Bug 264955

Summary: Crash on infinitemac.org
Product: WebKit Reporter: Matt Sephton <matt.sephton>
Component: WebCore Misc.Assignee: Nobody <webkit-unassigned>
Status: RESOLVED CONFIGURATION CHANGED    
Severity: Normal CC: ahmad.saleem792, ashvayka, justin_michaud, matt.sephton, mihaip, webkit-bug-importer, ysuzuki
Priority: P2 Keywords: InRadar
Version: Safari 17   
Hardware: Mac (Apple Silicon)   
OS: macOS 14   
URL: https://infinitemac.org/1998/Mac%20OS%208.5
Attachments:
Description Flags
screenshot just prior to crash
none
screen recording of crash
none
selection of logs from ~/Library/Logs/DiagnosticReports none

Description Matt Sephton 2023-11-16 08:09:37 PST
A web worker crashes, but only when the web inspector is *not* open. 

https://github.com/mihaip/infinite-mac/issues/249 

- macOS 14.1.1 + Safari 17.1 (19616.2.9.11.7)
- macOS 12.7.1 + Safari 17.1 (17616.2.9.11.9)
Comment 1 Matt Sephton 2023-11-16 08:31:37 PST
happens in latest WebKit Build Archive 270824@main
Comment 2 Ahmad Saleem 2023-11-16 10:14:42 PST
It is happening on Safari Technology Preview 183 as well. From GitHub thread, the crash log indicates 'JavaScript':

GitHub comment: https://github.com/mihaip/infinite-mac/issues/249#issuecomment-1807514156

Crashed Thread:        11  WebCore: Worker

Exception Type:        EXC_BAD_ACCESS (SIGKILL)
Exception Codes:       KERN_PROTECTION_FAILURE at 0x000000792cfffffc
Exception Codes:       0x0000000000000002, 0x000000792cfffffc

Termination Reason:    Namespace PAC_EXCEPTION, Code 2 
...
Thread 11 Crashed:: WebCore: Worker
0   ???                           	       0x121aac188 ???
1   ???                           	       0x121ae38f4 ???
2   ???                           	       0x121a65c3c ???
3   ???                           	       0x1218412e8 ???
4   ???                           	       0x121808248 ???
5   ???                           	       0x121808248 ???
6   ???                           	       0x121808248 ???
7   ???                           	       0x121808248 ???
8   ???                           	       0x121808248 ???
9   ???                           	       0x121808248 ???
10  ???                           	       0x121808248 ???
11  ???                           	       0x121808008 ???
12  ???                           	       0x121808728 ???
13  JavaScriptCore                	       0x103f21388 JSC::Interpreter::executeCall(JSC::JSObject*, JSC::CallData const&, JSC::JSValue, JSC::ArgList const&) + 604
14  JavaScriptCore                	       0x1042a91bc JSC::runJSMicrotask(JSC::JSGlobalObject*, WTF::ObjectIdentifierGeneric<JSC::MicrotaskIdentifierType, WTF::ObjectIdentifierThreadSafeAccessTraits>, JSC::JSValue, JSC::JSValue, JSC::JSValue, JSC::JSValue, JSC::JSValue) + 388
15  WebCore                       	       0x1104d3204 WebCore::JSMicrotaskCallback::call() + 200
16  WebCore                       	       0x1108a2a38 WebCore::MicrotaskQueue::performMicrotaskCheckpoint() + 228
17  WebCore                       	       0x11087e8e0 WebCore::EventLoop::run() + 440
18  WebCore                       	       0x11179d080 WebCore::WorkerDedicatedRunLoop::Task::performTask(WebCore::WorkerOrWorkletGlobalScope*) + 224
19  WebCore                       	       0x11179cb90 WebCore::WorkerDedicatedRunLoop::runInMode(WebCore::WorkerOrWorkletGlobalScope*, WebCore::ModePredicate const&) + 816
20  WebCore                       	       0x11179b250 WebCore::WorkerDedicatedRunLoop::run(WebCore::WorkerOrWorkletGlobalScope*) + 132
21  WebCore                       	       0x11179b660 WebCore::WorkerOrWorkletThread::workerOrWorkletThread() + 548
22  JavaScriptCore                	       0x1032472ec WTF::Thread::entryPoint(WTF::Thread::NewThreadContext*) + 244
23  JavaScriptCore                	       0x103056da4 WTF::wtfThreadEntryPoint(void*) + 16
24  libsystem_pthread.dylib       	       0x196177fa8 _pthread_start + 148
25  libsystem_pthread.dylib       	       0x196172da0 thread_start + 8
Comment 3 Ahmad Saleem 2023-11-16 10:19:14 PST
Get this on WebKit ToT (270823@main):

