NEW146599
Crash in XMLDocumentParser doWrite for Embedded Cocoa WebViews 
https://bugs.webkit.org/show_bug.cgi?id=146599
Summary Crash in XMLDocumentParser doWrite for Embedded Cocoa WebViews
calschut
Reported 2015-07-03 14:43:09 PDT
I have a Mac OS X Cocoa app with an embedded WebView and I keep getting the following crash reports. It happens on multiple versions of OS X including the latest 10.10. I would love to know a work around if possible. I looks like disabling Javascript might do it but that doesn't seem like a good idea. I cannot reproduce it myself but have had many users complain about crashing when loading pages! Also, I see a lot of crash reports generated. I have googled this issue like crazy and couldn't find much out there. See the report bellow... Code Type: X86-64 (Native) Date/Time: 2015-06-30 15:55:10.069 -0400 OS Version: Mac OS X 10.10.4 (14E46) Report Version: 11 Sleep/Wake UUID: 3FB00BEE-8C3B-496C-BBD4-2A7E6AA21248 Time Awake Since Boot: 9600 seconds Time Since Wake: 6800 seconds Crashed Thread: 0 Dispatch queue: com.apple.main-thread Exception Type: EXC_BAD_ACCESS (SIGSEGV) Exception Codes: KERN_INVALID_ADDRESS at 0x0000000000000060 VM Regions Near 0x60: --> __TEXT 000000010ff98000-0000000110141000 [ 1700K] r-x/rwx SM=COW Thread 0 Crashed:: Dispatch queue: com.apple.main-thread 0 com.apple.Foundation 0x00007fff86593d3d _NSErrorFromXMLError + 27 1 com.apple.Foundation 0x00007fff86595805 _reportError + 73 2 libxml2.2.dylib 0x00007fff88d76a85 __xmlRaiseError + 1331 3 libxml2.2.dylib 0x00007fff88d8be4d xmlFatalErr + 324 4 libxml2.2.dylib 0x00007fff88d9e088 xmlParseTryOrFinish + 6091 5 libxml2.2.dylib 0x00007fff88d9c6c8 xmlParseChunk + 901 6 com.apple.WebCore 0x00007fff8f6ba563 WebCore::XMLDocumentParser::doWrite(WTF::String const&) + 419 7 com.apple.WebCore 0x00007fff8f6ec255 WebCore::XMLDocumentParser::append(WTF::PassRefPtr<WTF::StringImpl>) + 197 8 com.apple.WebCore 0x00007fff8f6b9fcb WebCore::Document::setContent(WTF::String const&) + 59 9 com.apple.WebCore 0x00007fff8f990a96 WebCore::DOMParser::parseFromString(WTF::String const&, WTF::String const&, int&) + 214 10 com.apple.WebCore 0x00007fff8f701092 WebCore::jsDOMParserPrototypeFunctionParseFromString(JSC::ExecState*) + 562 11 ??? 0x0000000115986034 0 + 4657274932 12 com.apple.JavaScriptCore 0x00007fff90858fa2 llint_entry + 22764 13 com.apple.JavaScriptCore 0x00007fff90858fa2 llint_entry + 22764 14 com.apple.JavaScriptCore 0x00007fff90858fa2 llint_entry + 22764 15 com.apple.JavaScriptCore 0x00007fff90858fa2 llint_entry + 22764 16 com.apple.JavaScriptCore 0x00007fff908590aa llint_entry + 23028 17 com.apple.JavaScriptCore 0x00007fff90858fa2 llint_entry + 22764 18 com.apple.JavaScriptCore 0x00007fff90858fa2 llint_entry + 22764 19 com.apple.JavaScriptCore 0x00007fff90858fa2 llint_entry + 22764 20 com.apple.JavaScriptCore 0x00007fff90853491 callToJavaScript + 311 21 com.apple.JavaScriptCore 0x00007fff907d75e3 JSC::JITCode::execute(JSC::VM*, JSC::ProtoCallFrame*) + 35 22 com.apple.JavaScriptCore 0x00007fff9047ad7c JSC::Interpreter::execute(JSC::ProgramExecutable*, JSC::ExecState*, JSC::JSObject*) + 8796 23 com.apple.JavaScriptCore 0x00007fff90478944 JSC::evaluate(JSC::ExecState*, JSC::SourceCode const&, JSC::JSValue, JSC::JSValue*) + 484 24 com.apple.WebCore 0x00007fff900cb2d9 WebCore::ScriptController::evaluateInWorld(WebCore::ScriptSourceCode