJLaXQ6OlBhZ2VPdmVybGF5CisgICAgICAgIGh0dHBzOi8vYnVn cy53ZWJraXQub3JnL3Nob3dfYnVnLmNnaT9pZD05MTc4MgorCisgICAgICAgIFJldmlld2VkIGJ5 IE5PQk9EWSAoT09QUyEpLgorCisgICAgICAgIE9ubHkgcmVxdWVzdCBjbGllbnQgdG8gdXBkYXRl IGhpZ2hsaWdodCBpZiBzb21ldGhpbmcgY2hhbmdlZC4KKworICAgICAgICAqIGluc3BlY3Rvci9E T01Ob2RlSGlnaGxpZ2h0ZXIuY3BwOgorICAgICAgICAoV2ViQ29yZTo6SW5zcGVjdG9yT3Zlcmxh eTo6aGlkZUhpZ2hsaWdodCk6CisgICAgICAgIChXZWJDb3JlOjpJbnNwZWN0b3JPdmVybGF5Ojpo aWdobGlnaHROb2RlKToKKyAgICAgICAgKFdlYkNvcmU6Okluc3BlY3Rvck92ZXJsYXk6OmNsZWFy SGlnaGxpZ2h0RGF0YSk6CisKIDIwMTItMDctMjEgIEt3YW5nIFl1bCBTZW8gIDxza3l1bEBjb21w YW55MTAwLm5ldD4KIAogICAgICAgICBBIHN0YXJ0IHRhZyB3aG9zZSB0YWcgbmFtZSBpcyAiaHRt bCIgaW4gdGhlICJpbiBib2R5IiBpbnNlcnRpb24gbW9kZSBpcyBhIHBhcnNlIGVycm9yCmRpZmYg LS1naXQgYS9Tb3VyY2UvV2ViS2l0Mi9DaGFuZ2VMb2cgYi9Tb3VyY2UvV2ViS2l0Mi9DaGFuZ2VM b2cKaW5kZXggZDIzNmNlMmJkNTRhNmYzMGI1ZmRkNjM3YzZjZjBhNDI3MjFhODQ1Yi4uMTYzYjhh NzcyOTE0MWQ5ZWYzNzQ1ZmFlZjI3NGM3YTE2M2U4M2VkYyAxMDA2NDQKLS0tIGEvU291cmNlL1dl YktpdDIvQ2hhbmdlTG9nCisrKyBiL1NvdXJjZS9XZWJLaXQyL0NoYW5nZUxvZwpAQCAtMSwzICsx LDEzIEBACisyMDEyLTA3LTIxICBBbmRyZXkgS29zeWFrb3YgIDxjYXNlcUBjaHJvbWl1bS5vcmc+ CisKKyAgICAgICAgW1dLMl0gUkVHUkVTU0lPTiAocjEyMjkxOS1yMTIyOTY5KTogQ3Jhc2ggd2hl biBjbG9zaW5nIHRhYiB3aXRoIFdlYiBJbnNwZWN0b3Igb3BlbiBpbiBXZWJLaXQ6OlBhZ2VPdmVy bGF5CisgICAgICAgIGh0dHBzOi8vYnVncy53ZWJraXQub3JnL3Nob3dfYnVnLmNnaT9pZD05MTc4 MgorCisgICAgICAgIFJldmlld2VkIGJ5IE5PQk9EWSAoT09QUyEpLgorCisgICAgICAgICogV2Vi UHJvY2Vzcy9XZWJQYWdlL1BhZ2VPdmVybGF5LmNwcDoKKyAgICAgICAgKFdlYktpdDo6UGFnZU92 ZXJsYXk6OmJvdW5kcyk6IGNoZWNrIGZyYW1lVmlldyBpcyBub3QgbnVsbCBiZWZvcmUgYWNjZXNz aW5nIGl0IChoYXBwZW5zIG9uIHBhZ2UgZGVzdHJ1Y3Rpb24pCisKIDIwMTItMDctMjAgIEtlbnQg