Bug 276337

Summary:	Crash under WebExtensionContextProxy::enumerateFramesAndNamespaceObjects
Product:	WebKit	Reporter:	Timothy Hatcher <timothy>
Component:	WebKit Extensions	Assignee:	Timothy Hatcher <timothy>
Status:	RESOLVED FIXED
Severity:	Normal	CC:	timothy, webkit-bug-importer
Priority:	P2	Keywords:	InRadar
Version:	WebKit Nightly Build
Hardware:	Unspecified
OS:	Unspecified

Timothy Hatcher

Reported 2024-07-08 13:48:53 PDT

Thread 0 Crashed:: Dispatch queue: com.apple.main-thread 0 com.apple.WebKit 0x1a8b765c4 WebKit::RemoteAudioSessionProxy::WeakValueType* WTF::WeakPtrImplBase<WTF::DefaultWeakPtrImpl>::get<WebKit::RemoteAudioSessionProxy>() + 0 (/AppleInternal/Library/BuildRoots/fca865f8-1dcd-11ef-b393-e2437461156c/Applications/Xcode.app/Contents/Developer/Platforms/MacOSX.platform/Developer/SDKs/MacOSX15.0.Internal.sdk/usr/local/include/wtf/WeakPtrImpl.h:48) [inlined] 1 com.apple.WebKit 0x1a8b765c4 WTF::WeakHashSet<WebKit::RemoteAudioSessionProxy, WTF::DefaultWeakPtrImpl, (WTF::EnableWeakPtrThreadingAssertions)1>::WeakHashSetConstIterator::get() const + 4 (/AppleInternal/Library/BuildRoots/fca865f8-1dcd-11ef-b393-e2437461156c/Applications/Xcode.app/Contents/Developer/Platforms/MacOSX.platform/Developer/SDKs/MacOSX15.0.Internal.sdk/usr/local/include/wtf/WeakHashSet.h:59) [inlined] 2 com.apple.WebKit 0x1a8b765c4 WTF::WeakHashSet<WebKit::ResourceLoadStatisticsStore, WTF::DefaultWeakPtrImpl, (WTF::EnableWeakPtrThreadingAssertions)1>::WeakHashSetConstIterator::skipEmptyBuckets() + 20 (/AppleInternal/Library/BuildRoots/fca865f8-1dcd-11ef-b393-e2437461156c/Applications/Xcode.app/Contents/Developer/Platforms/MacOSX.platform/Developer/SDKs/MacOSX15.0.Internal.sdk/usr/local/include/wtf/WeakHashSet.h:74) 3 com.apple.WebKit 0x1a90b35f0 WTF::WeakHashSet<WebKit::WebFrame, WTF::DefaultWeakPtrImpl, (WTF::EnableWeakPtrThreadingAssertions)1>::WeakHashSetConstIterator::operator++() + 64 (/AppleInternal/Library/BuildRoots/fca865f8-1dcd-11ef-b393-e2437461156c/Applications/Xcode.app/Contents/Developer/Platforms/MacOSX.platform/Developer/SDKs/MacOSX15.0.Internal.sdk/usr/local/include/wtf/WeakHashSet.h:67) [inlined] 4 com.apple.WebKit 0x1a90b35f0 WebKit::WebExtensionContextProxy::enumerateFramesAndNamespaceObjects(WTF::Function<void (WebKit::WebFrame&, WebKit::WebExtensionAPINamespace&)> const&, WebCore::DOMWrapperWorld&) + 832 (/AppleInternal/Library/BuildRoots/fca865f8-1dcd-11ef-b393-e2437461156c/Library/Caches/com.apple.xbs/Sources/WebKit/Source/WebKit/WebProcess/Extensions/WebExtensionContextProxy.cpp:185) 5 com.apple.WebKit 0x1a933db34 WebKit::WebExtensionContextProxy::internalDispatchRuntimeMessageEvent(WebKit::WebExtensionContentWorldType, WTF::String const&, std::__1::optional<WTF::ObjectIdentifierGeneric<WebKit::WebExtensionFrameIdentifierType, WTF::ObjectIdentifierMainThreadAccessTraits>>, WebKit::WebExtensionMessageSenderParameters const&, WTF::CompletionHandler<void (WTF::String&&)>&&) + 424 (/AppleInternal/Library/BuildRoots/fca865f8-1dcd-11ef-b393-e2437461156c/Library/Caches/com.apple.xbs/Sources/WebKit/Source/WebKit/WebProcess/Extensions/API/Cocoa/WebExtensionAPIRuntimeCocoa.mm:593) 6 com.apple.WebKit 0x1a9400248 auto void IPC::callMemberFunction<WebKit::WebExtensionContextProxy, WebKit::WebExtensionContextProxy, void (WebKit::WebExtensionContentWorldType, WTF::String