Bug 232448

Summary:	Multiple tests under imported/w3c/web-platform-tests/html/browsers/browsing-the-web/navigating-across-documents/replace-before-load/ are hitting ASSERT(data) in DocumentLoader::dataReceived
Product:	WebKit	Reporter:	Chris Dumez <cdumez>
Component:	Page Loading	Assignee:	Nobody <webkit-unassigned>
Status:	NEW ---
Severity:	Normal	CC:	beidson, webkit-bug-importer
Priority:	P2	Keywords:	InRadar
Version:	WebKit Nightly Build
Hardware:	Unspecified
OS:	Unspecified
See Also:	https://bugs.webkit.org/show_bug.cgi?id=232449 https://bugs.webkit.org/show_bug.cgi?id=225801

Description Chris Dumez 2021-10-28 12:28:39 PDT

Multiple tests under imported/w3c/web-platform-tests/html/browsers/browsing-the-web/navigating-across-documents/replace-before-load/ are crashing in debug:
  imported/w3c/web-platform-tests/html/browsers/browsing-the-web/navigating-across-documents/replace-before-load/form-requestsubmit-during-load.html [ Crash ]
  imported/w3c/web-platform-tests/html/browsers/browsing-the-web/navigating-across-documents/replace-before-load/form-requestsubmit-during-pageshow.html [ Crash ]
  imported/w3c/web-platform-tests/html/browsers/browsing-the-web/navigating-across-documents/replace-before-load/form-requestsubmit.html [ Crash ]
  imported/w3c/web-platform-tests/html/browsers/browsing-the-web/navigating-across-documents/replace-before-load/form-submit-button-click-during-load.html [ Crash ]
  imported/w3c/web-platform-tests/html/browsers/browsing-the-web/navigating-across-documents/replace-before-load/form-submit-button-click-during-pageshow.html [ Crash ]
  imported/w3c/web-platform-tests/html/browsers/browsing-the-web/navigating-across-documents/replace-before-load/form-submit-button-click.html [ Crash ]
  imported/w3c/web-platform-tests/html/browsers/browsing-the-web/navigating-across-documents/replace-before-load/form-submit-during-load.html [ Crash ]
  imported/w3c/web-platform-tests/html/browsers/browsing-the-web/navigating-across-documents/replace-before-load/form-submit-during-pageshow.html [ Crash ]
  imported/w3c/web-platform-tests/html/browsers/browsing-the-web/navigating-across-documents/replace-before-load/form-submit.html [ Crash ]
  imported/w3c/web-platform-tests/html/browsers/browsing-the-web/navigating-across-documents/replace-before-load/iframe-src-during-load.html [ Crash ]
  imported/w3c/web-platform-tests/html/browsers/browsing-the-web/navigating-across-documents/replace-before-load/iframe-src-during-pageshow.html [ Crash ]
  imported/w3c/web-platform-tests/html/browsers/browsing-the-web/navigating-across-documents/replace-before-load/iframe-src.html [ Crash ]
  imported/w3c/web-platform-tests/html/browsers/browsing-the-web/navigating-across-documents/replace-before-load/location-assign-during-load.html [ Crash ]
  imported/w3c/web-platform-tests/html/browsers/browsing-the-web/navigating-across-documents/replace-before-load/location-assign-during-pageshow.html [ Crash ]
  imported/w3c/web-platform-tests/html/browsers/browsing-the-web/navigating-across-documents/replace-before-load/location-assign.html [ Crash ]
  imported/w3c/web-platform-tests/html/browsers/browsing-the-web/navigating-across-documents/replace-before-load/location-setter-during-load.html [ Crash ]
  imported/w3c/web-platform-tests/html/browsers/browsing-the-web/navigating-across-documents/replace-before-load/location-setter-during-pageshow.html [ Crash ]