VGFtdXJhICA8dGtlbnRAY2hyb21pdW0ub3JnPgogCiAgICAgICAgIFJlbmFtZSBFTkFCTEVfREFU QUxJU1QgdG8gRU5BQkxFX0RBVEFMSVNUX0VMRU1FTlQKZGlmZiAtLWdpdCBhL1NvdXJjZS9XZWJD b3JlL2luc3BlY3Rvci9ET01Ob2RlSGlnaGxpZ2h0ZXIuY3BwIGIvU291cmNlL1dlYkNvcmUvaW5z cGVjdG9yL0RPTU5vZGVIaWdobGlnaHRlci5jcHAKaW5kZXggNDZjOTljZjNkMzBlYmFmYmI2Y2E5 ZWRkNzZhMjU1NDFlYWFjY2VhOC4uNjNlZDlmMzU4MjZmOTg3Y2ZhMjRlMmJjZmUxYmJhM2Y0YjI2 MTJmNiAxMDA2NDQKLS0tIGEvU291cmNlL1dlYkNvcmUvaW5zcGVjdG9yL0RPTU5vZGVIaWdobGln aHRlci5jcHAKKysrIGIvU291cmNlL1dlYkNvcmUvaW5zcGVjdG9yL0RPTU5vZGVIaWdobGlnaHRl ci5jcHAKQEAgLTUzMywxNSArNTMzLDE2IEBAIHZvaWQgSW5zcGVjdG9yT3ZlcmxheTo6aGlkZUhp Z2hsaWdodCgpCiAgICAgICAgIC8vIEZJWE1FOiBDbGVhciBlbnRpcmUgaGlnaGxpZ2h0IGRhdGEg aGVyZSwgc3RvcmUgY29uZmlnIHVwb24gc2V0SW5zcGVjdE1vZGVFbmFibGVkCiAgICAgICAgIG1f aGlnaGxpZ2h0RGF0YS0+cmVjdC5jbGVhcigpOwogICAgICAgICBtX2hpZ2hsaWdodERhdGEtPm5v ZGUuY2xlYXIoKTsKKyAgICAgICAgdXBkYXRlKCk7CiAgICAgfQotICAgIHVwZGF0ZSgpOwogfQog CiB2b2lkIEluc3BlY3Rvck92ZXJsYXk6OmhpZ2hsaWdodE5vZGUoTm9kZSogbm9kZSkKIHsKLSAg ICBpZiAobV9oaWdobGlnaHREYXRhKQorICAgIGlmIChtX2hpZ2hsaWdodERhdGEpIHsKICAgICAg ICAgbV9oaWdobGlnaHREYXRhLT5ub2RlID0gbm9kZTsKLSAgICB1cGRhdGUoKTsKKyAgICAgICAg dXBkYXRlKCk7CisgICAgfQogfQogCiB2b2lkIEluc3BlY3Rvck92ZXJsYXk6OnNldEhpZ2hsaWdo dERhdGEoUGFzc093blB0cjxIaWdobGlnaHREYXRhPiBoaWdobGlnaHREYXRhKQpAQCAtNTUyLDgg KzU1MywxMCBAQCB2b2lkIEluc3BlY3Rvck92ZXJsYXk6OnNldEhpZ2hsaWdodERhdGEoUGFzc093 blB0cjxIaWdobGlnaHREYXRhPiBoaWdobGlnaHREYXRhKQogCiB2b2lkIEluc3BlY3Rvck92ZXJs YXk6OmNsZWFySGlnaGxpZ2h0RGF0YSgpCiB7Ci0gICAgbV9oaWdobGlnaHREYXRhLmNsZWFyKCk7 Ci0gICAgdXBkYXRlKCk7CisgICAgaWYgKG1faGlnaGxpZ2h0RGF0YSkgeworICAgICAgICBtX2hp