const&, std::__1::optional<WTF::ObjectIdentifierGeneric<WebKit::WebExtensionFrameIdentifierType, WTF::ObjectIdentifierMainThreadAccessTraits>>, WebKit::WebExtensionMessageSenderParameters const&, WTF::CompletionHandler<void (WTF::String&&)>&&), std::__1::tuple<WebKit::WebExtensionContentWorldType, WTF::String, std::__1::optional<WTF::ObjectIdentifierGeneric<WebKit::WebExtensionFrameIdentifierType, WTF::ObjectIdentifierMainThreadAccessTraits>>, WebKit::WebExtensionMessageSenderParameters>, void (WTF::String&&)>(WebKit::WebExtensionContextProxy*, void (WebKit::WebExtensionContextProxy::*)(WebKit::WebExtensionContentWorldType, WTF::String const&, std::__1::optional<WTF::ObjectIdentifierGeneric<WebKit::WebExtensionFrameIdentifierType, WTF::ObjectIdentifierMainThreadAccessTraits>>, WebKit::WebExtensionMessageSenderParameters const&, WTF::CompletionHandler<void (WTF::String&&)>&&), std::__1::tuple<WebKit::WebExtensionContentWorldType, WTF::String, std::__1::optional<WTF::ObjectIdentifierGeneric<WebKit::WebExtensionFrameIdentifierType, WTF::ObjectIdentifierMainThreadAccessTraits>>, WebKit::WebExtensionMessageSenderParameters>&&, WTF::CompletionHandler<void (WTF::String&&)>&&)::'lambda'(auto&&...)::operator()<WebKit::WebExtensionContentWorldType, WTF::String, std::__1::optional<WTF::ObjectIdentifierGeneric<WebKit::WebExtensionFrameIdentifierType, WTF::ObjectIdentifierMainThreadAccessTraits>>, WebKit::WebExtensionMessageSenderParameters>(auto&&...) const + 20 (/AppleInternal/Library/BuildRoots/fca865f8-1dcd-11ef-b393-e2437461156c/Library/Caches/com.apple.xbs/Sources/WebKit/Source/WebKit/Platform/IPC/HandleMessage.h:146) [inlined] 7 com.apple.WebKit 0x1a9400248 decltype(std::declval<WebKit::WebExtensionContextProxy>()(std::declval<WebKit::WebExtensionContentWorldType>(), std::declval<WTF::String>(), std::declval<std::__1::optional<WTF::ObjectIdentifierGeneric<WebKit::WebExtensionFrameIdentifierType, WTF::ObjectIdentifierMainThreadAccessTraits>>>(), std::declval<WebKit::WebExtensionMessageSenderParameters>())) std::__1::__invoke[abi:sn180100]<void IPC::callMemberFunction<WebKit::WebExtensionContextProxy, WebKit::WebExtensionContextProxy, void (WebKit::WebExtensionContentWorldType, WTF::String const&, std::__1::optional<WTF::ObjectIdentifierGeneric<WebKit::WebExtensionFrameIdentifierType, WTF::ObjectIdentifierMainThreadAccessTraits>>, WebKit::WebExtensionMessageSenderParameters const&, WTF::CompletionHandler<void (WTF::String&&)>&&), std::__1::tuple<WebKit::WebExtensionContentWorldType, WTF::String, std::__1::optional<WTF::ObjectIdentifierGeneric<WebKit::WebExtensionFrameIdentifierType, WTF::ObjectIdentifierMainThreadAccessTraits>>, WebKit::WebExtensionMessageSenderParameters>, void (WTF::String&&)>(WebKit::WebExtensionContextProxy*, void (WebKit::WebExtensionContextProxy::*)(WebKit::WebExtensionContentWorldType, WTF::String const&, std::__1::optional<WTF::ObjectIdentifierGeneric<WebKit::WebExtensionFrameIdentifierType, WTF::ObjectIdentifierMainThreadAccessTraits>>, WebKit::WebExtensionMessageSenderParameters const&, WTF::CompletionHandler<void (WTF::String&&)>&&), std::__1::tuple<WebKit::WebExtensionContentWorldType, WTF::String, std::__1::optional<WTF::ObjectIdentifierGeneric<WebKit::WebExtensionFrameIdentifierType, WTF::ObjectIdentifierMainThreadAccessTraits>>, WebKit::WebExtensionMessageSenderParameters>&&, WTF::CompletionHandler<void (WTF::String&&)>&&)::'lambda'(auto&&...), WebKit::WebExtensionContentWorldType, WTF::String, std::__1::optional<WTF::ObjectIdentifierGeneric<WebKit::WebExtensionFrameIdentifierType, WTF::ObjectIdentifierMainThreadAccessTraits>>, WebKit::WebExtensionMessageSenderParameters>(WebKit::WebExtensionContextProxy&&, WebKit::WebExtensionContentWorldType&&, WTF::String&&, std::__1::optional<WTF::ObjectIdentifierGeneric<WebKit::WebExtensionFrameIdentifierType, WTF::ObjectIdentifierMainThreadAccessTraits>>&&, WebKit::WebExtensionMessageSenderParameters&&) + 20 (/AppleInternal/Library/BuildRoots/fca865f8-1dcd-11ef-b393-e2437461156c/Applications/Xcode.app/Contents/Developer/Platforms/MacOSX.platform/Developer/SDKs/MacOSX15.0.Internal.sdk/usr/include/c++/v1/__type_traits/invoke.h:344) [inlined] 8 com.apple.WebKit 0x1a9400248 decltype(auto) std::__1::__apply_tuple_impl[abi:sn180100]<void IPC::callMemberFunction<WebKit::WebExtensionContextProxy, WebKit::WebExtensionContextProxy, void (WebKit::WebExtensionContentWorldType, WTF::String const&, std::__1::optional<WTF::ObjectIdentifierGeneric<WebKit::WebExtensionFrameIdentifierType, WTF::ObjectIdentifierMainThreadAccessTraits>>, WebKit::WebExtensionMessageSenderParameters const&, WTF::CompletionHandler<void (WTF::String&&)>&&), std::__1::tuple<WebKit::WebExtensionContentWorldType, WTF::String, std::__1::optional<WTF::ObjectIdentifierGeneric<WebKit::WebExtensionFrameIdentifierType, WTF::ObjectIdentifierMainThreadAccessTraits>>, WebKit::WebExtensionMessageSenderParameters>, void (WTF::String&&)>(WebKit::WebExtensionContextProxy*, void (WebKit::WebExtensionContextProxy::*)(WebKit::WebExtensionContentWorldType, WTF::String const&, std::__1::optional<WTF::ObjectIdentifierGeneric<WebKit::WebExtensionFrameIdentifierType, WTF::ObjectIdentifierMainThreadAccessTraits>>, WebKit::WebExtensionMessageSenderParameters const&, WTF::CompletionHandler<void (WTF::String&&)>&&), std::__1::tuple<WebKit::WebExtensionContentWorldType, WTF::String, std::__1::optional<WTF::ObjectIdentifierGeneric<WebKit::WebExtensionFrameIdentifierType, WTF::ObjectIdentifierMainThreadAccessTraits>>, WebKit::WebExtensionMessageSenderParameters>&&, WTF::CompletionHandler<void (WTF::String&&)>&&)::'lambda'(auto&&...), std::__1::tuple<WebKit::WebExtensionContentWorldType, WTF::String, std::__1::optional<WTF::ObjectIdentifierGeneric<WebKit::WebExtensionFrameIdentifierType, WTF::ObjectIdentifierMainThreadAccessTraits>>, WebKit::WebExtensionMessageSenderParameters>, 0ul, 1ul, 2ul, 3ul>(WebKit::WebExtensionContextProxy&&, WebKit::WebExtensionContextProxy&&, std::__1::__tuple_indices<0ul, 1ul, 2ul, 3ul>) + 28 (/AppleInternal/Library/BuildRoots/fca865f8-1dcd-11ef-b393-e2437461156c/Applications/Xcode.app/Contents/Developer/Platforms/MacOSX.platform/Developer/SDKs/MacOSX15.0.Internal.sdk/usr/include/c++/v1/tuple:1424) [inlined] 9 com.apple.WebKit 0x1a9400248 decltype(auto) std::__1::apply[abi:sn180100]<void IPC::callMemberFunction<WebKit::WebExtensionContextProxy, WebKit::WebExtensionContextProxy, void (WebKit::WebExtensionContentWorldType, WTF::String const&, std::__1::optional<WTF::ObjectIdentifierGeneric<WebKit::WebExtensionFrameIdentifierType, WTF::ObjectIdentifierMainThreadAccessTraits>>, WebKit::WebExtensionMessageSenderParameters