Bug 121953 – r156419, Nightly, Debug, _oldFirstResponderBeforeBecoming is not a valid message outside of a responder's implementation of -becomeFirstResponder

• Status: RESOLVED
• Resolution: INVALID
• Component: New Bugs

[Hoyt LLC]

Hello-

Filing as Security Issue to keep private until reviewed.  

 WebView.mm ->      // If we hit this assert on a debug build, we should figure out what causes the problem and do a better fix.

Description: NSWindow: -_oldFirstResponderBeforeBecoming is not a valid message outside of a responder's implementation of -becomeFirstResponder.

Overview: 

Using the nightly, debug build, and opening "Keynote" in icloud.com, the App Crashes.

Steps to Reproduce: Login to icloud.com, created a "new" presentation, paste in some text, Open Presentation, Go Full Screen, Cancel Full Screen... then Crash. Also, Opening icloud.com, KeyNote and opening WebInspector produces a Crash. 

Actual Results: Application Crash

Expected Results: Open the Presentation and continue editing... (Or, at least, the application should not crash.)

Build Date & Platform: 
uname -a = Darwin server.local 12.5.0 Darwin Kernel Version 12.5.0: Mon Jul 29 16:33:49 PDT 2013; root:xnu-2050.48.11~1/RELEASE_X86_64 x86_64
Repository Root: https://svn.webkit.org/repository/webkit
Revision: 156419
Report:
=========

server:Scripts xss$ DYLD_FRAMEWORK_PATH=/Applications/WebKit.app/Contents/Frameworks/10.8 DYLD_INSERT_LIBRARIES=/usr/lib/libgmalloc.dylib /Applications/Safari.app/Contents/MacOS/SafariForWebKitDevelopment --target-webkit-process
2013-09-25 14:41:05.023 SafariForWebKitDevelopment[89239:707] An uncaught exception was raised
2013-09-25 14:41:05.027 SafariForWebKitDevelopment[89239:707] NSWindow: -_oldFirstResponderBeforeBecoming is not a valid message outside of a responder's implementation of -becomeFirstResponder.
....
2013-09-25 14:41:05.132 SafariForWebKitDevelopment[89239:707] *** Terminating app due to uncaught exception 'NSInternalInconsistencyException', reason: 'NSWindow: -_oldFirstResponderBeforeBecoming is not a valid message outside of a responder's implementation of -becomeFirstResponder.'
*** First throw call stack:
(
	0   CoreFoundation                      0x00007fff8e248b06 __exceptionPreprocess + 198
	1   libobjc.A.dylib                     0x00007fff930903f0 objc_exception_throw + 43
	2   CoreFoundation                      0x00007fff8e2488dc +[NSException raise:format:] + 204
	3   AppKit                              0x00007fff8b635e42 -[NSWindow _oldFirstResponderBeforeBecoming] + 117
	4   WebKit                              0x00007fff92104e11 -[WebView becomeFirstResponder] + 129
	5   AppKit                              0x00007fff8b620818 -[NSWindow makeFirstResponder:] + 702
	6   Safari                              0x00007fff90b27247 -[Window makeFirstResponder:] + 112
	7   Safari                              0x00007fff90913b81 -[BrowserWindow makeFirstResponder:] + 171
	8   AppKit                              0x00007fff8b6469d8 -[NSWindow _selectFirstKeyView] + 812
	9   AppKit                              0x00007fff8b64668b -[NSWindow _setUpFirstResponder] + 182
	10  AppKit                              0x00007fff8b6449bf -[NSWindow _reallyDoOrderWindow:relativeTo:findKey:forCounter:force:isModal:] + 1288
	11  AppKit                              0x00007fff8b644038 -[NSWindow _doOrderWindow:relativeTo:findKey:forCounter:force:isModal:] + 940
	12  AppKit                              0x00007fff8b643c1f -[NSWindow orderWindow:relativeTo:] + 159
	13  WebKit                              0x00007fff9217dc01 -[WebFullScreenController exitFullScreen] + 545