Z2hsaWdodERhdGEuY2xlYXIoKTsKKyAgICAgICAgdXBkYXRlKCk7CisgICAgfQogfQogCiBOb2Rl KiBJbnNwZWN0b3JPdmVybGF5OjpoaWdobGlnaHRlZE5vZGUoKSBjb25zdApkaWZmIC0tZ2l0IGEv U291cmNlL1dlYktpdDIvV2ViUHJvY2Vzcy9XZWJQYWdlL1BhZ2VPdmVybGF5LmNwcCBiL1NvdXJj ZS9XZWJLaXQyL1dlYlByb2Nlc3MvV2ViUGFnZS9QYWdlT3ZlcmxheS5jcHAKaW5kZXggMmI0MjQ3 N2IwYWNhNjViMTE0NzA3YzllNzlkZDYzOTEwYTM2NjAyNS4uYjM5NjkyMTU1M2FmZWM1YWZhZDE4 MWM3ZWY1MWM5OGE0Nzg0YWYwNSAxMDA2NDQKLS0tIGEvU291cmNlL1dlYktpdDIvV2ViUHJvY2Vz cy9XZWJQYWdlL1BhZ2VPdmVybGF5LmNwcAorKysgYi9Tb3VyY2UvV2ViS2l0Mi9XZWJQcm9jZXNz L1dlYlBhZ2UvUGFnZU92ZXJsYXkuY3BwCkBAIC02Niw2ICs2NiwxMCBAQCBJbnRSZWN0IFBhZ2VP dmVybGF5Ojpib3VuZHMoKSBjb25zdAogewogICAgIEZyYW1lVmlldyogZnJhbWVWaWV3ID0gbV93 ZWJQYWdlLT5jb3JlUGFnZSgpLT5tYWluRnJhbWUoKS0+dmlldygpOwogCisgICAgLy8gVmlldyBp cyAwIGR1cmluZyBwYWdlIGRlc3RydWN0aW9uLgorICAgIGlmICghZnJhbWVWaWV3KQorICAgICAg ICByZXR1cm4gSW50UmVjdCgpOworCiAgICAgaW50IHdpZHRoID0gZnJhbWVWaWV3LT53aWR0aCgp OwogICAgIGludCBoZWlnaHQgPSBmcmFtZVZpZXctPmhlaWdodCgpOwogCg== 153667 2012-07-21 03:57:18 -0700 2012-07-23 04:18:39 -0700 Patch bug-91782-20120721145712.patch text/plain 1608 pfeldman U3VidmVyc2lvbiBSZXZpc2lvbjogMTIzMjg5CmRpZmYgLS1naXQgYS9Tb3VyY2UvV2ViQ29yZS9D aGFuZ2VMb2cgYi9Tb3VyY2UvV2ViQ29yZS9DaGFuZ2VMb2cKaW5kZXggYzY1NzhjYjQ5OGU0ZDll ZTNlOWY0NTAwMDBiYjU0ODcwYTE1ZjQ5Mi4uNTUxYzkxMzRiZTJjMTQxYjgwNTM1NjdhMjkyN2Jm Nzk5ZDk0N2Y2ZSAxMDA2NDQKLS0tIGEvU291cmNlL1dlYkNvcmUvQ2hhbmdlTG9nCisrKyBiL1Nv dXJjZS9XZWJDb3JlL0NoYW5nZUxvZwpAQCAtMSwzICsxLDE1IEBACisyMDEyLTA3LTIxICBQYXZl bCBGZWxkbWFuICA8cGZlbGRtYW5AY2hyb21pdW0ub3JnPgorCisgICAgICAgIFtXSzJdIFJFR1JF U1NJT04gcjEyMjk2NjogQ3Jhc2ggd2hlbiBjbG9zaW5nIHRhYiB3aXRoIFdlYiBJbnNwZWN0b3Ig