Bug 109887 – REGRESSION (r142734): Crash in JSObjectGetPrivate

• Status: RESOLVED
• Resolution: WORKSFORME
• Component: WebCore JavaScript

[Kevin M. Dean]

Been crashing randomly on various sites throughout the last day. Not always repeatable.


Process:         WebProcess [17088]
Path:            /Applications/WebKit.app/Contents/Frameworks/10.8/WebKit2.framework/WebProcess.app/Contents/MacOS/WebProcess
Identifier:      com.apple.WebProcess
Version:         537+ (537.32+)
Code Type:       X86-64 (Native)
Parent Process:  SafariForWebKitDevelopment [17086]
User ID:         501

Date/Time:       2013-02-15 00:33:31.975 -0500
OS Version:      Mac OS X 10.8.2 (12C60)
Report Version:  10

Crashed Thread:  0  Dispatch queue: com.apple.main-thread

Exception Type:  EXC_BAD_ACCESS (SIGSEGV)
Exception Codes: KERN_INVALID_ADDRESS at 0x0000000000000430

VM Regions Near 0x430:
--> 
    __TEXT                 000000010d08c000-000000010d08d000 [    4K] r-x/rwx SM=COW  /Applications/WebKit.app/Contents/Frameworks/10.8/WebKit2.framework/WebProcess.app/Contents/MacOS/WebProcess

Application Specific Information:
Bundle controller class:
BrowserBundleController
 

Thread 0 Crashed:: Dispatch queue: com.apple.main-thread
0   com.apple.JavaScriptCore      	0x000000010d67c50d JSObjectGetPrivate + 13
1   com.apple.Safari.framework    	0x0000000111576e69 Safari::JSWrapper::wrap(OpaqueJSContext const*, Safari::JSWrappable*) + 131
2   com.apple.Safari.framework    	0x00000001114d9b75 Safari::EventTarget::handleEvent(Safari::Event*, Safari::RegisteredEventListener const&) + 87
3   com.apple.Safari.framework    	0x00000001114d9a9a Safari::EventTarget::fireEventListeners(Safari::Event*, Safari::EventTargetTracker*) + 312
4   com.apple.Safari.framework    	0x00000001114d96bf Safari::EventTarget::fireEventListeners(Safari::Event*) + 173
5   com.apple.Safari.framework    	0x00000001114d95ce Safari::EventTarget::dispatchEvent(Safari::Event*) + 370
6   com.apple.Safari.framework    	0x00000001114a14ea Safari::ContentExtension::dispatchMessageToPage(Safari::WK::String const&, Safari::WK::SerializedScriptValue const&, Safari::WK::BundlePage const&) + 128
7   com.apple.Safari.framework    	0x00000001114a44c0 Safari::ContentExtension::handleMessage(Safari::WK::String const&, Safari::WK::Type const&) + 140
8   com.apple.Safari.framework    	0x0000000111407582 Safari::BrowserBundleController::dispatchMessage(Safari::WK::String const&, Safari::WK::Type const&) + 62
9   com.apple.Safari.framework    	0x0000000111405cc2 Safari::BrowserBundleController::didReceiveMessage(Safari::WK::Bundle const&, Safari::WK::String const&, Safari::WK::Type const&) + 40
10  com.apple.Safari.framework    	0x000000011148a6e3 Safari::WK::didReceiveMessage(OpaqueWKBundle const*, OpaqueWKString const*, void const*, void const*) + 91
11  com.apple.WebKit2             	0x000000010d0f0140 WebKit::InjectedBundleClient::didReceiveMessage(WebKit::InjectedBundle*, WTF::String const&, WebKit::APIObject*) + 134
12  com.apple.WebKit2             	0x000000010d1ec624 WebKit::WebProcess::postInjectedBundleMessage(CoreIPC::DataReference const&) + 144
13  com.apple.WebKit2             	0x000000010d1f2943 void CoreIPC::handleMessage<Messages::WebProcess::PostInjectedBundleMessage, WebKit::WebProcess, void (WebKit::WebProcess::*)(CoreIPC::DataReference const&)>(CoreIPC::MessageDecoder&, WebKit::WebProcess*, void (WebKit::WebProcess::*)(CoreIPC::DataReference const&)) + 69
14  com.apple.WebKit2             	0x000000010d0d30dd CoreIPC::Connection::dispatchMessage(WTF::PassOwnPtr<CoreIPC::MessageDecoder>) + 105
15  com.apple.WebKit2             	0x000000010d0d477a CoreIPC::Connection::dispatchOneMessage() + 96
16  com.apple.WebCore             	0x000000010e469fd9 WebCore::RunLoop::performWork() + 153
17  com.apple.WebCore             	0x000000010e46a675 WebCore::RunLoop::performWork(void*) + 53
18  com.apple.CoreFoundation      	0x00007fff87db0101 __CFRUNLOOP_IS_CALLING_OUT_TO_A_SOURCE0_PERFORM_FUNCTION__ + 17
19  com.apple.CoreFoundation      	0x00007fff87dafaed __CFRunLoopDoSources0 + 445
20  com.apple.CoreFoundation      	0x00007fff87dd2dc5 __CFRunLoopRun + 789
21  com.apple.CoreFoundation      	0x00007fff87dd26b2 CFRunLoopRunSpecific + 290
22  com.apple.HIToolbox           	0x00007fff8dc4e0a4 RunCurrentEventLoopInMode + 209
23  com.apple.HIToolbox           	0x00007fff8dc4de42 ReceiveNextEventCommon + 356
24  com.apple.HIToolbox           	0x00007fff8dc4dcd3 BlockUntilNextEventMatchingListInMode + 62
25  com.apple.AppKit              	0x00007fff8b88d613 _DPSNextEvent + 685
26  com.apple.AppKit              	0x00007fff8b88ced2 -[NSApplication nextEventMatchingMask:untilDate:inMode:dequeue:] + 128
27  com.apple.AppKit              	0x00007fff8b884283 -[NSApplication run] + 517
28  com.apple.WebCore             	0x000000010e46ac5d WebCore::RunLoop::run() + 77
29  com.apple.WebKit2             	0x000000010d163d2d int WebKit::ChildProcessMain<WebKit::WebProcess, WebKit::WebContentProcessMainDelegate>(int, char**) + 631
30  com.apple.WebProcess          	0x000000010d08ce43 main + 307
31  libdyld.dylib                 	0x00007fff8936d7e1 start + 1

