Bug 278556

Summary: REGRESSION (iOS 18 beta 5): WebContent process terminates due to invalid RemoteLayerTreeDrawingAreaProxy_CommitLayerTree message
Product: WebKit Reporter: nihao <zshnr1993>
Component: Layout and RenderingAssignee: Matt Woodrow <mattwoodrow>
Status: RESOLVED FIXED    
Severity: Major CC: ahmad.saleem792, ap, bfulgham, ipmanak, mattwoodrow, ricardo, simon.fraser, webkit-bug-importer, zalan
Priority: P2 Keywords: InRadar
Version: WebKit Nightly Build   
Hardware: iPhone / iPad   
OS: iOS 18   
Attachments:
Description Flags
webkit error
none
Test Case from Comment 0 none

nihao
Reported 2024-08-23 02:17:32 PDT
Created attachment 472277 [details] webkit error <!DOCTYPE html> <html lang="en"> <head> <meta charset="UTF-8"> <meta name="viewport" content="width=device-width, initial-scale=1.0"> <title>Document</title> <style> .header { background-color: #fff; padding: .1rem .1rem; position: relative; width: 100%; } li { position: relative; line-height: .46rem; } .options { background-color: red; height: 4.8rem; height: 70vh; margin-top: -.01rem; max-height: 200px; overflow-x: hidden; overflow-y: auto; padding-bottom: .2rem; width: 100%; } .aaaa { max-width: 300px; max-height: 200px; } </style> </head> <body> <button id="aa_click">click</button> <div class="bbbbb"> <div class="aaaa"> <div class="header"> <h3>reason</h3><span class="close-pop"><i></i></span> </div> <div class="options"> <ul> <li class=""> <p class="optionItem">aa</p><i></i> </li> <li class=""> <p class="optionItem">bb</p><i></i> </li> <li class=""> <p class="optionItem">cc</p><i></i> </li> <li class=""> <p class="optionItem">dd</p><i></i> </li> <li class="selected"> <p class="optionItem">ee</p><i></i> </li> <li class=""> <p class="optionItem">ff</p><i></i> </li> <li class=""> <p class="optionItem">gg</p><i></i> </li> <li class=""> <p class="optionItem">sdf</p><i></i> </li> <li class=""> <p class="optionItem">aaa</p><i></i> </li> <li class=""> <p class="optionItem">aaa</p><i></i> </li> <li class=""> <p class="optionItem">aaa</p><i></i> </li> <li class=""> <p class="optionItem">aaa</p><i></i> </li> <li class=""> <p class="optionItem">aaa</p><i></i> </li> <li class=""> <p class="optionItem">aaa</p><i></i> </li> <li class=""> <p class="optionItem">aaa</p><i></i> </li> </ul> </div> </div> </div> <script> document.getElementById("aa_click").onclick = function () { let a = document.getElementsByClassName("bbbbb")[0]; let b = a.style.visibility if (b == 'hidden') { a.style.visibility = "visible"; } else { a.style.visibility = "hidden"; } }; </script> </body> </html> In iOS18 beta5-7, open this HTML with wkwebview or safari, click the button to hide the list, and the webview will be terminated.If one of the following three conditions is triggered, the webview will not be terminated: 1. Remove the elements in ul until the list is no longer slidable 2. Remove the position:relative of the header element 3. Remove the position:relative of the li element
Attachments
webkit error (80.64 KB, image/png)
2024-08-23 02:17 PDT, nihao 		no flags
Details
Test Case from Comment 0 (3.30 KB, text/html)
2024-08-26 07:18 PDT, Ahmad Saleem 		no flags
Details
View All Add attachment proposed patch, testcase, etc.
Radar WebKit Bug Importer
Comment 1 2024-08-23 09:48:55 PDT
<rdar://problem/134572916>
Alexey Proskuryakov
Comment 2 2024-08-24 16:51:52 PDT
Thank you for the report! Just to clarify, are you saying that this definitely does not happen in earlier releases and betas, or just that these were the only ones tested?
nihao
Comment 3 2024-08-25 01:21:53 PDT
this definitely does not happen in earlier releases and betas
Ahmad Saleem
Comment 4 2024-08-26 07:18:59 PDT
Created attachment 472293 [details] Test Case from Comment 0
Matt Woodrow
Comment 5 2024-08-26 16:18:50 PDT
Pull request: https://github.com/WebKit/WebKit/pull/32733
EWS
Comment 6 2024-08-28 20:25:42 PDT
Committed 282879@main (fcd3d0ef9ce6): <https://commits.webkit.org/282879@main> Reviewed commits have been landed. Closing PR #32733 and removing active labels.
EWS
Comment 7 2024-08-29 12:17:05 PDT
Committed 280938.291@safari-7619-branch (ddc7b99dd935): <https://commits.webkit.org/280938.291@safari-7619-branch> Reviewed commits have been landed. Closing PR #1673 and removing active labels.
nihao
Comment 8 2024-09-21 20:30:06 PDT
iOS18（22A3354） version still has this error
Nick
Comment 9 2024-10-14 18:55:23 PDT
This bug still occurs on iOS 18.0.1 (22A3370) and it's currently breaking our app. Just playing with the test case provided from the comment 0 and it's still crashing mobile Safari on iOS 18.0.1. Does anyone know any update on this bug or it's just closed for good?
Alexey Proskuryakov
Comment 10 2024-10-14 20:16:24 PDT
iOS 18.0.1 doesn't include the fix yet, it's coming later. I think that you won't see this problem with iOS 18.1 beta.
Note You need to log in before you can comment on or make changes to this bug.