| Summary: | [ BigSur arm64 Debug EWS ] ASSERTION FAILED: m_uncommittedState.state == State::Provisional | ||||||
|---|---|---|---|---|---|---|---|
| Product: | WebKit | Reporter: | ayumi_kojima | ||||
| Component: | New Bugs | Assignee: | Chris Dumez <cdumez> | ||||
| Status: | RESOLVED FIXED | ||||||
| Severity: | Normal | CC: | achristensen, beidson, cdumez, darin, ggaren, webkit-bot-watchers-bugzilla, webkit-bug-importer | ||||
| Priority: | P2 | Keywords: | InRadar | ||||
| Version: | WebKit Nightly Build | ||||||
| Hardware: | Mac (Apple Silicon) | ||||||
| OS: | Unspecified | ||||||
| See Also: | https://bugs.webkit.org/show_bug.cgi?id=229880 | ||||||
| Attachments: |
|
||||||
|
Description
ayumi_kojima
2021-09-01 14:12:27 PDT
First crash in the open source directory is at r281832 Marked test expectations: https://trac.webkit.org/changeset/281876/webkit Doesn't seem to reproduce easily for me. I really wish I was able to reproduce this. Based on the crash trace, we can tell the UIProcess is crashing when committing the load in the new process, after a process-swap. It is impossible to tell if the process-swap was due to PSON or COOP but since this is a recent regression, COOP may be more likely. The reason we hit the assertion is that the WebPageProxy doesn't think a provisional load is going on when the load gets committed. This could be because: 1. The UIProcess did not receive the DidStartProvisionalLoad IPC before the DidCommitLoad IPC 2. The UIProcess got a DidFailProvisionalLoad IPC before the DidCommitLoad IPC 3. PageLoadState::reset() was called between the DidStartProvisionalLoad IPC and the DidCommitLoad IPC The expected behavior when doing a COOP process-swap is: 1. Process A sends a DidStartProvisionalLoad IPC to the UIProcess 2. Process A send DecidePolicyForResponse IPC to the UIProcess and we decide to process-swap due to COOP header 3. The UIProcess responds with PolicyAction::Ignore for the DecidePolicyForResponse IPC to Process A. This causes process A to send back a DidFailProvisionalLoad IPC but it gets ignored in WebPageProxy::didFailProvisionalLoadForFrame() (early return). 4. The UIProcess launches a new Process B and creates a ProvisionalPageProxy and starts the load in this new process / page. 5. Process B doesn't send a DidStartProvisionalLoad IPC to the UIProcess because we have a check in WebPageLoadClient::didStartProvisionalLoadForFrame() and we are continuing a load after the response policy. 6. Process B sends a DidCommitLoad IPC to the UIProcess. At step 6, the UIProcess should be in provisional load state since it got a DidStartProvisionalLoad from process A and nothing should have changed the state in between. This works in general and we have API tests covering this. However, something seems to go wrong in the layout tests in some cases. The check to discard the DidFailProvisionalLoad IPC from the previous process after a swap looks like so:
```
void WebPageProxy::didFailProvisionalLoadForFrame(FrameIdentifier frameID, FrameInfoData&& frameInfo, WebCore::ResourceRequest&& request, uint64_t navigationID, const String& provisionalURL, const ResourceError& error, WillContinueLoading willContinueLoading, const UserData& userData)
{
if (m_provisionalPage && m_provisionalPage->navigationID() == navigationID) {
// The load did not fail, it is merely happening in a new provisional process.
return;
}
```
It is a bit fragile. I worry, process A could be sending us a didFailProvisionalLoadForFrame with a navigationID that is 0 or not the navigationID of the provisional frame for some reason.
Created attachment 437090 [details]
Patch
Comment on attachment 437090 [details] Patch View in context: https://bugs.webkit.org/attachment.cgi?id=437090&action=review > Source/WebKit/UIProcess/WebPageProxy.cpp:4788 > + if (m_provisionalPage && frame->isMainFrame()) { > // The load did not fail, it is merely happening in a new provisional process. Can a provisional navigation fail in the new process before m_provisionalPage is cleared? (In reply to Alex Christensen from comment #8) > Comment on attachment 437090 [details] > Patch > > View in context: > https://bugs.webkit.org/attachment.cgi?id=437090&action=review > > > Source/WebKit/UIProcess/WebPageProxy.cpp:4788 > > + if (m_provisionalPage && frame->isMainFrame()) { > > // The load did not fail, it is merely happening in a new provisional process. > > Can a provisional navigation fail in the new process before > m_provisionalPage is cleared? A few things: 1. didFailProvisionalLoadForFrame() only gets called due to IPC from the currently committed process. It is didFailProvisionalLoadForFrameShared() that may get called due to IPC from either the committed or the provisional process. 2. didFailProvisionalLoadForFrameShared() has logic to clear m_provisionalPage if the provisional load fails in the provisional process. Tools/Scripts/svn-apply failed to apply attachment 437090 [details] to trunk.
Please resolve the conflicts and upload a new patch.
Committed r281964 (241271@main): <https://commits.webkit.org/241271@main> *** Bug 229880 has been marked as a duplicate of this bug. *** |