[Alexey Proskuryakov]

Can you please try running the nightly build with GuardMalloc from command line to hopefully catch the error earlier and more reproducibly?

The following should be a single line in Terminal:

DYLD_FRAMEWORK_PATH=/Applications/WebKit.app/Contents/Frameworks/10.8 DYLD_INSERT_LIBRARIES=/usr/lib/libgmalloc.dylib /Applications/Safari.app/Contents/MacOS/SafariForWebKitDevelopment

[Alexey Proskuryakov]

*** Bug 109938 has been marked as a duplicate of this bug. ***

[Kevin M. Dean]

(In reply to comment #1)
> Can you please try running the nightly build with GuardMalloc from command line to hopefully catch the error earlier and more reproducibly?

Ok, doing now. We'll see what happens.

[Kevin M. Dean]

Crashed running in the other mode. Crash doesn't really look any different.

Process:         WebProcess [17088]
Path:            /Applications/WebKit.app/Contents/Frameworks/10.8/WebKit2.framework/WebProcess.app/Contents/MacOS/WebProcess
Identifier:      com.apple.WebProcess
Version:         537+ (537.32+)
Code Type:       X86-64 (Native)
Parent Process:  SafariForWebKitDevelopment [17086]
User ID:         501

Date/Time:       2013-02-15 00:33:31.975 -0500
OS Version:      Mac OS X 10.8.2 (12C60)
Report Version:  10

Interval Since Last Report:          46 sec
Crashes Since Last Report:           1
Per-App Interval Since Last Report:  24 sec
Per-App Crashes Since Last Report:   1
Anonymous UUID:                      3FB4F99D-AA2A-BF09-84EE-B9783AA375CE

