Bug 134284 – REGRESSION (r170325): UI process crashes in lastCommittedLayerTreeTransactionID() when the Web Content process crashes

• Component: WebKit2
• Status: RESOLVED FIXED

After the Web Content process crashes, setting its scroll view’s content offset causes a crash:

* thread #1: tid = 0x1dd4a6, 0x000000011c5bf57c WebKit`WebKit::RemoteLayerTreeDrawingAreaProxy::lastCommittedLayerTreeTransactionID(this=0x0000000000000000) const + 12 at RemoteLayerTreeDrawingAreaProxy.h:53, queue = 'com.apple.main-thread', stop reason = EXC_BAD_ACCESS (code=1, address=0xe8)
  * frame #0: 0x000000011c5bf57c WebKit`WebKit::RemoteLayerTreeDrawingAreaProxy::lastCommittedLayerTreeTransactionID(this=0x0000000000000000) const + 12 at RemoteLayerTreeDrawingAreaProxy.h:53
    frame #1: 0x000000011c5bcde7 WebKit`-[WKContentView didUpdateVisibleRect:unobscuredRect:unobscuredRectInScrollViewCoordinates:scale:minimumScale:inStableState:isChangingObscuredInsetsInteractively:](self=0x00007ff6bac4a050, _cmd=0x000000011cb9f238, visibleRect=<unavailable>, unobscuredRect=<unavailable>, unobscuredRectInScrollViewCoordinates=<unavailable>, zoomScale=1, minimumScale=1, isStableState=true, isChangingObscuredInsetsInteractively=false) + 583 at WKContentView.mm:306
    frame #2: 0x000000011c3799a5 WebKit`-[WKWebView _updateVisibleContentRects](self=0x00007ff6bc872a50, _cmd=0x000000011cb9f0ed) + 1893 at WKWebView.mm:1309
    frame #3: 0x000000011c373526 WebKit`-[WKWebView _didInvokeUIScrollViewDelegateCallback](self=0x00007ff6bc872a50, _cmd=0x000000011cba0e10) + 86 at WKWebView.mm:638
    frame #4: 0x000000011c8df3d5 WebKit`-[WKScrollViewDelegateForwarder forwardInvocation:](self=0x00007ff6bc883aa0, _cmd=0x000000011265d104, anInvocation=0x00007ff6bae83030) + 309 at WKScrollView.mm:89

[Benjamin Poulain]

Created attachment 233779 [details]
Patch

[Simon Fraser (smfr)]

Comment on attachment 233779 [details]
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=233779&action=review

> Source/WebKit2/UIProcess/WebPageProxy.h:385
> +    void updateVisibleContentRects(const WebCore::FloatRect& exposedRect, const WebCore::FloatRect& unobscuredRect, const WebCore::FloatRect& unobscuredRectInScrollViewCoordinates, const WebCore::FloatRect& customFixedPositionRect, double scale, bool inStableState, bool isChangingObscuredInsetsInteractively, double timestamp, double horizontalVelocity, double verticalVelocity, double scaleChangeRate);

So many arguments.

[Benjamin Poulain]

Comment on attachment 233779 [details]
Patch

Clearing flags on attachment: 233779

Committed r170460: <http://trac.webkit.org/changeset/170460>

[Benjamin Poulain]

All reviewed patches have been landed.  Closing bug.

[Darin Adler]

Comment on attachment 233779 [details]
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=233779&action=review

> Source/WebKit2/UIProcess/ios/WebPageProxyIOS.mm:202
> +    return;

Should remove this line.