Bug 301007

Summary: ASSERTION FAILED: checkedPtrCountWithoutThreadCheck() in SQLiteStorageArea:: createAndPopulateInitialDatabaseInfo
Product: WebKit Reporter: Sihui Liu <sihui_liu>
Component: New BugsAssignee: Sihui Liu <sihui_liu>
Status: RESOLVED FIXED    
Severity: Normal CC: webkit-bug-importer
Priority: P2 Keywords: InRadar
Version: WebKit Nightly Build   
Hardware: Unspecified   
OS: Unspecified   

Sihui Liu
Reported 2025-10-17 14:09:45 PDT
...
Attachments
Add attachment proposed patch, testcase, etc.
Sihui Liu
Comment 1 2025-10-17 14:10:05 PDT
Thread 6 Crashed:: Dispatch queue: com.apple.WebKit.Storage.persistent 0 WebCore 0x3002cf7c0 WTFCrashWithInfo(int, char const*, char const*, int) + 100 1 WebCore 0x3009c26c4 WTF::CanMakeCheckedPtrBase<std::__1::atomic<unsigned int>, unsigned int>::decrementCheckedPtrCount() const + 132 2 WebCore 0x303fa5954 WTF::CheckedPtr<WebCore::SQLiteDatabase, WTF::RawPtrTraits<WebCore::SQLiteDatabase>>::derefIfNotNull() + 52 3 WebCore 0x303fa5910 WTF::CheckedPtr<WebCore::SQLiteDatabase, WTF::RawPtrTraits<WebCore::SQLiteDatabase>>::~CheckedPtr() + 32 4 WebCore 0x303f52984 WTF::CheckedPtr<WebCore::SQLiteDatabase, WTF::RawPtrTraits<WebCore::SQLiteDatabase>>::~CheckedPtr() + 32 5 WebCore 0x303f553fc WebCore::IDBServer::SQLiteIDBBackingStore::createAndPopulateInitialDatabaseInfo() + 2916 6 WebCore 0x303f58fd4 WebCore::IDBServer::SQLiteIDBBackingStore::getOrEstablishDatabaseInfo(WebCore::IDBDatabaseInfo&) + 1428 7 WebCore 0x303f73aac WebCore::IDBServer::UniqueIDBDatabase::performCurrentOpenOperationAfterSpaceCheck(bool) + 624 8 WebCore 0x303fc05dc WebCore::IDBServer::UniqueIDBDatabase::performCurrentOpenOperation()::$_0::operator()(bool) + 200 9 WebCore 0x303fc03e8 WTF::Detail::CallableWrapper<WebCore::IDBServer::UniqueIDBDatabase::performCurrentOpenOperation()::$_0, void, bool>::call(bool) + 44 10 WebKit 0x115e83380 WTF::Function<void (bool)>::operator()(bool) const + 188 (Function.h:82) 11 WebKit 0x115e6f9a0 WTF::CompletionHandler<void (bool)>::operator()(bool) + 160 (CompletionHandler.h:79) 12 WebKit 0x118ca9dbc auto WebKit::OriginStorageManager::idbStorageManager(WebKit::IDBStorageRegistry&)::$_0::operator()(unsigned long long, WTF::CompletionHandler<void (bool)>&&)::'lambda'(auto)::operator()<WebKit::OriginQuotaManager::Decision>(auto) + 56 (OriginStorageManager.cpp:735) 13 WebKit 0x118ca9ce4 WTF::Detail::CallableWrapper<WebKit::OriginStorageManager::idbStorageManager(WebKit::IDBStorageRegistry&)::$_0::operator()(unsigned long long, WTF::CompletionHandler<void (bool)>&&)::'lambda'(auto), void, WebKit::OriginQuotaManager::Decision>::call(WebKit::OriginQuotaManager::Decision) + 44 (Function.h:53) 14 WebKit 0x118c79f60 WTF::Function<void (WebKit::OriginQuotaManager::Decision)>::operator()(WebKit::OriginQuotaManager::Decision) const + 188 (Function.h:82) 15 WebKit 0x118bf98d0 WTF::CompletionHandler<void (WebKit::OriginQuotaManager::Decision)>::operator()(WebKit::OriginQuotaManager::Decision) + 160 (CompletionHandler.h:79) 16 WebKit 0x118bf9420 WebKit::OriginQuotaManager::handleRequests() + 252 (OriginQuotaManager.cpp:82) 17 WebKit 0x118bf9250 WebKit::OriginQuotaManager::requestSpace(unsigned long long, WTF::CompletionHandler<void (WebKit::OriginQuotaManager::Decision)>&&) + 108 (OriginQuotaManager.cpp:69) 18 WebKit 0x118ca98e8 WebKit::OriginStorageManager::idbStorageManager(WebKit::IDBStorageRegistry&)::$_0::operator()(unsigned long long, WTF::CompletionHandler<void (bool)>&&) + 180 (OriginStorageManager.cpp:734) 