	14  WebCore                             0x00007fff89e3637b _ZN7WebCore8Document20webkitExitFullscreenEv + 651
	15  WebCore                             0x00007fff89cb4714 _ZN7WebCore8Document22webkitCancelFullScreenEv + 404
	16  WebCore                             0x00007fff89912853 _ZN7WebCore13ContainerNode11removeChildEPNS_4NodeERi + 147
	17  WebCore                             0x00007fff899b0b29 _ZN7WebCore4Node11removeChildEPS0_Ri + 25
	18  WebCore                             0x00007fff899b0adc _ZN7WebCore6JSNode11removeChildEPN3JSC9ExecStateE + 60
	19  WebCore                             0x00007fff899b0a93 _ZN7WebCore34jsNodePrototypeFunctionRemoveChildEPN3JSC9ExecStateE + 83
	20  ???                                 0x0000000113465685 0x0 + 4618344069
	21  JavaScriptCore                      0x00007fff931c4d70 _ZN3JSC11Interpreter11executeCallEPNS_9ExecStateEPNS_8JSObjectENS_8CallTypeERKNS_8CallDataENS_7JSValueERKNS_7ArgListE + 912
	22  JavaScriptCore                      0x00007fff931c49d4 _ZN3JSC4callEPNS_9ExecStateENS_7JSValueENS_8CallTypeERKNS_8CallDataES2_RKNS_7ArgListE + 52
	23  WebCore                             0x00007fff898eee72 _ZN7WebCore15JSEventListener11handleEventEPNS_22ScriptExecutionContextEPNS_5EventE + 898
	24  WebCore                             0x00007fff898ee98c _ZN7WebCore11EventTarget18fireEventListenersEPNS_5EventEPNS_15EventTargetDataERN3WTF6VectorINS_23RegisteredEventListenerELm1EEE + 220
	25  WebCore                             0x00007fff89870465 _ZN7WebCore11EventTarget18fireEventListenersEPNS_5EventE + 69
	26  WebCore                             0x00007fff8987053a _ZN7WebCore4Node17handleLocalEventsEPNS_5EventE + 170
	27  WebCore                             0x00007fff898fa0d6 _ZNK7WebCore12EventContext17handleLocalEventsEPNS_5EventE + 86
	28  WebCore                             0x00007fff8986fceb _ZN7WebCore15EventDispatcher13dispatchEventEN3WTF10PassRefPtrINS_5EventEEE + 939
	29  WebCore                             0x00007fff8986f905 _ZNK7WebCore21EventDispatchMediator13dispatchEventEPNS_15EventDispatcherE + 37
	30  WebCore                             0x00007fff89f2174b _ZN7WebCore15EventDispatcher13dispatchEventEPNS_4NodeEN3WTF10PassRefPtrINS_21EventDispatchMediatorEEE + 139
	31  WebCore                             0x00007fff8986f857 _ZN7WebCore4Node13dispatchEventEN3WTF10PassRefPtrINS_5EventEEE + 55
	32  WebCore                             0x00007fff8999ab40 _ZN7WebCore11EventTarget13dispatchEventEN3WTF10PassRefPtrINS_5EventEEERi + 112
	33  WebCore                             0x00007fff89acef64 _ZN7WebCore12EventHandler8keyEventERKNS_21PlatformKeyboardEventE + 1060
	34  WebCore                             0x00007fff89ace285 _ZN7WebCore12EventHandler8keyEventEP7NSEvent + 53
	35  WebKit                              0x00007fff9212ec7c -[WebHTMLView keyDown:] + 268
	36  AppKit                              0x00007fff8b66a020 -[NSWindow sendEvent:] + 9687
	37  AppKit                              0x00007fff8b665644 -[NSApplication sendEvent:] + 5761
	38  Safari                              0x00007fff908aec75 -[BrowserApplication sendEvent:] + 415
	39  AppKit                              0x00007fff8b57b21a -[NSApplication run] + 636
	40  AppKit                              0x00007fff8b51fbd6 NSApplicationMain + 869
	41  Safari                              0x00007fff90a86564 SafariMain + 166
	42  libdyld.dylib                       0x00007fff8ce167e1 start + 0
)
libc++abi.dylib: terminate called throwing an exception
Abort trap: 6
server:Scripts xss$

