Bug 197883 – Crash under WebKit::WebProcessProxy::didBecomeUnresponsive()

• Component: WebKit2
• Status: RESOLVED FIXED

[Chris Dumez]

Crash under WebKit::WebProcessProxy::didBecomeUnresponsive():
Thread[0] EXC_BAD_ACCESS (SIGSEGV) (KERN_INVALID_ADDRESS at 0xfffffffffffffff8)
[  0] 0xfffffffffffffff8 0 + 18446744073709551608
[  1] 0x00007fff4aa5be89 WebKit`WebKit::WebProcessProxy::didBecomeUnresponsive() + 355 at WebProcessProxy.cpp:728:9
       724 	    for (auto& callback : isResponsiveCallbacks)
       725 	        callback(isWebProcessResponsive);
       726 	
       727 	    // If the service worker process becomes unresponsive, kill it ourselves since there are no native clients to do it.
    -> 728 	    if (isServiceWorkerProcess()) {
       729 	        RELEASE_LOG_ERROR(PerformanceLogging, "%p - WebProcessProxy::didBecomeUnresponsive() Terminating Service Worker process with pid %d because it is unresponsive", this, processIdentifier());
       730 	        terminate();
       731 	    }
       732 	}
    
[  2] 0x00007fff3e3dee6a JavaScriptCore`WTF::RunLoop::TimerBase::timerFired(__CFRunLoopTimer*, void*) + 26 at RunLoopCF.cpp:84:12
       80  	{
       81  	    TimerBase* timer = static_cast<TimerBase*>(context);
       82  	
       83  	    AutodrainedPool pool;
    -> 84  	    timer->fired();
       85  	}
       86  	
       87  	RunLoop::TimerBase::TimerBase(RunLoop& runLoop)
       88  	    : m_runLoop(runLoop)
    
[  3] 0x00007fff39e80134 CoreFoundation`__CFRUNLOOP_IS_CALLING_OUT_TO_A_TIMER_CALLBACK_FUNCTION__ + 19 at CFRunLoop.c:1754:9
       1750	
       1751	static void __CFRUNLOOP_IS_CALLING_OUT_TO_A_TIMER_CALLBACK_FUNCTION__(CFRunLoopTimerCallBack, CFRunLoopTimerRef, void *) __attribute__((noinline));
       1752	static void __CFRUNLOOP_IS_CALLING_OUT_TO_A_TIMER_CALLBACK_FUNCTION__(CFRunLoopTimerCallBack func, CFRunLoopTimerRef timer, void *info) {
       1753	    if (func) {
    -> 1754	        func(timer, info);
       1755	    }
       1756	    __asm __volatile__(""); // thwart tail-call optimization
       1757	}
       1758	
    
[  4] 0x00007fff39e7fcee CoreFoundation`__CFRunLoopDoTimer + 858 at CFRunLoop.c:2339:2
       2335	        }
       2336	#endif
       2337	        CFRunLoopTimerCallBack callout = rlt->_callout;
       2338	        cf_trace(KDEBUG_EVENT_CFRL_IS_CALLING_TIMER | DBG_FUNC_START, callout, rlt, context_info, 0);
    -> 2339		__CFRUNLOOP_IS_CALLING_OUT_TO_A_TIMER_CALLBACK_FUNCTION__(callout, rlt, context_info);
       2340	        cf_trace(KDEBUG_EVENT_CFRL_IS_CALLING_TIMER | DBG_FUNC_END, callout, rlt, context_info, 0);
       2341	        
       2342		CHECK_FOR_FORK();
       2343	        if (doInvalidate) {
    
[  5] 0x00007fff39e7f714 CoreFoundation`__CFRunLoopDoTimers + 316 at CFRunLoop.c:2494:23

[Chris Dumez]

<rdar://problem/50665984>

[Chris Dumez]

Created attachment 369860 [details]
Patch

[EWS Watchlist]

Comment on attachment 369860 [details]
Patch

Attachment 369860 [details] did not pass win-ews (win):
Output: https://webkit-queues.webkit.org/results/12189512

New failing tests:
js/dom/custom-constructors.html

[EWS Watchlist]

Created attachment 369873 [details]
Archive of layout-test-results from ews214 for win-future

The attached test failures were seen while running run-webkit-tests on the win-ews.
Bot: ews214  Port: win-future  Platform: CYGWIN_NT-10.0-17763-3.0.5-338.x86_64-x86_64-64bit

[Chris Dumez]

Comment on attachment 369860 [details]
Patch

Clearing flags on attachment: 369860

Committed r245298: <https://trac.webkit.org/changeset/245298>

[Chris Dumez]

All reviewed patches have been landed.  Closing bug.