Bug 131409 – REGRESSION(r166890): Crash inside WebKit::WebEditorClient::textFieldDidEndEditing

• Component: WebKit2
• Status: RESOLVED FIXED

[Ryosuke Niwa]

Exception Type:  EXC_BAD_ACCESS (SIGSEGV)
Exception Codes: KERN_INVALID_ADDRESS at 0x0000000000000000

VM Regions Near 0:
--> 
    __TEXT                 00000001054f6000-00000001054f8000 [    8K] r-x/rwx SM=COW  /Volumes/VOLUME/*/WebKit2.framework/Versions/A/XPCServices/com.apple.WebKit.WebContent.Development.xpc/Contents/MacOS/com.apple.WebKit.WebContent.Development

Application Specific Information:
Bundle controller class:
BrowserBundleController
 
Process Model:
Multiple Web Processes
 

Thread 0 Crashed:: Dispatch queue: com.apple.main-thread
0   com.apple.WebKit2             	0x0000000108509579 WebKit::WebEditorClient::textFieldDidEndEditing(WebCore::Element*) + 79
1   com.apple.WebCore             	0x000000010903e1a1 WebCore::FrameLoader::stopLoading(WebCore::UnloadEventPolicy) + 161
2   com.apple.WebCore             	0x00000001090dff7c WebCore::FrameLoader::detachFromParent() + 76
3   com.apple.WebKit2             	0x0000000108519df0 WebKit::WebPage::close() + 598
4   com.apple.WebKit2             	0x0000000108661b43 WebKit::WebPage::didReceiveWebPageMessage(IPC::Connection*, IPC::MessageDecoder&) + 4647
5   com.apple.WebKit2             	0x00000001085bc145 IPC::MessageReceiverMap::dispatchMessage(IPC::Connection*, IPC::MessageDecoder&) + 125
6   com.apple.WebKit2             	0x0000000108694b2c WebKit::WebProcess::didReceiveMessage(IPC::Connection*, IPC::MessageDecoder&) + 28
7   com.apple.WebKit2             	0x000000010857afae IPC::Connection::dispatchMessage(std::__1::unique_ptr<IPC::MessageDecoder, std::__1::default_delete<IPC::MessageDecoder> >) + 94
8   com.apple.WebKit2             	0x000000010857d01a IPC::Connection::dispatchOneMessage() + 106
9   com.apple.JavaScriptCore      	0x0000000108ded8e2 WTF::RunLoop::performWork() + 850
10  com.apple.JavaScriptCore      	0x0000000108dede12 WTF::RunLoop::performWork(void*) + 34
11  com.apple.CoreFoundation      	0x00007fff8bf11731 __CFRUNLOOP_IS_CALLING_OUT_TO_A_SOURCE0_PERFORM_FUNCTION__ + 17
12  com.apple.CoreFoundation      	0x00007fff8bf02ea2 __CFRunLoopDoSources0 + 242
13  com.apple.CoreFoundation      	0x00007fff8bf0262f __CFRunLoopRun + 831
14  com.apple.CoreFoundation      	0x00007fff8bf020b5 CFRunLoopRunSpecific + 309
15  com.apple.HIToolbox           	0x00007fff90f2fa0d RunCurrentEventLoopInMode + 226
16  com.apple.HIToolbox           	0x00007fff90f2f7b7 ReceiveNextEventCommon + 479
17  com.apple.HIToolbox           	0x00007fff90f2f5bc _BlockUntilNextEventMatchingListInModeWithFilter + 65
18  com.apple.AppKit              	0x00007fff91a4c3de _DPSNextEvent + 1434
19  com.apple.AppKit              	0x00007fff91a4ba2b -[NSApplication nextEventMatchingMask:untilDate:inMode:dequeue:] + 122
20  com.apple.AppKit              	0x00007fff91a3fb2c -[NSApplication run] + 553
21  com.apple.AppKit              	0x00007fff91a2a913 NSApplicationMain + 940
22  com.apple.XPCService          	0x00007fff85f1cc0f _xpc_main + 385
23  libxpc.dylib                  	0x00007fff8c846bde xpc_main + 399
24  com.apple.WebKit.WebContent.Development	0x00000001054f76a0 0x1054f6000 + 5792
25  libdyld.dylib                 	0x00007fff8e2135fd start + 1

[Ryosuke Niwa]

Created attachment 228918 [details]
Fixes the bug

[Joseph Pecoraro]

Comment on attachment 228918 [details]
Fixes the bug

View in context: https://bugs.webkit.org/attachment.cgi?id=228918&action=review

> Source/WebKit2/WebProcess/WebPage/WebPage.cpp:889
> +    m_formClient = std::make_ptr<API::InjectedBundle::FormClient>();

What is make_ptr? Did you mean make_unique?

[Ryosuke Niwa]

Landed in r166985, and fixed the typo in r166986.

[Daniel Bates]

Closing bug as Resolved Fixed since the patch landed per comment #3. If the patch didn't resolve this bug then please reopen/file a new bug as appropriate.