ASSERTION FAILED: dlopen(/System/Library/StagedFrameworks/Safari/WebInspectorUI.framework/Versions/A/WebInspectorUI, 1): image not found
frameworkLibrary
/Users/xss/WebKit/Source/WebKit2/UIProcess/mac/WebInspectorProxyMac.mm(54) : void *WebInspectorUILibrary()
1   0x10059a7d0 WTFCrash
2   0x101e3394a WebInspectorUILibrary()
3   0x101e33671 WebKit::inspectorReallyUsesWebKitUserInterface(WebKit::WebPreferences*)
4   0x101e3350b WebKit::WebInspectorProxy::inspectorPageURL() const
5   0x101e21b95 WebKit::WebInspectorProxy::createInspectorPage(unsigned long long&, WebKit::WebPageCreationParameters&)
6   0x101e38b16 void CoreIPC::callMemberFunction<WebKit::WebInspectorProxy, void (WebKit::WebInspectorProxy::*)(unsigned long long&, WebKit::WebPageCreationParameters&), unsigned long long, WebKit::WebPageCreationParameters>(std::__1::tuple<>&&, std::__1::tuple<unsigned long long, WebKit::WebPageCreationParameters>&, WebKit::WebInspectorProxy*, void (WebKit::WebInspectorProxy::*)(unsigned long long&, WebKit::WebPageCreationParameters&))
7   0x101e38a2e void CoreIPC::handleMessage<Messages::WebInspectorProxy::CreateInspectorPage, WebKit::WebInspectorProxy, void (WebKit::WebInspectorProxy::*)(unsigned long long&, WebKit::WebPageCreationParameters&)>(CoreIPC::MessageDecoder&, CoreIPC::MessageEncoder&, WebKit::WebInspectorProxy*, void (WebKit::WebInspectorProxy::*)(unsigned long long&, WebKit::WebPageCreationParameters&))
8   0x101e37fa6 WebKit::WebInspectorProxy::didReceiveSyncMessage(CoreIPC::Connection*, CoreIPC::MessageDecoder&, std::__1::unique_ptr<CoreIPC::MessageEncoder, std::__1::default_delete<CoreIPC::MessageEncoder> >&)
9   0x101e3801f non-virtual thunk to WebKit::WebInspectorProxy::didReceiveSyncMessage(CoreIPC::Connection*, CoreIPC::MessageDecoder&, std::__1::unique_ptr<CoreIPC::MessageEncoder, std::__1::default_delete<CoreIPC::MessageEncoder> >&)
10  0x101bad376 CoreIPC::MessageReceiverMap::dispatchSyncMessage(CoreIPC::Connection*, CoreIPC::MessageDecoder&, std::__1::unique_ptr<CoreIPC::MessageEncoder, std::__1::default_delete<CoreIPC::MessageEncoder> >&)
11  0x101ae28bf WebKit::ChildProcessProxy::dispatchSyncMessage(CoreIPC::Connection*, CoreIPC::MessageDecoder&, std::__1::unique_ptr<CoreIPC::MessageEncoder, std::__1::default_delete<CoreIPC::MessageEncoder> >&)
12  0x101fb0df2 WebKit::WebProcessProxy::didReceiveSyncMessage(CoreIPC::Connection*, CoreIPC::MessageDecoder&, std::__1::unique_ptr<CoreIPC::MessageEncoder, std::__1::default_delete<CoreIPC::MessageEncoder> >&)
13  0x101fb0eef non-virtual thunk to WebKit::WebProcessProxy::didReceiveSyncMessage(CoreIPC::Connection*, CoreIPC::MessageDecoder&, std::__1::unique_ptr<CoreIPC::MessageEncoder, std::__1::default_delete<CoreIPC::MessageEncoder> >&)
14  0x101aee826 CoreIPC::Connection::dispatchSyncMessage(CoreIPC::MessageDecoder&)
15  0x101ae7bbd CoreIPC::Connection::dispatchMessage(std::__1::unique_ptr<CoreIPC::MessageDecoder, std::__1::default_delete<CoreIPC::MessageDecoder> >)
16  0x101aef181 CoreIPC::Connection::dispatchOneMessage()
17  0x101afbb02 WTF::FunctionWrapper<void (CoreIPC::Connection::*)()>::operator()(CoreIPC::Connection*)
18  0x101afba85 WTF::BoundFunctionImpl<WTF::FunctionWrapper<void (CoreIPC::Connection::*)()>, void (CoreIPC::Connection*)>::operator()()
19  0x104877f02 WTF::Function<void ()>::operator()() const
20  0x104877b58 WebCore::RunLoop::performWork()
21  0x104879504 WebCore::RunLoop::performWork(void*)
22  0x7fff92905b31 __CFRUNLOOP_IS_CALLING_OUT_TO_A_SOURCE0_PERFORM_FUNCTION__
23  0x7fff92905455 __CFRunLoopDoSources0
24  0x7fff929287f5 __CFRunLoopRun
25  0x7fff929280e2 CFRunLoopRunSpecific
26  0x7fff94bedeb4 RunCurrentEventLoopInMode
27  0x7fff94bedc52 ReceiveNextEventCommon
28  0x7fff94bedae3 BlockUntilNextEventMatchingListInMode
29  0x7fff8fcc2533 _DPSNextEvent
30  0x7fff8fcc1df2 -[NSApplication nextEventMatchingMask:untilDate:inMode:dequeue:]
31  0x7fff94fed5a2 -[BrowserApplication nextEventMatchingMask:untilDate:inMode:dequeue:]
LEAK: 2 WebPage
LEAK: 3 WebFrame
LEAK: 4 XMLHttpRequest
LEAK: 4 SubresourceLoader
LEAK: 234 RenderObject
LEAK: 2 Page
LEAK: 928 WebCoreNode
LEAK: 3 Frame
LEAK: 253 CachedResource

[Alexey Proskuryakov]

In the future, please report separate issues in separate bugs. It is extremely confusing to deal with a bug that tracks two unrelated issues.

I could not reproduce either issue. 

Issue #1 is a crash under -[WebView becomeFirstResponder] when going to and from fullscreen. It's unclear why WebKit1 code gets involved, perhaps there is an extension?

If you can still reproduce this, please file a new bug, and attach a complete crash report as a file - not just a stack trace that was posted here.

Issue #2 is a failre to open WebInspectorUI framework. This framework should be loaded from WebKit.app, not from /S/L/StagedFrameworks/Safari/. Not sure why it's looking in the wrong place. Are you using Safari 6.0.5? Nightly builds are not expected to be usable with anything except for the latest released version of Safari.

If you can still reproduce this with Safari 6.0.5, please file a new bug, and attach a complete crash report.