Bug 193955 – REGRESSION (r240553): Crash in WebCore::ScrollingTree::updateTreeFromStateNode

• Component: New Bugs
• Status: RESOLVED DUPLICATE

[Ryan Haddad]

Created attachment 360440 [details]
Crash log

After https://trac.webkit.org/changeset/240553/webkit, layout test compositing/iframes/remove-reinsert-webview-with-iframe.html is consistently crashing on iOS simulator bots.

https://webkit-test-results.webkit.org/dashboards/flakiness_dashboard.html#showAllRuns=true&tests=compositing%2Fiframes%2Fremove-reinsert-webview-with-iframe.html

Thread 0 Crashed:: Dispatch queue: com.apple.main-thread
0   libsystem_kernel.dylib        	0x000000010a546b66 __pthread_kill + 10
1   libsystem_pthread.dylib       	0x000000010a580080 pthread_kill + 333
2   libsystem_c.dylib             	0x000000010a2f3c45 abort + 127
3   libc++abi.dylib               	0x000000010728e5b1 abort_message + 231
4   libc++abi.dylib               	0x000000010729b7a2 __cxa_pure_virtual + 18
5   com.apple.WebCore             	0x000000010bc19aa2 WebCore::ScrollingTree::updateTreeFromStateNode(WebCore::ScrollingStateNode const*, WTF::HashMap<unsigned long long, WTF::RefPtr<WebCore::ScrollingTreeNode, WTF::DumbPtrTraits<WebCore::ScrollingTreeNode> >, WTF::IntHash<unsigned long long>, WTF::HashTraits<unsigned long long>, WTF::HashTraits<WTF::RefPtr<WebCore::ScrollingTreeNode, WTF::DumbPtrTraits<WebCore::ScrollingTreeNode> > > >&) + 1026 (ScrollingTree.cpp:184)
6   com.apple.WebCore             	0x000000010bc19bde WebCore::ScrollingTree::updateTreeFromStateNode(WebCore::ScrollingStateNode const*, WTF::HashMap<unsigned long long, WTF::RefPtr<WebCore::ScrollingTreeNode, WTF::DumbPtrTraits<WebCore::ScrollingTreeNode> >, WTF::IntHash<unsigned long long>, WTF::HashTraits<unsigned long long>, WTF::HashTraits<WTF::RefPtr<WebCore::ScrollingTreeNode, WTF::DumbPtrTraits<WebCore::ScrollingTreeNode> > > >&) + 1342 (ScrollingTree.cpp:197)
7   com.apple.WebCore             	0x000000010bc19bde WebCore::ScrollingTree::updateTreeFromStateNode(WebCore::ScrollingStateNode const*, WTF::HashMap<unsigned long long, WTF::RefPtr<WebCore::ScrollingTreeNode, WTF::DumbPtrTraits<WebCore::ScrollingTreeNode> >, WTF::IntHash<unsigned long long>, WTF::HashTraits<unsigned long long>, WTF::HashTraits<WTF::RefPtr<WebCore::ScrollingTreeNode, WTF::DumbPtrTraits<WebCore::ScrollingTreeNode> > > >&) + 1342 (ScrollingTree.cpp:197)
8   com.apple.WebCore             	0x000000010bc194dc WebCore::ScrollingTree::commitTreeState(std::__1::unique_ptr<WebCore::ScrollingStateTree, std::__1::default_delete<WebCore::ScrollingStateTree> >) + 444 (ScrollingTree.cpp:145)
9   com.apple.WebKit              	0x0000000104d90927 WebKit::RemoteScrollingCoordinatorProxy::commitScrollingTreeState(WebKit::RemoteScrollingCoordinatorTransaction const&, WebKit::RemoteScrollingCoordinatorProxy::RequestedScrollInfo&) + 111 (RemoteScrollingCoordinatorProxy.cpp:92)
10  com.apple.WebKit              	0x0000000104c9dedf WebKit::RemoteLayerTreeDrawingAreaProxy::commitLayerTree(WebKit::RemoteLayerTreeTransaction const&, WebKit::RemoteScrollingCoordinatorTransaction const&) + 239 (RemoteLayerTreeDrawingAreaProxy.mm:217)
