Summary: | Crash in DOMWindowExtension::suspendForPageCache | ||||||
---|---|---|---|---|---|---|---|
Product: | WebKit | Reporter: | Ryosuke Niwa <rniwa> | ||||
Component: | DOM | Assignee: | Ryosuke Niwa <rniwa> | ||||
Status: | RESOLVED FIXED | ||||||
Severity: | Normal | CC: | beidson, cdumez, ggaren | ||||
Priority: | P2 | Keywords: | InRadar | ||||
Version: | WebKit Nightly Build | ||||||
Hardware: | Unspecified | ||||||
OS: | Unspecified | ||||||
Attachments: |
|
Description
Ryosuke Niwa
2019-02-20 14:24:21 PST
We're also seeing crashes in DOMWindowExtension::willDestroyGlobalObjectInCachedFrame() e.g. Thread 0 Crashed:: Dispatch queue: com.apple.main-thread 0 com.apple.WebCore 0x00007fff52579040 WebCore::DOMWindowExtension::willDestroyGlobalObjectInCachedFrame() + 16 1 com.apple.WebCore 0x00007fff514da36a WebCore::DOMWindow::willDestroyCachedFrame() + 234 2 com.apple.WebCore 0x00007fff514da185 WebCore::CachedFrame::destroy() + 37 3 com.apple.WebCore 0x00007fff522e84d4 WebCore::PageCache::prune(WebCore::PruningReason) + 100 4 com.apple.WebCore 0x00007fff522e8458 WebCore::PageCache::pruneToSizeNow(unsigned int, WebCore::PruningReason) + 24 5 com.apple.WebKit 0x00007fff52fc5a98 IPC::Connection::dispatchMessage(std::__1::unique_ptr<IPC::Decoder, std::__1::default_delete<IPC::Decoder> >) + 108 6 com.apple.WebKit 0x00007fff52fc924b IPC::Connection::dispatchOneIncomingMessage() + 181 7 com.apple.JavaScriptCore 0x00007fff47874734 WTF::RunLoop::performWork() + 228 8 com.apple.JavaScriptCore 0x00007fff478749c2 WTF::RunLoop::performWork(void*) + 34 9 com.apple.CoreFoundation 0x00007fff443526a3 __CFRUNLOOP_IS_CALLING_OUT_TO_A_SOURCE0_PERFORM_FUNCTION__ + 17 10 com.apple.CoreFoundation 0x00007fff44352649 __CFRunLoopDoSource0 + 108 11 com.apple.CoreFoundation 0x00007fff44335ffb __CFRunLoopDoSources0 + 195 12 com.apple.CoreFoundation 0x00007fff443355c5 __CFRunLoopRun + 1189 13 com.apple.CoreFoundation 0x00007fff44334ece CFRunLoopRunSpecific + 455 14 com.apple.Foundation 0x00007fff4664da9f -[NSRunLoop(NSRunLoop) runMode:beforeDate:] + 280 15 com.apple.Foundation 0x00007fff4664d974 -[NSRunLoop(NSRunLoop) run] + 76 16 libxpc.dylib 0x00007fff709ec1d7 _xpc_objc_main + 552 17 libxpc.dylib 0x00007fff709ebcd9 xpc_main + 433 18 com.apple.WebKit.WebContent 0x1013b26e2 WebKit::XPCServiceMain(int, char const**) + 547 (/BuildRoot/Library/Caches/com.apple.xbs/Sources/WebKit2/WebKit2-7607.1.30/Shared/EntryPointUtilities/mac/XPCService/XPCServiceMain.mm:157) 19 com.apple.WebKit.WebContent 0x1013b2867 main + 9 (/BuildRoot/Library/Caches/com.apple.xbs/Sources/WebKit2/WebKit2-7607.1.30/Shared/EntryPointUtilities/mac/XPCService/XPCServiceMain.mm:165) 20 libdyld.dylib 0x00007fff707b93ed start + 1 I suspect what might be happening here is that DOMWindowExtension is getting removed / unregistered inside the client delegate callbacks in dispatchWillDisconnectDOMWindowExtensionFromGlobalObject and dispatchWillDestroyGlobalObjectForDOMWindowExtension. In DOMWindow::willDestroyCachedFrame, for example, there is a comment about how this may happen: // It is necessary to copy m_properties to a separate vector because the DOMWindowProperties may // unregister themselves from the DOMWindow as a result of the call to willDestroyGlobalObjectInFrame. I think what we didn't account is notifying one DOMWindowExtension removing another DOMWindowExtension. Created attachment 362547 [details]
Fix attempt
Waiting for EWS... Comment on attachment 362547 [details] Fix attempt Clearing flags on attachment: 362547 Committed r241848: <https://trac.webkit.org/changeset/241848> All reviewed patches have been landed. Closing bug. |