Bug 194094

Summary: Regression(PSON) Crash under WebProcessProxy::canTerminateChildProcess()
Product: WebKit Reporter: Chris Dumez <cdumez>
Component: WebKit2Assignee: Chris Dumez <cdumez>
Status: RESOLVED FIXED    
Severity: Normal CC: achristensen, beidson, commit-queue, ggaren, jiewen_tan, rniwa, ryanhaddad, tsavell, webkit-bug-importer
Priority: P2 Keywords: InRadar
Version: WebKit Nightly Build   
Hardware: Unspecified   
OS: Unspecified   
Attachments:
Description Flags
Patch none

Chris Dumez
Reported 2019-01-31 09:49:18 PST
Crash under WebProcessProxy::canTerminateChildProcess(): Exception Type: EXC_BAD_ACCESS (SIGSEGV) Exception Subtype: KERN_INVALID_ADDRESS at 0x0000000000000018 VM Region Info: 0x18 is not in any region. Bytes before following region: 4309712872 REGION TYPE START - END [ VSIZE] PRT/MAX SHRMOD REGION DETAIL UNUSED SPACE AT START ---> __TEXT 0000000100e10000-0000000100fe8000 [ 1888K] r-x/r-x SM=COW .../MobileSafari Termination Signal: Segmentation fault: 11 Termination Reason: Namespace SIGNAL, Code 0xb Terminating Process: exc handler [597] Triggered by Thread: 0 Thread 0 name: Dispatch queue: com.apple.main-thread Thread 0 Crashed: 0 WebKit 0x00000001f1328c20 WebKit::WebProcessProxy::canTerminateChildProcess() + 48 (DumbPtrTraits.h:41) 1 WebKit 0x00000001f1327128 WebKit::WebProcessProxy::maybeShutDown() + 36 (WebProcessProxy.cpp:868) 2 WebKit 0x00000001f1327084 WebKit::WebProcessProxy::removeWebPage(WebKit::WebPageProxy&, unsigned long long, WebKit::WebProcessProxy::EndsUsingDataStore) + 124 (WebProcessProxy.cpp:473) 3 WebKit 0x00000001f12f5d00 WebKit::WebPageProxy::continueNavigationInNewProcess(API::Navigation&, std::__1::unique_ptr<WebKit::SuspendedPageProxy, std::__1::default_delete<WebKit::SuspendedPageProxy> >&&, WTF::Ref<WebKit::WebProcessProxy, WTF::DumbPtrTraits<WebKit::WebProcessProxy> >&&, WebKit::ProcessSwapRequestedByClient, WTF::Optional<WebKit::WebsitePoliciesData>&&) + 420 (WebPageProxy.cpp:2760) 4 WebKit 0x00000001f130d4f4 WTF::Function<void (WTF::Ref<WebKit::WebProcessProxy, WTF::DumbPtrTraits<WebKit::WebProcessProxy> >&&, WebKit::SuspendedPageProxy*, WTF::String const&)>::CallableWrapper<WebKit::WebPageProxy::receivedNavigationPolicyDecision(WebKit::WebPolicyAction, API::Navigation*, WebKit::ProcessSwapRequestedByClient, WebKit::WebFrameProxy&, API::WebsitePolicies*, WTF::Ref<WebKit::WebPageProxy::PolicyDecisionSender, WTF::DumbPtrTraits<WebKit::WebPageProxy::PolicyDecisionSender> >&&)::$_5>::call(WTF::Ref<WebKit::WebProcessProxy, WTF::DumbPtrTraits<WebKit::WebProcessProxy> >&&, WebKit::SuspendedPageProxy*, WTF::String const&) + 816 (WebPageProxy.cpp:2709) 5 WebKit 0x00000001f1332e08 WTF::Function<void (WTF::Ref<WebKit::WebProcessProxy, WTF::DumbPtrTraits<WebKit::WebProcessProxy> >&&, WebKit::SuspendedPageProxy*, WTF::String const&)>::CallableWrapper<WebKit::WebProcessPool::processForNavigation(WebKit::WebPageProxy&, API::Navigation const&, WebKit::ProcessSwapRequestedByClient, WTF::CompletionHandler<void (WTF::Ref<WebKit::WebProcessProxy, WTF::DumbPtrTraits<WebKit::WebProcessProxy> >&&, WebKit::SuspendedPageProxy*, WTF::String const&)>&&)::$_14>::call(WTF::Ref<WebKit::WebProcessProxy, WTF::DumbPtrTraits<WebKit::WebProcessProxy> >&&, WebKit::SuspendedPageProxy*, WTF::String const&) + 196 (Function.h:56) 6 WebKit 0x00000001f13330c0 WTF::Function<void (WebKit::SuspendedPageProxy*)>::CallableWrapper<WebKit::WebProcessPool::processForNavigationInternal(WebKit::WebPageProxy&, API::Navigation const&, WebKit::ProcessSwapRequestedByClient, WTF::CompletionHandler<void (WTF::Ref<WebKit::WebProcessProxy, WTF::DumbPtrTraits<WebKit::WebProcessProxy> >&&, WebKit::SuspendedPageProxy*, WTF::String const&)>&&)::$_15>::call(WebKit::SuspendedPageProxy*) + 348 (Function.h:56) 7 WebKit 0x00000001f12bfa54 WebKit::SuspendedPageProxy::~SuspendedPageProxy() + 72 (Function.h:56) 8 WebKit 0x00000001f12bfc4c WebKit::SuspendedPageProxy::~SuspendedPageProxy() + 12 (SuspendedPageProxy.cpp:93) 9 WebKit 0x00000001f132ee78 WTF::Deque<std::__1::unique_ptr<WebKit::SuspendedPageProxy, std::__1::default_delete<WebKit::SuspendedPageProxy> >, 0ul>::destroyAll() + 192 (memory:2321) 10 WebKit 0x00000001f1320d0c WTF::Deque<std::__1::unique_ptr<WebKit::SuspendedPageProxy, std::__1::default_delete<WebKit::SuspendedPageProxy> >, 0ul>::clear() + 20 (Deque.h:389) 11 WebKit 0x00000001f12cb0f0 WTF::Function<void (WTF::Critical, WTF::Synchronous)>::CallableWrapper<WebKit::installMemoryPressureHandler()::$_0>::call(WTF::Critical, WTF::Synchronous) + 60 (WebMemoryPressureHandlerCocoa.mm:49) 12 JavaScriptCore 0x00000001e8dbdca8 WTF::MemoryPressureHandler::releaseMemory(WTF::Critical, WTF::Synchronous) + 92 (Function.h:56) 13 JavaScriptCore 0x00000001e8dbe3bc invocation function for block in WTF::MemoryPressureHandler::install() + 140 (MemoryPressureHandlerCocoa.mm:192) 14 libdispatch.dylib 0x00000001e0e457d4 _dispatch_client_callout + 16 (object.m:511) 15 libdispatch.dylib 0x00000001e0dea018 _dispatch_continuation_pop$VARIANT$mp + 412 (inline_internal.h:2441) 16 libdispatch.dylib 0x00000001e0df9fa4 _dispatch_source_invoke$VARIANT$mp + 1308 (source.c:568) 17 libdispatch.dylib 0x00000001e0df2ee8 _dispatch_main_queue_callback_4CF$VARIANT$mp + 784 (inline_internal.h:2482) 18 CoreFoundation 0x00000001e1391e7c __CFRUNLOOP_IS_SERVICING_THE_MAIN_DISPATCH_QUEUE__ + 12 (CFRunLoop.c:1813) 19 CoreFoundation 0x00000001e138cdb0 __CFRunLoopRun + 1940 (CFRunLoop.c:3113) 20 CoreFoundation 0x00000001e138c2fc CFRunLoopRunSpecific + 436 (CFRunLoop.c:3247) 21 GraphicsServices 0x00000001e358d79c GSEventRunModal + 104 (GSEvent.c:2245) 22 UIKitCore 0x000000020ddf3558 UIApplicationMain + 212 (UIApplication.m:4353) 23 MobileSafari 0x0000000100e155a0 main + 1500 (main.m:121) 24 libdyld.dylib 0x00000001e0e55b80 start + 4
Attachments
Patch (1.86 KB, patch)
2019-01-31 09:56 PST, Chris Dumez 		no flags
DetailsFormatted DiffDiff
View All Add attachment proposed patch, testcase, etc.