19 WebKit 0x118ca9794 WTF::Detail::CallableWrapper<WebKit::OriginStorageManager::idbStorageManager(WebKit::IDBStorageRegistry&)::$_0, void, unsigned long long, WTF::CompletionHandler<void (bool)>&&>::call(unsigned long long, WTF::CompletionHandler<void (bool)>&&) + 48 (Function.h:53) 20 WebKit 0x118a96e64 WTF::Function<void (unsigned long long, WTF::CompletionHandler<void (bool)>&&)>::operator()(unsigned long long, WTF::CompletionHandler<void (bool)>&&) const + 192 (Function.h:82) 21 WebKit 0x118be1284 WebKit::IDBStorageManager::requestSpace(WebCore::ClientOrigin const&, unsigned long long, WTF::CompletionHandler<void (bool)>&&) + 52 (IDBStorageManager.cpp:349) 22 WebCore 0x303f737e0 WebCore::IDBServer::UniqueIDBDatabase::performCurrentOpenOperation() + 684 23 WebCore 0x303f76014 WebCore::IDBServer::UniqueIDBDatabase::handleCurrentOperation() + 224 24 WebCore 0x303f73484 WebCore::IDBServer::UniqueIDBDatabase::handleDatabaseOperations() + 396 25 WebCore 0x303f7319c WebCore::IDBServer::UniqueIDBDatabase::openDatabaseConnection(WebCore::IDBServer::IDBConnectionToClient&, WebCore::IDBOpenRequestData const&) + 292 26 WebKit 0x118be01b8 WebKit::IDBStorageManager::openDatabase(WebCore::IDBServer::IDBConnectionToClient&, WebCore::IDBOpenRequestData const&) + 124 (IDBStorageManager.cpp:255) 27 WebKit 0x118bf3c7c WebKit::NetworkStorageManager::openDatabase(IPC::Connection&, WebCore::IDBOpenRequestData const&) + 540 (NetworkStorageManager.cpp:1726) 28 WebKit 0x11767fcd4 auto void IPC::callMemberFunction<WebKit::NetworkStorageManager, WebKit::NetworkStorageManager, void (IPC::Connection&, WebCore::IDBOpenRequestData const&), std::__1::tuple<WebCore::IDBOpenRequestData>>(WebKit::NetworkStorageManager*, void (WebKit::NetworkStorageManager::*)(IPC::Connection&, WebCore::IDBOpenRequestData const&), IPC::Connection&, std::__1::tuple<WebCore::IDBOpenRequestData>&&)::'lambda'(auto&&...)::operator()<WebCore::IDBOpenRequestData>(auto&&...) const + 200 (HandleMessage.h:171) 29 WebKit 0x11767fbd8 std::__1::__invoke_result_impl<void, auto...>::type std::__1::__invoke[abi:sn210101]<void IPC::callMemberFunction<WebKit::NetworkStorageManager, WebKit::NetworkStorageManager, void (IPC::Connection&, WebCore::IDBOpenRequestData const&), std::__1::tuple<WebCore::IDBOpenRequestData>>(WebKit::NetworkStorageManager*, void (WebKit::NetworkStorageManager::*)(IPC::Connection&, WebCore::IDBOpenRequestData const&), IPC::Connection&, std::__1::tuple<WebCore::IDBOpenRequestData>&&)::'lambda'(auto&&...), WebCore::IDBOpenRequestData>(auto&&...) + 36 (invoke.h:87) 30 WebKit 0x11767fba8 decltype(auto) std::__1::__apply_tuple_impl[abi:sn210101]<void IPC::callMemberFunction<WebKit::NetworkStorageManager, WebKit::NetworkStorageManager, void (IPC::Connection&, WebCore::IDBOpenRequestData const&), std::__1::tuple<WebCore::IDBOpenRequestData>>(WebKit::NetworkStorageManager*, void (WebKit::NetworkStorageManager::*)(IPC::Connection&, WebCore::IDBOpenRequestData const&), IPC::Connection&, std::__1::tuple<WebCore::IDBOpenRequestData>&&)::'lambda'(auto&&...), std::__1::tuple<WebCore::IDBOpenRequestData>, 0ul>(WebKit::NetworkStorageManager&&, WebKit::NetworkStorageManager&&, std::__1::__tuple_indices<0ul>) + 52 (tuple:1380) 31 WebKit 0x11767fb68 decltype(auto) std::__1::apply[abi:sn210101]<void IPC::callMemberFunction<WebKit::NetworkStorageManager, WebKit::NetworkStorageManager, void (IPC::Connection&, WebCore::IDBOpenRequestData const&), std::__1::tuple<WebCore::IDBOpenRequestData>>(WebKit::NetworkStorageManager*, void (WebKit::NetworkStorageManager::*)(IPC::Connection&, WebCore::IDBOpenRequestData const&), IPC::Connection&, std::__1::tuple<WebCore::IDBOpenRequestData>&&)::'lambda'(auto&&...), std::__1::tuple<WebCore::IDBOpenRequestData>>(WebKit::NetworkStorageManager&&, WebKit::NetworkStorageManager&&) + 36 (tuple:1384) 32 WebKit 0x11767efc0 void IPC::callMemberFunction<WebKit::NetworkStorageManager, WebKit::NetworkStorageManager, void (IPC::Connection&, WebCore::IDBOpenRequestData const&), std::__1::tuple<WebCore::IDBOpenRequestData>>(WebKit::NetworkStorageManager*, void (WebKit::NetworkStorageManager::*)(IPC::Connection&, WebCore::IDBOpenRequestData const&), IPC::Connection&, std::__1::tuple<WebCore::IDBOpenRequestData>&&) + 88 (HandleMessage.h:168) 33 WebKit 0x117638d60 void IPC::handleMessage<Messages::NetworkStorageManager::OpenDatabase, IPC::Connection, WebKit::NetworkStorageManager, WebKit::NetworkStorageManager, void (IPC::Connection&, WebCore::IDBOpenRequestData const&)>(IPC::Connection&, IPC::Decoder&, WebKit::NetworkStorageManager*, void (WebKit::NetworkStorageManager::*)(IPC::Connection&, WebCore::IDBOpenRequestData const&)) + 252 (HandleMessage.h:335) 34 WebKit 0x117633b38 WebKit::NetworkStorageManager::didReceiveMessage(IPC::Connection&, IPC::Decoder&) + 10016 (NetworkStorageManagerMessageReceiver.cpp:329) 35 WebKit 0x11a73bdbc void IPC::Connection::dispatchMessageReceiverMessage<IPC::WorkQueueMessageReceiverBase>(IPC::WorkQueueMessageReceiverBase&, WTF::UniqueRef<IPC::Decoder>&&) + 440 (Connection.cpp:467) 36 WebKit 0x11a74fad0 IPC::WorkQueueMessageReceiverQueue::enqueueMessage(IPC::Connection&, WTF::UniqueRef<IPC::Decoder>&&)::'lambda'()::operator()() + 68 (MessageReceiveQueues.h:70) 37 WebKit 0x11a74f830 WTF::Detail::CallableWrapper<IPC::WorkQueueMessageReceiverQueue::enqueueMessage(IPC::Connection&, WTF::UniqueRef<IPC::Decoder>&&)::'lambda'(), void>::call() + 32 (Function.h:53) 38 JavaScriptCore 0x12af630cc WTF::Function<void ()>::operator()() const + 176 39 JavaScriptCore 0x12b0bc724 WTF::SuspendableWorkQueue::dispatch(WTF::Function<void ()>&&)::$_0::operator()() const + 48 40 JavaScriptCore 0x12b0bc640 WTF::Detail::CallableWrapper<WTF::SuspendableWorkQueue::dispatch(WTF::Function<void ()>&&)::$_0, void>::call() + 32 41 JavaScriptCore 0x12af630cc WTF::Function<void ()>::operator()() const + 176 42 JavaScriptCore 0x12b13ed44 WTF::(anonymous namespace)::DispatchWorkItem::operator()() + 28 43 JavaScriptCore 0x12b13d984 void WTF::dispatchWorkItem<WTF::(anonymous namespace)::DispatchWorkItem>(void*) + 36 44 libdispatch.dylib 0x18264f550 _dispatch_client_callout + 16 45 libdispatch.dylib 0x18263e030 _dispatch_lane_serial_drain + 740 46 libdispatch.dylib 0x18263eb2c _dispatch_lane_invoke + 392 47 libdispatch.dylib 0x182648ed4 _dispatch_root_queue_drain_deferred_wlh + 284 48 libdispatch.dylib 0x1826487d4 _dispatch_workloop_worker_thread + 720 49 libsystem_pthread.dylib 0x1827ebec0 _pthread_wqthread + 292 50 libsystem_pthread.dylib 0x1827eac10 start_wqthread + 8
Radar WebKit Bug Importer
Comment 2 2025-10-17 14:12:15 PDT
<rdar://problem/162891393>
Sihui Liu
Comment 3 2025-10-17 14:23:21 PDT
Pull request: https://github.com/WebKit/WebKit/pull/52579
EWS
Comment 4 2025-10-17 20:42:16 PDT
Committed 301758@main (8414bf071128): <https://commits.webkit.org/301758@main> Reviewed commits have been landed. Closing PR #52579 and removing active labels.
Note You need to log in before you can comment on or make changes to this bug.