Bug 278321 – REGRESSION(iOS 18): Crash in NetworkProcessProxy::getNetworkProcessConnection

• Component: WebKit2
• Status: RESOLVED DUPLICATE

[Ali Juma]

Created attachment 472227 [details]
Crash log

Chrome for iOS is getting reports of a new crash in NetworkProcessProxy::getNetworkProcessConnection in iOS 18. We don't have steps to reproduce, but I've attached a crash log.

Here's is the crash stack:

Exception Type:  EXC_BREAKPOINT (SIGTRAP)
Exception Codes: 0x0000000000000001, 0x00000001a64879f4

Thread 0 Crashed:
0   WebKit                        	0x00000001a64879f4 WebKit::NetworkProcessProxy::getNetworkProcessConnection(WebKit::WebProcessProxy&, WTF::CompletionHandler<void (WebKit::NetworkProcessConnectionInfo&&)>&&) + 564 (NetworkProcessProxy.cpp:318)
1   WebKit                        	0x00000001a6487624 WebKit::WebsiteDataStore::getNetworkProcessConnection(WebKit::WebProcessProxy&, WTF::CompletionHandler<void (WebKit::NetworkProcessConnectionInfo&&)>&&, WebKit::WebsiteDataStore::ShouldRetryOnFailure) + 228 (WebsiteDataStore.cpp:1675)
2   WebKit                        	0x00000001a648744c WebKit::WebProcessProxy::getNetworkProcessConnection(WTF::CompletionHandler<void (WebKit::NetworkProcessConnectionInfo&&)>&&) + 68 (WebProcessProxy.cpp:1069)
3   WebKit                        	0x00000001a64e3ee4 WebKit::WebProcessProxy::didReceiveSyncWebProcessProxyMessage(IPC::Connection&, IPC::Decoder&, WTF::UniqueRef<IPC::Encoder>&) + 248 (WebProcessProxyMessageReceiver.cpp:171)
4   WebKit                        	0x00000001a64e3cec IPC::Connection::dispatchSyncMessage(IPC::Decoder&) + 204 (Connection.cpp:1217)
5   WebKit                        	0x00000001a7189718 IPC::Connection::dispatchMessage(WTF::UniqueRef<IPC::Decoder>) + 680 (Connection.cpp:1392)
6   WebKit                        	0x00000001a6434e34 IPC::Connection::SyncMessageState::ConnectionAndIncomingMessage::dispatch() + 60 (Connection.cpp:148)
7   WebKit                        	0x00000001a718ad88 WTF::Detail::CallableWrapper<IPC::Connection::SyncMessageState::processIncomingMessage(IPC::Connection&, WTF::UniqueRef<IPC::Decoder>&)::$_0, void>::call() + 532 (Function.h:53)
8   JavaScriptCore                	0x00000001a74cc864 WTF::RunLoop::performWork() + 204 (RunLoop.cpp:147)
9   JavaScriptCore                	0x00000001a74cd78c WTF::RunLoop::performWork(void*) + 36 (RunLoopCF.cpp:46)
10  CoreFoundation                	0x0000000190d93088 __CFRUNLOOP_IS_CALLING_OUT_TO_A_SOURCE0_PERFORM_FUNCTION__ + 28 (CFRunLoop.c:1950)
11  CoreFoundation                	0x0000000190d9301c __CFRunLoopDoSource0 + 176 (CFRunLoop.c:1994)
12  CoreFoundation                	0x0000000190d90b08 __CFRunLoopDoSources0 + 244 (CFRunLoop.c:2031)
13  CoreFoundation                	0x0000000190d8fd04 __CFRunLoopRun + 840 (CFRunLoop.c:2949)
14  CoreFoundation                	0x0000000190d8f5b8 CFRunLoopRunSpecific + 572 (CFRunLoop.c:3414)
15  GraphicsServices              	0x00000001dca971c4 GSEventRunModal + 164 (GSEvent.c:2196)
16  UIKitCore                     	0x00000001938eeda0 -[UIApplication _run] + 816 (UIApplication.m:3789)
17  UIKitCore                     	0x000000019399d17c UIApplicationMain + 340 (UIApplication.m:5439)
18  Chrome                        	0x00000001009281f4 0x100924000 + 16884
19  dyld                          	0x00000001b6884d34 start + 2724 (dyldMain.cpp:1334)

[Alexey Proskuryakov]

Line 318 is:

    parameters.preferencesForWebProcess = *webProcessProxy.preferencesForNetworkProcess();

The crashing code has already been removed by Ryosuke in bug 277106. I didn't inspect the change super closely, but it seems likely the crash is actually gone and not just moved to a different place.

*** This bug has been marked as a duplicate of bug 277106 ***

[Ali Juma]

(In reply to Alexey Proskuryakov from comment #1)
> Line 318 is:
> 
>     parameters.preferencesForWebProcess =
> *webProcessProxy.preferencesForNetworkProcess();
> 
> The crashing code has already been removed by Ryosuke in bug 277106. I
> didn't inspect the change super closely, but it seems likely the crash is
> actually gone and not just moved to a different place.
> 
> *** This bug has been marked as a duplicate of bug 277106 ***

This crash is still happening in the latest iOS 18 beta seed (22A5350a) so if the change in bug 277106 is already in that build, then this bug is not fixed by that change and we should un-dupe it.

[Alexey Proskuryakov]

Thank you for the update, it's appreciated. This fix is indeed not expected to be in 22A5350a.