b3BlbiBpbiBXZWJLaXQ6OlBhZ2VPdmVybGF5CisgICAgICAgIGh0dHBzOi8vYnVncy53ZWJraXQu b3JnL3Nob3dfYnVnLmNnaT9pZD05MTc4MgorCisgICAgICAgIFJldmlld2VkIGJ5IE5PQk9EWSAo T09QUyEpLgorCisgICAgICAgIGhpZGVIaWdobGlnaHQgd2FzIG5ldmVyIGNhbGxlZCBvbmNlIHVz ZXIgaG92ZXJlZCBvdmVyIGEgbm9kZS4KKworICAgICAgICAqIGluc3BlY3Rvci9ET01Ob2RlSGln aGxpZ2h0ZXIuY3BwOgorICAgICAgICAoV2ViQ29yZTo6SW5zcGVjdG9yT3ZlcmxheTo6dXBkYXRl KToKKwogMjAxMi0wNy0yMSAgS3dhbmcgWXVsIFNlbyAgPHNreXVsQGNvbXBhbnkxMDAubmV0Pgog CiAgICAgICAgIEEgc3RhcnQgdGFnIHdob3NlIHRhZyBuYW1lIGlzICJodG1sIiBpbiB0aGUgImlu IGJvZHkiIGluc2VydGlvbiBtb2RlIGlzIGEgcGFyc2UgZXJyb3IKZGlmZiAtLWdpdCBhL1NvdXJj ZS9XZWJDb3JlL2luc3BlY3Rvci9ET01Ob2RlSGlnaGxpZ2h0ZXIuY3BwIGIvU291cmNlL1dlYkNv cmUvaW5zcGVjdG9yL0RPTU5vZGVIaWdobGlnaHRlci5jcHAKaW5kZXggNDZjOTljZjNkMzBlYmFm YmI2Y2E5ZWRkNzZhMjU1NDFlYWFjY2VhOC4uMTBjNzg1YjJhZTYwMjZjOGRhNmZmNDI4ZjU5NDJh YjhlMWFlYTExYyAxMDA2NDQKLS0tIGEvU291cmNlL1dlYkNvcmUvaW5zcGVjdG9yL0RPTU5vZGVI aWdobGlnaHRlci5jcHAKKysrIGIvU291cmNlL1dlYkNvcmUvaW5zcGVjdG9yL0RPTU5vZGVIaWdo bGlnaHRlci5jcHAKQEAgLTU2Myw3ICs1NjMsOCBAQCBOb2RlKiBJbnNwZWN0b3JPdmVybGF5Ojpo aWdobGlnaHRlZE5vZGUoKSBjb25zdAogCiB2b2lkIEluc3BlY3Rvck92ZXJsYXk6OnVwZGF0ZSgp CiB7Ci0gICAgaWYgKG1faGlnaGxpZ2h0RGF0YSB8fCAhbV9wYXVzZWRJbkRlYnVnZ2VyTWVzc2Fn ZS5pc051bGwoKSkKKyAgICAvLyBGSVhNRSg5MTkyNikgUmVmYWN0b3IgaGlnaGxpZ2h0Tm9kZSB0 byBwYXNzIGhpZ2hsaWdodCBkYXRhIGFsb25nIHdpdGggdGhlIGNhbGwuCisgICAgaWYgKChtX2hp Z2hsaWdodERhdGEgJiYgKG1faGlnaGxpZ2h0RGF0YS0+cmVjdCB8fCBtX2hpZ2hsaWdodERhdGEt Pm5vZGUpKSB8fCAhbV9wYXVzZWRJbkRlYnVnZ2VyTWVzc2FnZS5pc051bGwoKSkKICAgICAgICAg bV9jbGllbnQtPmhpZ2hsaWdodCgpOwogICAgIGVsc2UKICAgICAgICAgbV9jbGllbnQtPmhpZGVI aWdobGlnaHQoKTsK