const&, WTF::CompletionHandler<void (WTF::String&&)>&&), std::__1::tuple<WebKit::WebExtensionContentWorldType, WTF::String, std::__1::optional<WTF::ObjectIdentifierGeneric<WebKit::WebExtensionFrameIdentifierType, WTF::ObjectIdentifierMainThreadAccessTraits>>, WebKit::WebExtensionMessageSenderParameters>, void (WTF::String&&)>(WebKit::WebExtensionContextProxy*, void (WebKit::WebExtensionContextProxy::*)(WebKit::WebExtensionContentWorldType, WTF::String const&, std::__1::optional<WTF::ObjectIdentifierGeneric<WebKit::WebExtensionFrameIdentifierType, WTF::ObjectIdentifierMainThreadAccessTraits>>, WebKit::WebExtensionMessageSenderParameters const&, WTF::CompletionHandler<void (WTF::String&&)>&&), std::__1::tuple<WebKit::WebExtensionContentWorldType, WTF::String, std::__1::optional<WTF::ObjectIdentifierGeneric<WebKit::WebExtensionFrameIdentifierType, WTF::ObjectIdentifierMainThreadAccessTraits>>, WebKit::WebExtensionMessageSenderParameters>&&, WTF::CompletionHandler<void (WTF::String&&)>&&)::'lambda'(auto&&...), std::__1::tuple<WebKit::WebExtensionContentWorldType, WTF::String, std::__1::optional<WTF::ObjectIdentifierGeneric<WebKit::WebExtensionFrameIdentifierType, WTF::ObjectIdentifierMainThreadAccessTraits>>, WebKit::WebExtensionMessageSenderParameters>>(WebKit::WebExtensionContextProxy&&, WebKit::WebExtensionContextProxy&&) + 28 (/AppleInternal/Library/BuildRoots/fca865f8-1dcd-11ef-b393-e2437461156c/Applications/Xcode.app/Contents/Developer/Platforms/MacOSX.platform/Developer/SDKs/MacOSX15.0.Internal.sdk/usr/include/c++/v1/tuple:1428) [inlined] 10 com.apple.WebKit 0x1a9400248 void IPC::callMemberFunction<WebKit::WebExtensionContextProxy, WebKit::WebExtensionContextProxy, void (WebKit::WebExtensionContentWorldType, WTF::String const&, std::__1::optional<WTF::ObjectIdentifierGeneric<WebKit::WebExtensionFrameIdentifierType, WTF::ObjectIdentifierMainThreadAccessTraits>>, WebKit::WebExtensionMessageSenderParameters const&, WTF::CompletionHandler<void (WTF::String&&)>&&), std::__1::tuple<WebKit::WebExtensionContentWorldType, WTF::String, std::__1::optional<WTF::ObjectIdentifierGeneric<WebKit::WebExtensionFrameIdentifierType, WTF::ObjectIdentifierMainThreadAccessTraits>>, WebKit::WebExtensionMessageSenderParameters>, void (WTF::String&&)>(WebKit::WebExtensionContextProxy*, void (WebKit::WebExtensionContextProxy::*)(WebKit::WebExtensionContentWorldType, WTF::String const&, std::__1::optional<WTF::ObjectIdentifierGeneric<WebKit::WebExtensionFrameIdentifierType, WTF::ObjectIdentifierMainThreadAccessTraits>>, WebKit::WebExtensionMessageSenderParameters const&, WTF::CompletionHandler<void (WTF::String&&)>&&), std::__1::tuple<WebKit::WebExtensionContentWorldType, WTF::String, std::__1::optional<WTF::ObjectIdentifierGeneric<WebKit::WebExtensionFrameIdentifierType, WTF::ObjectIdentifierMainThreadAccessTraits>>, WebKit::WebExtensionMessageSenderParameters>&&, WTF::CompletionHandler<void (WTF::String&&)>&&) + 28 (/AppleInternal/Library/BuildRoots/fca865f8-1dcd-11ef-b393-e2437461156c/Library/Caches/com.apple.xbs/Sources/WebKit/Source/WebKit/Platform/IPC/HandleMessage.h:144) [inlined] 11 com.apple.WebKit 0x1a9400248 void IPC::handleMessageAsync<Messages::WebExtensionContextProxy::DispatchRuntimeMessageEvent, WebKit::WebExtensionContextProxy, WebKit::WebExtensionContextProxy, void (WebKit::WebExtensionContentWorldType, WTF::String const&, std::__1::optional<WTF::ObjectIdentifierGeneric<WebKit::WebExtensionFrameIdentifierType, WTF::ObjectIdentifierMainThreadAccessTraits>>, WebKit::WebExtensionMessageSenderParameters const&, WTF::CompletionHandler<void (WTF::String&&)>&&)>(IPC::Connection&, IPC::Decoder&, WebKit::WebExtensionContextProxy*, void (WebKit::WebExtensionContextProxy::*)(WebKit::WebExtensionContentWorldType, WTF::String const&, std::__1::optional<WTF::ObjectIdentifierGeneric<WebKit::WebExtensionFrameIdentifierType, WTF::ObjectIdentifierMainThreadAccessTraits>>, WebKit::WebExtensionMessageSenderParameters const&, WTF::CompletionHandler<void (WTF::String&&)>&&)) + 160 (/AppleInternal/Library/BuildRoots/fca865f8-1dcd-11ef-b393-e2437461156c/Library/Caches/com.apple.xbs/Sources/WebKit/Source/WebKit/Platform/IPC/HandleMessage.h:336) [inlined] 12 com.apple.WebKit 0x1a9400248 WebKit::WebExtensionContextProxy::didReceiveMessage(IPC::Connection&, IPC::Decoder&) + 7164 (/AppleInternal/Library/BuildRoots/fca865f8-1dcd-11ef-b393-e2437461156c/Library/Caches/com.apple.xbs/Binaries/WebKit/install/Symbols/BuiltProducts/DerivedSources/WebKit/WebExtensionContextProxyMessageReceiver.cpp:120) 13 com.apple.WebKit 0x1a9556a88 IPC::MessageReceiverMap::dispatchMessage(IPC::Connection&, IPC::Decoder&) + 272 (/AppleInternal/Library/BuildRoots/fca865f8-1dcd-11ef-b393-e2437461156c/Library/Caches/com.apple.xbs/Sources/WebKit/Source/WebKit/Platform/IPC/MessageReceiverMap.cpp:129) 14 com.apple.WebKit 0x1a909aa40 WebKit::WebProcess::didReceiveMessage(IPC::Connection&, IPC::Decoder&) + 40 (/AppleInternal/Library/BuildRoots/fca865f8-1dcd-11ef-b393-e2437461156c/Library/Caches/com.apple.xbs/Sources/WebKit/Source/WebKit/WebProcess/WebProcess.cpp:966) 15 com.apple.WebKit 0x1a9550f14 IPC::Connection::dispatchMessage(IPC::Decoder&) + 112 (/AppleInternal/Library/BuildRoots/fca865f8-1dcd-11ef-b393-e2437461156c/Library/Caches/com.apple.xbs/Sources/WebKit/Source/WebKit/Platform/IPC/Connection.cpp:1326) [inlined] 16 com.apple.WebKit 0x1a9550f14 IPC::Connection::dispatchMessage(WTF::UniqueRef<IPC::Decoder>) + 332 (/AppleInternal/Library/BuildRoots/fca865f8-1dcd-11ef-b393-e2437461156c/Library/Caches/com.apple.xbs/Sources/WebKit/Source/WebKit/Platform/IPC/Connection.cpp:1374) 17 com.apple.WebKit 0x1a95544ac IPC::Connection::dispatchOneIncomingMessage() + 120 (/AppleInternal/Library/BuildRoots/fca865f8-1dcd-11ef-b393-e2437461156c/Library/Caches/com.apple.xbs/Sources/WebKit/Source/WebKit/Platform/IPC/Connection.cpp:1439) [inlined] 18 com.apple.WebKit 0x1a95544ac IPC::Connection::enqueueIncomingMessage(WTF::UniqueRef<IPC::Decoder>)::$_1::operator()() const + 128 (/AppleInternal/Library/BuildRoots/fca865f8-1dcd-11ef-b393-e2437461156c/Library/Caches/com.apple.xbs/Sources/WebKit/Source/WebKit/Platform/IPC/Connection.cpp:1288) [inlined] rdar://129820399

Attachments
Add attachment proposed patch, testcase, etc.

Timothy Hatcher

Comment 1 2024-07-08 13:51:02 PDT

Pull request: https://github.com/WebKit/WebKit/pull/30578

EWS

Comment 2 2024-07-08 14:06:13 PDT

Committed 280753@main (0f7c9d38a4fe): <https://commits.webkit.org/280753@main> Reviewed commits have been landed. Closing PR #30578 and removing active labels.

Note You need to log in before you can comment on or make changes to this bug.