Crashed Thread:  0  Dispatch queue: com.apple.main-thread

Exception Type:  EXC_BAD_ACCESS (SIGSEGV)
Exception Codes: KERN_INVALID_ADDRESS at 0x0000000000000430

VM Regions Near 0x430:
--> 
    __TEXT                 000000010d08c000-000000010d08d000 [    4K] r-x/rwx SM=COW  /Applications/WebKit.app/Contents/Frameworks/10.8/WebKit2.framework/WebProcess.app/Contents/MacOS/WebProcess

Application Specific Information:
Bundle controller class:
BrowserBundleController
 

Thread 0 Crashed:: Dispatch queue: com.apple.main-thread
0   com.apple.JavaScriptCore      	0x000000010d67c50d JSObjectGetPrivate + 13
1   com.apple.Safari.framework    	0x0000000111576e69 Safari::JSWrapper::wrap(OpaqueJSContext const*, Safari::JSWrappable*) + 131
2   com.apple.Safari.framework    	0x00000001114d9b75 Safari::EventTarget::handleEvent(Safari::Event*, Safari::RegisteredEventListener const&) + 87
3   com.apple.Safari.framework    	0x00000001114d9a9a Safari::EventTarget::fireEventListeners(Safari::Event*, Safari::EventTargetTracker*) + 312
4   com.apple.Safari.framework    	0x00000001114d96bf Safari::EventTarget::fireEventListeners(Safari::Event*) + 173
5   com.apple.Safari.framework    	0x00000001114d95ce Safari::EventTarget::dispatchEvent(Safari::Event*) + 370
6   com.apple.Safari.framework    	0x00000001114a14ea Safari::ContentExtension::dispatchMessageToPage(Safari::WK::String const&, Safari::WK::SerializedScriptValue const&, Safari::WK::BundlePage const&) + 128
7   com.apple.Safari.framework    	0x00000001114a44c0 Safari::ContentExtension::handleMessage(Safari::WK::String const&, Safari::WK::Type const&) + 140
8   com.apple.Safari.framework    	0x0000000111407582 Safari::BrowserBundleController::dispatchMessage(Safari::WK::String const&, Safari::WK::Type const&) + 62
9   com.apple.Safari.framework    	0x0000000111405cc2 Safari::BrowserBundleController::didReceiveMessage(Safari::WK::Bundle const&, Safari::WK::String const&, Safari::WK::Type const&) + 40
10  com.apple.Safari.framework    	0x000000011148a6e3 Safari::WK::didReceiveMessage(OpaqueWKBundle const*, OpaqueWKString const*, void const*, void const*) + 91
11  com.apple.WebKit2             	0x000000010d0f0140 WebKit::InjectedBundleClient::didReceiveMessage(WebKit::InjectedBundle*, WTF::String const&, WebKit::APIObject*) + 134
12  com.apple.WebKit2             	0x000000010d1ec624 WebKit::WebProcess::postInjectedBundleMessage(CoreIPC::DataReference const&) + 144
13  com.apple.WebKit2             	0x000000010d1f2943 void CoreIPC::handleMessage<Messages::WebProcess::PostInjectedBundleMessage, WebKit::WebProcess, void (WebKit::WebProcess::*)(CoreIPC::DataReference const&)>(CoreIPC::MessageDecoder&, WebKit::WebProcess*, void (WebKit::WebProcess::*)(CoreIPC::DataReference const&)) + 69
14  com.apple.WebKit2             	0x000000010d0d30dd CoreIPC::Connection::dispatchMessage(WTF::PassOwnPtr<CoreIPC::MessageDecoder>) + 105
15  com.apple.WebKit2             	0x000000010d0d477a CoreIPC::Connection::dispatchOneMessage() + 96
16  com.apple.WebCore             	0x000000010e469fd9 WebCore::RunLoop::performWork() + 153
17  com.apple.WebCore             	0x000000010e46a675 WebCore::RunLoop::performWork(void*) + 53
18  com.apple.CoreFoundation      	0x00007fff87db0101 __CFRUNLOOP_IS_CALLING_OUT_TO_A_SOURCE0_PERFORM_FUNCTION__ + 17
19  com.apple.CoreFoundation      	0x00007fff87dafaed __CFRunLoopDoSources0 + 445
20  com.apple.CoreFoundation      	0x00007fff87dd2dc5 __CFRunLoopRun + 789
21  com.apple.CoreFoundation      	0x00007fff87dd26b2 CFRunLoopRunSpecific + 290
22  com.apple.HIToolbox           	0x00007fff8dc4e0a4 RunCurrentEventLoopInMode + 209
23  com.apple.HIToolbox           	0x00007fff8dc4de42 ReceiveNextEventCommon + 356
24  com.apple.HIToolbox           	0x00007fff8dc4dcd3 BlockUntilNextEventMatchingListInMode + 62
25  com.apple.AppKit              	0x00007fff8b88d613 _DPSNextEvent + 685
26  com.apple.AppKit              	0x00007fff8b88ced2 -[NSApplication nextEventMatchingMask:untilDate:inMode:dequeue:] + 128
27  com.apple.AppKit              	0x00007fff8b884283 -[NSApplication run] + 517
28  com.apple.WebCore             	0x000000010e46ac5d WebCore::RunLoop::run() + 77
29  com.apple.WebKit2             	0x000000010d163d2d int WebKit::ChildProcessMain<WebKit::WebProcess, WebKit::WebContentProcessMainDelegate>(int, char**) + 631
30  com.apple.WebProcess          	0x000000010d08ce43 main + 307
31  libdyld.dylib                 	0x00007fff8936d7e1 start + 1

