Bug 217111 – Crash while loading a confluence page

• Component: DOM
• Status: RESOLVED INVALID

[Ryosuke Niwa]

We can hit the following crash while loading a confluence page:

./dom/Node.cpp(2293) : void WebCore::Node::unregisterMutationObserver(WebCore::MutationObserverRegistration &)
1   0x6ec0debd9 WTFCrash
2   0x6cdf3b03b WTFCrashWithInfo(int, char const*, char const*, int)
3   0x6d0d4f4bd WebCore::Node::unregisterMutationObserver(WebCore::MutationObserverRegistration&)
4   0x6d0d1cfb6 WebCore::MutationObserver::disconnect()
5   0x6cef7e128 WebCore::jsMutationObserverPrototypeFunctionDisconnectBody(JSC::JSGlobalObject*, JSC::CallFrame*, WebCore::JSMutationObserver*)
6   0x6ceef0c6c long long WebCore::IDLOperation<WebCore::JSMutationObserver>::call<&(WebCore::jsMutationObserverPrototypeFunctionDisconnectBody(JSC::JSGlobalObject*, JSC::CallFrame*, WebCore::JSMutationObserver*)), (WebCore::CastedThisErrorBehavior)0>(JSC::JSGlobalObject&, JSC::CallFrame&, char const*)
7   0x6ceef0944 WebCore::jsMutationObserverPrototypeFunctionDisconnect(JSC::JSGlobalObject*, JSC::CallFrame*)
8   0x30ae70801178
9   0x6ec65539d llint_entry
10  0x6ec632543 vmEntryToJavaScript
11  0x6ed4668fb JSC::JITCode::execute(JSC::VM*, JSC::ProtoCallFrame*)
12  0x6ed465e12 JSC::Interpreter::executeProgram(JSC::SourceCode const&, JSC::JSGlobalObject*, JSC::JSObject*)
13  0x6ed810937 JSC::evaluate(JSC::JSGlobalObject*, JSC::SourceCode const&, JSC::JSValue, WTF::NakedPtr<JSC::Exception>&)
14  0x6ed810a8a JSC::profiledEvaluate(JSC::JSGlobalObject*, JSC::ProfilingReason, JSC::SourceCode const&, JSC::JSValue, WTF::NakedPtr<JSC::Exception>&)
15  0x6d06a8e9c WebCore::JSExecState::profiledEvaluate(JSC::JSGlobalObject*, JSC::ProfilingReason, JSC::SourceCode const&, JSC::JSValue, WTF::NakedPtr<JSC::Exception>&)
16  0x6d06a8a7e WebCore::ScriptController::evaluateInWorld(WebCore::ScriptSourceCode const&, WebCore::DOMWrapperWorld&)
17  0x6d06a88a9 WebCore::ScriptController::evaluateInWorldIgnoringException(WebCore::ScriptSourceCode const&, WebCore::DOMWrapperWorld&)
18  0x6d06a91a5 WebCore::ScriptController::evaluateIgnoringException(WebCore::ScriptSourceCode const&)
19  0x6d0d9d6b6 WebCore::ScriptElement::executeClassicScript(WebCore::ScriptSourceCode const&)
20  0x6d0d9b62b WebCore::ScriptElement::prepareScript(WTF::TextPosition const&, WebCore::ScriptElement::LegacyTypeSupport)
21  0x6d1319216 WebCore::HTMLScriptRunner::runScript(WebCore::ScriptElement&, WTF::TextPosition const&)
22  0x6d1319017 WebCore::HTMLScriptRunner::execute(WTF::Ref<WebCore::ScriptElement, WTF::DumbPtrTraits<WebCore::ScriptElement> >&&, WTF::TextPosition const&)
23  0x6d12fd721 WebCore::HTMLDocumentParser::runScriptsForPausedTreeBuilder()
24  0x6d12fdbac WebCore::HTMLDocumentParser::pumpTokenizerLoop(WebCore::HTMLDocumentParser::SynchronousMode, bool, WebCore::PumpSession&)
25  0x6d12fcf1f WebCore::HTMLDocumentParser::pumpTokenizer(WebCore::HTMLDocumentParser::SynchronousMode)
26  0x6d12fc86d WebCore::HTMLDocumentParser::pumpTokenizerIfPossible(WebCore::HTMLDocumentParser::SynchronousMode)
27  0x6d12fe972 WebCore::HTMLDocumentParser::append(WTF::RefPtr<WTF::StringImpl, WTF::DumbPtrTraits<WTF::StringImpl>, WTF::DefaultRefDerefTraits<WTF::StringImpl> >&&)
28  0x6d0b96616 WebCore::DecodedDataDocumentParser::flush(WebCore::DocumentWriter&)
29  0x6d17090fc WebCore::DocumentWriter::end()
30  0x6d1708144 WebCore::DocumentLoader::finishedLoading()
31  0x6d1707b41 WebCore::DocumentLoader::notifyFinished(WebCore::CachedResource&, WebCore::NetworkLoadMetrics const&)

<rdar://problem/69757679>

[Ryosuke Niwa]

Created attachment 410076 [details]
Fixes the bug

[Ryosuke Niwa]

Comment on attachment 410076 [details]
Fixes the bug

View in context: https://bugs.webkit.org/attachment.cgi?id=410076&action=review

> Source/WebCore/dom/MutationObserverRegistration.h:72
> -    std::unique_ptr<HashSet<GCReachableRef<Node>>> m_transientRegistrationNodes;
> +    bool m_hasStoppedObservingNode { false };

This re-ordering helps with packing.

[Wenson Hsieh]

Comment on attachment 410076 [details]
Fixes the bug

View in context: https://bugs.webkit.org/attachment.cgi?id=410076&action=review

> Source/WebCore/dom/MutationObserver.cpp:124
> +        auto node = registration->takeNodeAndStopObserving();

Nit - usually, methods like `takeFoo()` also remove `Foo` from the object.

(We chatted on slack and decided to go with just `stopObserving()` instead)

[Ryosuke Niwa]

Created attachment 410079 [details]
Patch for landing

[Ryosuke Niwa]

Comment on attachment 410079 [details]
Patch for landing

Let's wait for EWS.

[Ryosuke Niwa]

Created attachment 410082 [details]
Fixes the bug

[Ryosuke Niwa]

Comment on attachment 410082 [details]
Fixes the bug

Waiting for EWS.

[EWS]

Patch 410079 does not build

[Ryosuke Niwa]

Comment on attachment 410082 [details]
Fixes the bug

Clearing flags on attachment: 410082

Committed r267779: <https://trac.webkit.org/changeset/267779>

[Ryosuke Niwa]

All reviewed patches have been landed.  Closing bug.

[Radar WebKit Bug Importer]

<rdar://problem/69775129>

[WebKit Commit Bot]

Re-opened since this is blocked by bug 217923