Bug 233043

Summary: Regression(r285639) fast/dom/Geolocation/cached-position-iframe.html is frequently crashing on Mac-wk1
Product: WebKit Reporter: Chris Dumez <cdumez>
Component: WebCore Misc.Assignee: Alexey Shvayka <ashvayka>
Status: RESOLVED FIXED    
Severity: Normal CC: ashvayka, ggaren, ryanhaddad, tsavell, webkit-bug-importer
Priority: P2 Keywords: InRadar
Version: WebKit Nightly Build   
Hardware: Unspecified   
OS: Unspecified   
Bug Depends on:    
Bug Blocks: 232387    

Description Chris Dumez 2021-11-12 07:55:43 PST
fast/dom/Geolocation/cached-position-iframe.html is frequently crashing on Mac-wk1 and leads to a lot of false positive EWS warnings.
Comment 1 Chris Dumez 2021-11-12 07:59:36 PST
Committed r285719 (244178@main): <https://commits.webkit.org/244178@main>
Comment 2 Chris Dumez 2021-11-12 07:59:52 PST
Reopening since I merely skipped the test for now.
Comment 3 Chris Dumez 2021-11-12 08:02:14 PST
I managed to reproduce the issue locally and got this crash trace:

Crashed Thread:        0  Dispatch queue: com.apple.main-thread

Exception Type:        EXC_BAD_ACCESS (SIGSEGV)
Exception Codes:       KERN_INVALID_ADDRESS at 0x0000000000000035
Exception Codes:       0x0000000000000001, 0x0000000000000035
Exception Note:        EXC_CORPSE_NOTIFY

Termination Reason:    Namespace SIGNAL, Code 11 Segmentation fault: 11
Terminating Process:   exc handler [86418]

VM Region Info: 0x35 is not in any region.  Bytes before following region: 4558184395
      REGION TYPE                    START - END         [ VSIZE] PRT/MAX SHRMOD  REGION DETAIL
      UNUSED SPACE AT START
--->  
      __TEXT                      10fb06000-10fc46000    [ 1280K] r-x/r-x SM=COW  ...umpRenderTree

Application Specific Information:
dyld4 config: DYLD_INSERT_LIBRARIES=/Volumes/Data/WebKit/OpenSource/WebKitBuild/Debug/libWebCoreTestShim.dylib DYLD_FRAMEWORK_PATH=/Volumes/Data/WebKit/OpenSource/WebKitBuild/Debug DYLD_LIBRARY_PATH=/Volumes/Data/WebKit/OpenSource/WebKitBuild/Debug
CRASHING TEST: fast/dom/Geolocation/cached-position-iframe.html