RuntimeError: Out of bounds memory access (evaluating 'r(t,n)')

Test Case: https://infinitemac.org/1998/Mac%20OS%208.5
Comment 4 Matt Sephton 2023-11-17 08:43:02 PST
Thanks for the follow-up.

I'm intrigued why it doesn't happen when the web inspector is open? Would you enlighten me? Thank you
Comment 5 Alexey Proskuryakov 2023-11-17 09:22:43 PST
rdar://118510931
Comment 6 Alexey Proskuryakov 2023-11-17 09:27:51 PST
What are the exact steps to reproduce? I cannot make it crash using macOS 14.2 beta.

Could you please attach the complete crash log (.ips file from ~/Library/Logs/DiagnosticReports)?

> I'm intrigued why it doesn't happen when the web inspector is open? Would you enlighten me? Thank you

This is extremely common, JavaScript compilation changes a lot to aid debugging when Web Inspector is in use.
Comment 7 Matt Sephton 2023-11-17 12:34:36 PST
Steps to reproduce

1. visit this URL: https://infinitemac.org/1998/Mac%20OS%208.5
2. wait about 10 or so seconds as the page loads

Attachments:
- screenshot just prior to crash
- screen recording of crash
- selection of com.apple.WebKit.WebContent logs
Comment 8 Matt Sephton 2023-11-17 12:35:50 PST
Created attachment 468655 [details]
screenshot just prior to crash
Comment 9 Matt Sephton 2023-11-17 12:36:38 PST
Created attachment 468656 [details]
screen recording of crash
Comment 10 Matt Sephton 2023-11-17 12:37:17 PST
Created attachment 468657 [details]
selection of logs from ~/Library/Logs/DiagnosticReports
Comment 11 Matt Sephton 2023-11-30 13:06:59 PST
(In reply to Ahmad Saleem from comment #3)
> RuntimeError: Out of bounds memory access (evaluating 'r(t,n)')

I got this on iPhone Xs, iOS 16.7.1
Comment 12 Alexey Proskuryakov 2023-11-30 13:57:45 PST
Would it be possible for you to test with iOS 17.2 beta, and/or macOS 14.2 beta? There is not much we can do about iOS 16, but it would really help to get on the same page with regards to whether this reproduces in upcoming release.
Comment 13 Matt Sephton 2023-11-30 15:49:10 PST
Sadly I'm unable to do so at the moment as I won't be upgrade to the latest versions any time soon. Apologies. Hopefully somebody else in the thread who has been able to reproduce this can keep us updated on latest.

There's a new site from Software Applications Incorporated (the Workflow/Shortcuts founders) that uses the same technology stack, and that crashes in the same way too: https://software.inc
Comment 14 Justin Michaud 2024-01-17 14:04:47 PST
This no longer reproduces for me, is it reproducing for anyone else?
Comment 15 Ahmad Saleem 2024-01-17 14:09:25 PST
(In reply to Justin Michaud from comment #14)
> This no longer reproduces for me, is it reproducing for anyone else?

I am also no longer able to reproduce with Safari 17.2.1 and macOS 14.2.1 and it loads fine despite having gazillion tabs and browsers windows on 16 GB RAM M1 MacBook Pro.
Comment 16 Matt Sephton 2024-01-18 02:15:33 PST
(In reply to Justin Michaud from comment #14)
> This no longer reproduces for me, is it reproducing for anyone else?

I finally upgraded to Sonoma and Safari 17.2.1 no longer able to repro.

I can't recall but I think it was also resolved on Safari 17.2.1 on Monterey.