Bug 283546 – Crash in WebPageProxy::sendWheelEvent if the WebProcess takes too long to start

• Component: WebKit Process Model
• Status: RESOLVED FIXED

[Lauro Moura]

WebPageProxy::sendWheelEvent() accesses the WebProcessProxy Connection object directly in order to send the event message, bypassing `AuxiliaryWebProcess::sendMessage` safeguard that stores the pending messages until the process finishes launching:

This might trigger a `RELEASE_ASSERT` if the WebProcess takes too long to start, and we have wheel events right away, as is the case in the WPT WebDriver wheel tests (`test_null_response_value` test case), which are randomly asserting in my laptop.

imported/w3c/webdriver/tests/classic/perform_actions/wheel.py

Tentative patch incoming.

[Lauro Moura]

Pull request: https://github.com/WebKit/WebKit/pull/37000

[Radar WebKit Bug Importer]

<rdar://problem/140682309>

[Ethan Wong]

We found some crashes starting on macOS 15.2 with an use case that the WKWebView slides in as side panel when a button is clicked. Users with certain mouse that could keep sending wheel events even when the scroller is released (typically logitech MX series) would likely to reproduce this release assertion.

Bisecting shows it should be introduced at: https://commits.webkit.org/282353@main, where check for null connection was removed.

https://github.com/WebKit/WebKit/commit/c5175b3ba737b9c4d0237e82c887d049bd24f9a1#diff-713e4ec79a64c4e41e2a80f757ce1074a599d2a2886c3cbaaba4ada4e531a625L3825

[Ethan Wong]

Created attachment 473899 [details]
A crash report that probably relates to this issue

[Michael Catanzaro]

I think I probably fixed both Lauro's crash and Ethan's crash in 302030@main.

However, I did so by *dropping* the wheel event. If it's important to actually process those wheel events, then we still need Lauro's changes. I had assumed these wheel events were occurring immediately after the web process is closed, not before it starts.

[Michael Catanzaro]

Well, I just hit the crash again with WebKitGTK 2.51.1, which contains that commit. (That I encountered the crash shortly after updating this bug is a coincidence.)

Evidently my changes in bug #295679 are insufficient. I'm going to mark my bug as a duplicate of this one.

[Michael Catanzaro]

*** Bug 295679 has been marked as a duplicate of this bug. ***

[Michael Catanzaro]

*** Bug 299687 has been marked as a duplicate of this bug. ***

[Michael Catanzaro]

*** Bug 282384 has been marked as a duplicate of this bug. ***

[Michael Catanzaro]

Pull request: https://github.com/WebKit/WebKit/pull/54660

[EWS]

Committed 303867@main (1e6c25ac7d90): <https://commits.webkit.org/303867@main>

Reviewed commits have been landed. Closing PR #54660 and removing active labels.