Thread 0 Crashed::  Dispatch queue: com.apple.main-thread
0   DumpRenderTree                	       0x10fbcab24 TestRunner::setGeolocationPermissionCommon(bool) + 20 (TestRunner.cpp:2190)
1   DumpRenderTree                	       0x10fbd8d95 TestRunner::setGeolocationPermission(bool) + 37 (TestRunnerMac.mm:479)
2   DumpRenderTree                	       0x10fbc6bc1 setGeolocationPermissionCallback(OpaqueJSContext const*, OpaqueJSValue*, OpaqueJSValue*, unsigned long, OpaqueJSValue const* const*, OpaqueJSValue const**) + 113 (TestRunner.cpp:977)
3   JavaScriptCore                	       0x11b5d49e4 long long JSC::APICallbackFunction::callImpl<JSC::JSCallbackFunction>(JSC::JSGlobalObject*, JSC::CallFrame*) + 612 (APICallbackFunction.h:61)
4   JavaScriptCore                	       0x11b5c9d4d JSC::callJSCallbackFunction(JSC::JSGlobalObject*, JSC::CallFrame*) + 29 (JSCallbackFunction.cpp:42)
5   JavaScriptCore                	       0x11b47efcc vmEntryToNative + 299 (LowLevelInterpreter64.asm:343)
6   JavaScriptCore                	       0x11c35be2d JSC::Interpreter::executeCall(JSC::JSGlobalObject*, JSC::JSObject*, JSC::CallData const&, JSC::JSValue, JSC::ArgList const&) + 1869 (Interpreter.cpp:966)
7   JavaScriptCore                	       0x11c7238aa JSC::call(JSC::JSGlobalObject*, JSC::JSValue, JSC::CallData const&, JSC::JSValue, JSC::ArgList const&) + 218 (CallData.cpp:57)
8   JavaScriptCore                	       0x11c72398d JSC::call(JSC::JSGlobalObject*, JSC::JSValue, JSC::CallData const&, JSC::JSValue, JSC::ArgList const&, WTF::NakedPtr<JSC::Exception>&) + 205 (CallData.cpp:64)
9   JavaScriptCore                	       0x11c723c4d JSC::profiledCall(JSC::JSGlobalObject*, JSC::ProfilingReason, JSC::JSValue, JSC::CallData const&, JSC::JSValue, JSC::ArgList const&, WTF::NakedPtr<JSC::Exception>&) + 125 (CallData.cpp:85)
10  WebCore                       	       0x16465112c WebCore::JSExecState::profiledCall(JSC::JSGlobalObject*, JSC::ProfilingReason, JSC::JSValue, JSC::CallData const&, JSC::JSValue, JSC::ArgList const&, WTF::NakedPtr<JSC::Exception>&) + 108 (JSExecState.h:73)
11  WebCore                       	       0x164650d9d WebCore::JSCallbackData::invokeCallback(WebCore::JSDOMGlobalObject&, WebCore::JSDOMGlobalObject*, JSC::JSObject*, JSC::JSValue, JSC::MarkedArgumentBufferWithSize<8ul>&, WebCore::JSCallbackData::CallbackType, JSC::PropertyName, WTF::NakedPtr<JSC::Exception>&) + 1469 (JSCallbackData.cpp:91)
12  WebCore                       	       0x162130943 WebCore::JSCallbackDataStrong::invokeCallback(WebCore::JSDOMGlobalObject&, JSC::JSValue, JSC::MarkedArgumentBufferWithSize<8ul>&, WebCore::JSCallbackData::CallbackType, JSC::PropertyName, WTF::NakedPtr<JSC::Exception>&) + 131 (JSCallbackData.h:83)
13  WebCore                       	       0x162f75a89 WebCore::JSPositionErrorCallback::handleEvent(WebCore::GeolocationPositionError&) + 409 (JSPositionErrorCallback.cpp:74)
14  WebCore                       	       0x163da81f8 WebCore::GeoNotifier::runErrorCallback(WebCore::GeolocationPositionError&) + 72 (GeoNotifier.cpp:85)
15  WebCore                       	       0x163da7cad WebCore::GeoNotifier::timerFired() + 93 (GeoNotifier.cpp:109)
16  WebCore                       	       0x163dea6ee decltype(*(std::__1::forward<WebCore::GeoNotifier*&>(fp0)).*fp()) std::__1::__invoke<void (WebCore::GeoNotifier::*&)(), WebCore::GeoNotifier*&, void>(void (WebCore::GeoNotifier::*&)(), WebCore::GeoNotifier*&) + 110 (type_traits:3635)