[Kevin M. Dean]

Currently crashing when I visit the following page:

http://www.aintitcool.com/node/60976

Doesn't happen every time. I thinking clearing the cache first helps increase the chances of having a crash.

[Alexey Proskuryakov]

> Currently crashing when I visit the following page:

Can you please attach a complete crash log? That would tell us what extensions you have installed (the crash happens in extension support code).

[Kevin M. Dean]

Created attachment 188693 [details]
Crash Log

[Kevin M. Dean]

Created attachment 188694 [details]
Crash Log 2

Noticed previous crash log didn't have as much data as earlier ones, so here's the first crash I had.

[Kevin M. Dean]

Note that I'm also not seeing any extensions listed in these crash logs.

[Alexey Proskuryakov]

(In reply to comment #9)
> Note that I'm also not seeing any extensions listed in these crash logs.

Indeed, not sure what's up with that. Can you tell us what extensions you have installed and enabled?

[Kevin M. Dean]

Copy All Links 1.0
Franker 1.3.1
BuiltWith 1.0
User CSS 1.3.2
ClicktoFlash 2.7.4
Maximieren 0.95
IMDb Links 2.4
Social Fixer 7.501
NinjaKit 0.9.1
YoutubeWide 10.0
The Tracktor 1.1
OpenSearch for Safari 1.09
NoMoreiTunes 2.3.1
autocomplete 1.0
gDirectLinks 1.0.3
IP Address and Domain Information 2.3
Ghostery 1.4.1
RSS Menu 1.9.3
3camels 1.0
Google Search by Image 1.0

[Luc Jallois]

Created attachment 188721 [details]
Crash Report

[Kevin M. Dean]

(In reply to comment #12)
> Created an attachment (id=188721) [details]
> Crash Report

That's a different crash that's being reviewed in Bug 109838

Although that crash did start around the same time as this one, so maybe they're related.

[Kevin M. Dean]

Will see if the rollout in Bug 110018 has any affect on this.

[Luc Jallois]

Created attachment 188732 [details]
WebKit Crash Report

[Kevin M. Dean]

(In reply to comment #14)
> Will see if the rollout in Bug 110018 has any affect on this.

So far no crash with the recent nightly after this rollout, so maybe...

need to test some more to be sure.

[Kevin M. Dean]

Well... no crashes anymore after that rollout for me.

[Alexey Proskuryakov]

Oh well.