11  com.apple.WebKit              	0x0000000104b31645 void IPC::handleMessage<Messages::RemoteLayerTreeDrawingAreaProxy::CommitLayerTree, WebKit::RemoteLayerTreeDrawingAreaProxy, void (WebKit::RemoteLayerTreeDrawingAreaProxy::*)(WebKit::RemoteLayerTreeTransaction const&, WebKit::RemoteScrollingCoordinatorTransaction const&)>(IPC::Decoder&, WebKit::RemoteLayerTreeDrawingAreaProxy*, void (WebKit::RemoteLayerTreeDrawingAreaProxy::*)(WebKit::RemoteLayerTreeTransaction const&, WebKit::RemoteScrollingCoordinatorTransaction const&)) + 126 (HandleMessage.h:134)
12  com.apple.WebKit              	0x0000000104b104c3 IPC::MessageReceiverMap::dispatchMessage(IPC::Connection&, IPC::Decoder&) + 127 (MessageReceiverMap.cpp:123)
13  com.apple.WebKit              	0x0000000104ceea70 WebKit::WebProcessProxy::didReceiveMessage(IPC::Connection&, IPC::Decoder&) + 24 (WebProcessProxy.cpp:532)
14  com.apple.WebKit              	0x0000000104c9ef1b bool IPC::Connection::waitForAndDispatchImmediately<Messages::RemoteLayerTreeDrawingAreaProxy::CommitLayerTree>(unsigned long long, WTF::Seconds, WTF::OptionSet<IPC::WaitForOption>) + 83 (Connection.h:490)
15  com.apple.WebKit              	0x0000000104c9ee4b WebKit::RemoteLayerTreeDrawingAreaProxy::waitForDidUpdateActivityState(unsigned long long) + 117 (RemoteLayerTreeDrawingAreaProxy.mm:461)
16  com.apple.WebKit              	0x0000000104cafdd0 WebKit::WebPageProxy::dispatchActivityStateChange() + 590 (WebPageProxy.cpp:1769)
17  com.apple.UIKitCore           	0x0000000113999e05 -[UIView(Internal) _didMoveFromWindow:toWindow:] + 1820
18  com.apple.UIKitCore           	0x000000011398c091 __45-[UIView(Hierarchy) _postMovedFromSuperview:]_block_invoke + 151
19  com.apple.UIKitCore           	0x000000011398bf70 -[UIView(Hierarchy) _postMovedFromSuperview:] + 804
20  com.apple.UIKitCore           	0x000000011399c9a5 -[UIView(Internal) _addSubview:positioned:relativeTo:] + 1951
21  org.webkit.WebKitTestRunnerApp	0x0000000102515abd WTR::JSUIScriptController::addViewToWindow(OpaqueJSContext const*, OpaqueJSValue*, OpaqueJSValue*, unsigned long, OpaqueJSValue const* const*, OpaqueJSValue const**) + 65
22  JavaScriptCore                	0x0000000102a06f2f long long JSC::APICallbackFunction::call<JSC::JSCallbackFunction>(JSC::ExecState*) + 495 (APICallbackFunction.h:63)
23  ???                           	0x0000073a3253c02d 0 + 7946533847085
24  JavaScriptCore                	0x00000001029dc271 llint_entry + 61758
25  JavaScriptCore                	0x00000001029dc271 llint_entry + 61758

[Radar WebKit Bug Importer]

<rdar://problem/47622864>

[Ryan Haddad]

I can't roll out r240553 cleanly, as Source/WebCore/rendering/RenderLayerCompositor.cpp has been modified multiple times since then.

[Ryan Haddad]

Skipped test in https://trac.webkit.org/r240642 so iOS-sim EWS will stop bleeding.

Simon, would you please take a look at this?

[Wenson Hsieh]

I think this is a dupe of <https://bugs.webkit.org/show_bug.cgi?id=193907>.

[Wenson Hsieh]

*** This bug has been marked as a duplicate of bug 193907 ***