17  WebCore                       	       0x163dea66d std::__1::__bind_return<void (WebCore::GeoNotifier::*)(), std::__1::tuple<WebCore::GeoNotifier*>, std::__1::tuple<>, __is_valid_bind_return<void (WebCore::GeoNotifier::*)(), std::__1::tuple<WebCore::GeoNotifier*>, std::__1::tuple<> >::value>::type std::__1::__apply_functor<void (WebCore::GeoNotifier::*)(), std::__1::tuple<WebCore::GeoNotifier*>, 0ul, std::__1::tuple<> >(void (WebCore::GeoNotifier::*&)(), std::__1::tuple<WebCore::GeoNotifier*>&, std::__1::__tuple_indices<0ul>, std::__1::tuple<>&&) + 61 (functional:2857)
18  WebCore                       	       0x163dea620 std::__1::__bind_return<void (WebCore::GeoNotifier::*)(), std::__1::tuple<WebCore::GeoNotifier*>, std::__1::tuple<>, __is_valid_bind_return<void (WebCore::GeoNotifier::*)(), std::__1::tuple<WebCore::GeoNotifier*>, std::__1::tuple<> >::value>::type std::__1::__bind<void (WebCore::GeoNotifier::*&)(), WebCore::GeoNotifier*>::operator()<>() + 32 (functional:2890)
19  WebCore                       	       0x163dea5b9 WTF::Detail::CallableWrapper<std::__1::__bind<void (WebCore::GeoNotifier::*&)(), WebCore::GeoNotifier*>, void>::call() + 25 (Function.h:53)
20  WebCore                       	       0x161cd3102 WTF::Function<void ()>::operator()() const + 130 (Function.h:82)
21  WebCore                       	       0x161cfbae9 WebCore::Timer::fired() + 25 (Timer.h:135)
22  WebCore                       	       0x165c3e8af WebCore::ThreadTimers::sharedTimerFiredInternal() + 671 (ThreadTimers.cpp:127)
23  WebCore                       	       0x165c49661 WebCore::ThreadTimers::setSharedTimer(WebCore::SharedTimer*)::$_0::operator()() const + 33 (ThreadTimers.cpp:67)
24  WebCore                       	       0x165c495f9 WTF::Detail::CallableWrapper<WebCore::ThreadTimers::setSharedTimer(WebCore::SharedTimer*)::$_0, void>::call() + 25 (Function.h:53)
25  WebCore                       	       0x161cd3102 WTF::Function<void ()>::operator()() const + 130 (Function.h:82)
26  WebCore                       	       0x165bf6d11 WebCore::MainThreadSharedTimer::fired() + 129 (MainThreadSharedTimer.cpp:83)
27  WebCore                       	       0x165cbc836 WebCore::timerFired(__CFRunLoopTimer*, void*) + 38 (MainThreadSharedTimerCF.cpp:85)
28  CoreFoundation                	    0x7ff80376184f __CFRUNLOOP_IS_CALLING_OUT_TO_A_TIMER_CALLBACK_FUNCTION__ + 20
29  CoreFoundation                	    0x7ff80376133e __CFRunLoopDoTimer + 927
30  CoreFoundation                	    0x7ff803760e9d __CFRunLoopDoTimers + 307
31  CoreFoundation                	    0x7ff80374745f __CFRunLoopRun + 1985
32  CoreFoundation                	    0x7ff8037465dd CFRunLoopRunSpecific + 563
33  DumpRenderTree                	       0x10fb2d0aa runTest(std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> > const&) + 3434 (DumpRenderTree.mm:1965)
34  DumpRenderTree                	       0x10fb2c297 runTestingServerLoop() + 215 (DumpRenderTree.mm:1078)
35  DumpRenderTree                	       0x10fb2bafb dumpRenderTree(int, char const**) + 555 (DumpRenderTree.mm:1191)
36  DumpRenderTree                	       0x10fb2dc28 DumpRenderTreeMain(int, char const**) + 104 (DumpRenderTree.mm:1302)
37  DumpRenderTree                	       0x10fbf53e2 main + 34 (DumpRenderTreeMain.mm:34)
38  dyld                          	       0x11ad2f4fe start + 462
Comment 4 Chris Dumez 2021-11-12 08:12:45 PST
Per the dashboard this is a regression from Alexey's r285639.
Comment 5 Radar WebKit Bug Importer 2021-11-12 08:13:55 PST
<rdar://problem/85343956>
Comment 6 Chris Dumez 2021-11-12 14:32:26 PST
Committed r285743 (244202@main): <https://commits.webkit.org/244202@main>