Bug 189926 – Regression(r236368) TestWebKitAPI.WebKit.NetworkProcessCrashWithPendingConnection intermittent crashing

• Component: New Bugs
• Status: RESOLVED FIXED

[Ryan Haddad]

TestWebKitAPI.WebKit.NetworkProcessCrashWithPendingConnection intermittent crashing on High Sierra and Sierra bots

https://build.webkit.org/builders/Apple%20High%20Sierra%20Release%20WK2%20(Tests)/builds/6908
https://build.webkit.org/builders/Apple%20Sierra%20Debug%20WK2%20%28Tests%29/builds/8087

[Ryan Haddad]

Created attachment 350672 [details]
Crash log

Thread 0 Crashed:: Dispatch queue: com.apple.main-thread
0   com.apple.WebKit              	0x000000010a6d9a14 API::Object::deref() + 4 (APIObject.mm:104)
1   com.apple.JavaScriptCore      	0x0000000109188e3c WTF::RunLoop::performWork() + 236 (RunLoop.cpp:106)
2   com.apple.JavaScriptCore      	0x00000001091890e2 WTF::RunLoop::performWork(void*) + 34 (RunLoopCF.cpp:39)
3   com.apple.CoreFoundation      	0x00007fff51f58d81 __CFRUNLOOP_IS_CALLING_OUT_TO_A_SOURCE0_PERFORM_FUNCTION__ + 17
4   com.apple.CoreFoundation      	0x00007fff5201065c __CFRunLoopDoSource0 + 108
5   com.apple.CoreFoundation      	0x00007fff51f3bd30 __CFRunLoopDoSources0 + 208
6   com.apple.CoreFoundation      	0x00007fff51f3b1ad __CFRunLoopRun + 1293
7   com.apple.CoreFoundation      	0x00007fff51f3aa07 CFRunLoopRunSpecific + 487
8   com.apple.Foundation          	0x00007fff54044f26 -[NSRunLoop(NSRunLoop) runMode:beforeDate:] + 277
9   TestWebKitAPI                 	0x0000000108ad539c TestWebKitAPI::Util::run(bool*) + 119 (UtilitiesCocoa.mm:34)
10  TestWebKitAPI                 	0x00000001089c91e1 TestWebKitAPI::WebKit_NetworkProcessCrashWithPendingConnection_Test::TestBody() + 1749 (NetworkProcessCrashWithPendingConnection.mm:113)
11  TestWebKitAPI                 	0x0000000108b71af7 void testing::internal::HandleExceptionsInMethodIfSupported<testing::Test, void>(testing::Test*, void (testing::Test::*)(), char const*) + 72
12  TestWebKitAPI                 	0x0000000108b71a60 testing::Test::Run() + 184
13  TestWebKitAPI                 	0x0000000108b729a2 testing::TestInfo::Run() + 220
14  TestWebKitAPI                 	0x0000000108b73123 testing::TestCase::Run() + 273
15  TestWebKitAPI                 	0x0000000108b7ca3c testing::internal::UnitTestImpl::RunAllTests() + 694
16  TestWebKitAPI                 	0x0000000108b7c674 bool testing::internal::HandleExceptionsInMethodIfSupported<testing::internal::UnitTestImpl, bool>(testing::internal::UnitTestImpl*, bool (testing::internal::UnitTestImpl::*)(), char const*) + 72
17  TestWebKitAPI                 	0x0000000108b7c601 testing::UnitTest::Run() + 107
18  TestWebKitAPI                 	0x0000000108a71b94 TestWebKitAPI::TestsController::run(int, char**) + 120 (TestsController.cpp:86)
19  TestWebKitAPI                 	0x0000000108b4b84c main + 344 (mainMac.mm:52)
20  libdyld.dylib                 	0x00007fff7a2df015 start + 1

[Chris Dumez]

The issue is that didClose() tries to extend the lifetime of the NetworkProcessProxy like so:
void NetworkProcessProxy::didClose(IPC::Connection&)
{
    auto protectedThis = makeRef(*this);
    // ...
    networkProcessCrashed();
}

Since r236368, ref'ing the NetworkProcessProxy merely refs its WebProcessPool. However, when calling networkProcessCrashed(), WebProcessPool::networkProcessCrashed() will be called and null-out WebProcessPool::m_networkProcess, thus destroying it.

[Chris Dumez]

<https://trac.webkit.org/changeset/236425>

[Radar WebKit Bug Importer]

<rdar://problem/44737717>