Crash trace:
Thread 0 Crashed::  Dispatch queue: com.apple.main-thread
0   JavaScriptCore                	       0x64471f7be WTFCrash + 14 (Assertions.cpp:321)
1   WebCore                       	       0x657602e7b WTFCrashWithInfo(int, char const*, char const*, int) + 27 (Assertions.h:732)
2   WebCore                       	       0x65b14d156 WebCore::DocumentLoader::dataReceived(unsigned char const*, int) + 182 (DocumentLoader.cpp:1331)
3   WebCore                       	       0x65b14d093 WebCore::DocumentLoader::dataReceived(WebCore::CachedResource&, unsigned char const*, int) + 147 (DocumentLoader.cpp:1321)
4   WebCore                       	       0x65b2db789 auto WebCore::CachedRawResource::didAddClient(WebCore::CachedResourceClient&)::$_0::operator()(WebCore::ResourceRequest&&)::'lambda'()::operator()() const::'lambda'(auto&)::operator()<WTF::Span<unsigned char const, 18446744073709551615ul> const>(auto&) const + 121 (CachedRawResource.cpp:172)
5   WebCore                       	       0x65b2db6c1 WTF::Detail::CallableWrapper<WebCore::CachedRawResource::didAddClient(WebCore::CachedResourceClient&)::$_0::operator()(WebCore::ResourceRequest&&)::'lambda'()::operator()() const::'lambda'(auto&), void, WTF::Span<unsigned char const, 18446744073709551615ul> const&>::call(WTF::Span<unsigned char const, 18446744073709551615ul> const&) + 49 (Function.h:53)
6   WebCore                       	       0x65a9d4e87 WTF::Function<void (WTF::Span<unsigned char const, 18446744073709551615ul> const&)>::operator()(WTF::Span<unsigned char const, 18446744073709551615ul> const&) const + 151 (Function.h:82)
7   WebCore                       	       0x65b628cfc WebCore::SharedBuffer::forEachSegment(WTF::Function<void (WTF::Span<unsigned char const, 18446744073709551615ul> const&)> const&) const + 172 (SharedBuffer.cpp:255)
8   WebCore                       	       0x65b2dab13 WebCore::CachedRawResource::didAddClient(WebCore::CachedResourceClient&)::$_0::operator()(WebCore::ResourceRequest&&)::'lambda'()::operator()() const + 147 (CachedRawResource.cpp:170)
9   WebCore                       	       0x65b2daee9 WTF::Detail::CallableWrapper<WebCore::CachedRawResource::didAddClient(WebCore::CachedResourceClient&)::$_0::operator()(WebCore::ResourceRequest&&)::'lambda'(), void>::call() + 25 (Function.h:53)
10  WebCore                       	       0x65761b052 WTF::Function<void ()>::operator()() const + 130
11  WebCore                       	       0x65767bb14 WTF::CompletionHandler<void ()>::operator()() + 244 (CompletionHandler.h:67)
12  WebCore                       	       0x65b188c24 WebCore::DocumentLoader::responseReceived(WebCore::ResourceResponse const&, WTF::CompletionHandler<void ()>&&)::$_5::operator()(WebCore::PolicyAction, WebCore::PolicyCheckIdentifier) + 260 (DocumentLoader.cpp:1009)
13  WebCore                       	       0x65b1889e6 WTF::Detail::CallableWrapper<WebCore::DocumentLoader::responseReceived(WebCore::ResourceResponse const&, WTF::CompletionHandler<void ()>&&)::$_5, void, WebCore::PolicyAction, WebCore::PolicyCheckIdentifier>::call(WebCore::PolicyAction, WebCore::PolicyCheckIdentifier) + 102 (Function.h:53)
14  WebKit                        	       0x62c523abb WTF::Function<void (WebCore::PolicyAction, WebCore::PolicyCheckIdentifier)>::operator()(WebCore::PolicyAction, WebCore::PolicyCheckIdentifier) const + 203 (Function.h:82)
15  WebKit                        	       0x62c5d132b WebKit::WebFrame::didReceivePolicyDecision(unsigned long long, WebKit::PolicyDecision&&) + 827 (WebFrame.cpp:283)