Chris Dumez
Comment 1 2019-01-31 09:49:32 PST
<rdar://problem/47580753>
Chris Dumez
Comment 2 2019-01-31 09:56:17 PST
Created attachment 360736 [details] Patch
WebKit Commit Bot
Comment 3 2019-01-31 11:49:50 PST
Comment on attachment 360736 [details] Patch Clearing flags on attachment: 360736 Committed r240803: <https://trac.webkit.org/changeset/240803>
WebKit Commit Bot
Comment 4 2019-01-31 11:49:51 PST
All reviewed patches have been landed. Closing bug.
Chris Dumez
Comment 5 2019-01-31 15:31:14 PST
Reopening as this seems to have caused API test failures on iOS: https://build.webkit.org/builders/Apple%20iOS%2012%20Simulator%20Release%20WK2%20%28Tests%29/builds/2336
Chris Dumez
Comment 6 2019-01-31 15:50:53 PST
(In reply to Chris Dumez from comment #5) > Reopening as this seems to have caused API test failures on iOS: > https://build.webkit.org/builders/ > Apple%20iOS%2012%20Simulator%20Release%20WK2%20%28Tests%29/builds/2336 Actually, given the crashes, I strongly suspect this was caused by Jiewen's r240555: Crashed TestWebKitAPI.ProcessSwap.CrossOriginSystemPreview Received data during response processing, queuing it. 2019-01-31 15:44:39.513 TestWebKitAPI[84804:3453689] *** Terminating app due to uncaught exception 'NSInvalidArgumentException', reason: '[NSXPCConnection sendInvocation]: Block was not compiled using a compiler that inserts type information about arguments. (openAppLink:state:completionHandler:)' *** First throw call stack: ( 0 CoreFoundation 0x000000010b43cfb2 __exceptionPreprocess + 370 1 libobjc.A.dylib 0x000000010b219ac5 objc_exception_throw + 48 2 Foundation 0x000000010ae71954 -[NSXPCConnection _sendInvocation:orArguments:count:methodSignature:selector:withProxy:] + 4021 3 Foundation 0x000000010ae70862 -[NSXPCConnection _sendSelector:withProxy:arg1:arg2:arg3:] + 133 4 Foundation 0x000000010ae82b7e _NSXPCDistantObjectSimpleMessageSend3 + 57 5 CoreServices 0x000000010b93be11 +[LSAppLink(Internal) _openWithAppLink:state:completionHandler:] + 279 6 CoreServices 0x000000010b93aaf5 __66+[LSAppLink(QRCodes) openWithURL:configuration:completionHandler:]_block_invoke + 116 7 libdispatch.dylib 0x000000010bc36ad0 _dispatch_call_block_and_release + 12 8 libdispatch.dylib 0x000000010bc37c5e _dispatch_client_callout + 8 9 libdispatch.dylib 0x000000010bc3e5fc _dispatch_lane_serial_drain + 672 10 libdispatch.dylib 0x000000010bc3f0a0 _dispatch_lane_invoke + 444 11 libdispatch.dylib 0x000000010bc494b7 _dispatch_workloop_worker_thread + 626 12 libsystem_pthread.dylib 0x000000010c03c60b _pthread_wqthread + 409 13 libsystem_pthread.dylib 0x000000010c03c405 start_wqthread + 13 ) libc++abi.dylib: terminating with uncaught exception of type NSException Child process terminated with signal 6: Abort trap Unsure why Truitt accused me, Jiewen's patch is even the only patch in the range: https://build.webkit.org/builders/Apple%20iOS%2012%20Simulator%20Release%20WK2%20%28Tests%29/builds/2336
Note You need to log in before you can comment on or make changes to this bug.