16  WebKit                        	       0x62c7c9473 WebKit::WebPage::didReceivePolicyDecision(WTF::ObjectIdentifier<WebCore::FrameIdentifierType>, unsigned long long, WebKit::PolicyDecision&&, WTF::Vector<WebKit::SandboxExtension::Handle, 0ul, WTF::CrashOnOverflow, 16ul, WTF::FastMalloc> const&) + 467 (WebPage.cpp:3563)
17  WebKit                        	       0x62c8919e8 void IPC::callMemberFunctionImpl<WebKit::WebPage, void (WebKit::WebPage::*)(WTF::ObjectIdentifier<WebCore::FrameIdentifierType>, unsigned long long, WebKit::PolicyDecision&&, WTF::Vector<WebKit::SandboxExtension::Handle, 0ul, WTF::CrashOnOverflow, 16ul, WTF::FastMalloc> const&), std::__1::tuple<WTF::ObjectIdentifier<WebCore::FrameIdentifierType>, unsigned long long, WebKit::PolicyDecision, WTF::Vector<WebKit::SandboxExtension::Handle, 0ul, WTF::CrashOnOverflow, 16ul, WTF::FastMalloc> >, 0ul, 1ul, 2ul, 3ul>(WebKit::WebPage*, void (WebKit::WebPage::*)(WTF::ObjectIdentifier<WebCore::FrameIdentifierType>, unsigned long long, WebKit::PolicyDecision&&, WTF::Vector<WebKit::SandboxExtension::Handle, 0ul, WTF::CrashOnOverflow, 16ul, WTF::FastMalloc> const&), std::__1::tuple<WTF::ObjectIdentifier<WebCore::FrameIdentifierType>, unsigned long long, WebKit::PolicyDecision, WTF::Vector<WebKit::SandboxExtension::Handle, 0ul, WTF::CrashOnOverflow, 16ul, WTF::FastMalloc> >&&, std::__1::integer_sequence<unsigned long, 0ul, 1ul, 2ul, 3ul>) + 232 (HandleMessage.h:125)
18  WebKit                        	       0x62c88f1ed void IPC::callMemberFunction<WebKit::WebPage, void (WebKit::WebPage::*)(WTF::ObjectIdentifier<WebCore::FrameIdentifierType>, unsigned long long, WebKit::PolicyDecision&&, WTF::Vector<WebKit::SandboxExtension::Handle, 0ul, WTF::CrashOnOverflow, 16ul, WTF::FastMalloc> const&), std::__1::tuple<WTF::ObjectIdentifier<WebCore::FrameIdentifierType>, unsigned long long, WebKit::PolicyDecision, WTF::Vector<WebKit::SandboxExtension::Handle, 0ul, WTF::CrashOnOverflow, 16ul, WTF::FastMalloc> >, std::__1::integer_sequence<unsigned long, 0ul, 1ul, 2ul, 3ul> >(std::__1::tuple<WTF::ObjectIdentifier<WebCore::FrameIdentifierType>, unsigned long long, WebKit::PolicyDecision, WTF::Vector<WebKit::SandboxExtension::Handle, 0ul, WTF::CrashOnOverflow, 16ul, WTF::FastMalloc> >&&, WebKit::WebPage*, void (WebKit::WebPage::*)(WTF::ObjectIdentifier<WebCore::FrameIdentifierType>, unsigned long long, WebKit::PolicyDecision&&, WTF::Vector<WebKit::SandboxExtension::Handle, 0ul, WTF::CrashOnOverflow, 16ul, WTF::FastMalloc> const&)) + 109 (HandleMessage.h:131)
19  WebKit                        	       0x62c83bcd0 void IPC::handleMessage<Messages::WebPage::DidReceivePolicyDecision, WebKit::WebPage, void (WebKit::WebPage::*)(WTF::ObjectIdentifier<WebCore::FrameIdentifierType>, unsigned long long, WebKit::PolicyDecision&&, WTF::Vector<WebKit::SandboxExtension::Handle, 0ul, WTF::CrashOnOverflow, 16ul, WTF::FastMalloc> const&)>(IPC::Connection&, IPC::Decoder&, WebKit::WebPage*, void (WebKit::WebPage::*)(WTF::ObjectIdentifier<WebCore::FrameIdentifierType>, unsigned long long, WebKit::PolicyDecision&&, WTF::Vector<WebKit::SandboxExtension::Handle, 0ul, WTF::CrashOnOverflow, 16ul, WTF::FastMalloc> const&)) + 256 (HandleMessage.h:202)
20  WebKit                        	       0x62c83221b WebKit::WebPage::didReceiveWebPageMessage(IPC::Connection&, IPC::Decoder&) + 6187 (WebPageMessageReceiver.cpp:3281)

Comment 1 Radar WebKit Bug Importer 2021-11-04 12:29:21 PDT

<rdar://problem/85029209>