const&, WebCore::DOMWrapperWorld&) + 313 25 com.apple.WebCore 0x00007fff8f552469 WebCore::ScriptController::evaluate(WebCore::ScriptSourceCode const&) + 41 26 com.apple.WebCore 0x00007fff8f55237a WebCore::ScriptElement::executeScript(WebCore::ScriptSourceCode const&) + 298 27 com.apple.WebCore 0x00007fff8f60f58f WebCore::ScriptElement::execute(WebCore::CachedScript*) + 95 28 com.apple.WebCore 0x00007fff900d113f WebCore::ScriptRunner::timerFired(WebCore::Timer&) + 511 29 com.apple.WebCore 0x00007fff8f49611d WebCore::ThreadTimers::sharedTimerFiredInternal() + 157 30 com.apple.WebCore 0x00007fff8f496044 WebCore::timerFired(__CFRunLoopTimer*, void*) + 20 31 com.apple.CoreFoundation 0x00007fff9354a2e4 __CFRUNLOOP_IS_CALLING_OUT_TO_A_TIMER_CALLBACK_FUNCTION__ + 20 32 com.apple.CoreFoundation 0x00007fff93549f73 __CFRunLoopDoTimer + 1059 33 com.apple.CoreFoundation 0x00007fff935bd53d __CFRunLoopDoTimers + 301 34 com.apple.CoreFoundation 0x00007fff93505608 __CFRunLoopRun + 2024 35 com.apple.CoreFoundation 0x00007fff93504bd8 CFRunLoopRunSpecific + 296 36 com.apple.HIToolbox 0x00007fff91d5456f RunCurrentEventLoopInMode + 235 37 com.apple.HIToolbox 0x00007fff91d542ea ReceiveNextEventCommon + 431 38 com.apple.HIToolbox 0x00007fff91d5412b _BlockUntilNextEventMatchingListInModeWithFilter + 71 39 com.apple.AppKit 0x00007fff8c17b8ab _DPSNextEvent + 978 40 com.apple.AppKit 0x00007fff8c17ae58 -[NSApplication nextEventMatchingMask:untilDate:inMode:dequeue:] + 346 41 com.apple.AppKit 0x00007fff8c170af3 -[NSApplication run] + 594 42 com.apple.AppKit 0x00007fff8c0ed244 NSApplicationMain + 1832 0x7fff8a77e000 - 0x7fff8aa3fffb com.apple.WebKit (10600 - 10600.7.12) <A6515140-ADED-30E6-B010-E5C3EEC51732> Another report with a slightly different stack.... Code Type: X86-64 (Native) Parent Process: ??? [1] User ID: 2000654291 Date/Time: 2015-05-18 09:00:37.585 +0200 OS Version: Mac OS X 10.10.3 (14D136) Report Version: 11 Time Awake Since Boot: 4900 seconds Crashed Thread: 0 Dispatch queue: com.apple.main-thread Exception Type: EXC_BAD_ACCESS (SIGSEGV) Exception Codes: KERN_INVALID_ADDRESS at 0x0000000000000060 VM Regions Near 0x60: --> __TEXT 0000000103eac000-0000000104055000 [ 1700K] r-x/rwx SM=COW Thread 0 Crashed:: Dispatch queue: com.apple.main-thread 0 com.apple.Foundation 0x00007fff94b23d3d _NSErrorFromXMLError + 27 1 com.apple.Foundation 0x00007fff94b25805 _reportError + 73 2 libxml2.2.dylib 0x00007fff93fe1a85 __xmlRaiseError + 1331 3 libxml2.2.dylib 0x00007fff93ff6e4d xmlFatalErr + 324 4 libxml2.2.dylib 0x00007fff94009088 xmlParseTryOrFinish + 6091 5 libxml2.2.dylib 0x00007fff940076c8 xmlParseChunk + 901 6 com.apple.WebCore 0x00007fff8f852783 WebCore::XMLDocumentParser::doWrite(WTF::String const&) + 419 7 com.apple.WebCore 0x00007fff8f884455 WebCore::XMLDocumentParser::append(WTF::PassRefPtr<WTF::StringImpl>) + 197 8 com.apple.WebCore 0x00007fff8f8521eb WebCore::Document::setContent(WTF::String const&) + 59 9 com.apple.WebCore 0x00007fff8fb28e16 WebCore::DOMParser::parseFromString(WTF::String const&, WTF::String const&, int&) + 214 10 com.apple.WebCore 0x00007fff8f899292 WebCore::jsDOMParserPrototypeFunctionParseFromString(JSC::ExecState*) + 562 11 ??? 0x0000446ee7201034 0 + 75243114729524 12 com.apple.JavaScriptCore 0x00007fff8ba5cfa2 llint_entry + 22764 13 com.apple.JavaScriptCore 0x00007fff8ba5cfa2 llint_entry + 22764 14 com.apple.JavaScriptCore 0x00007fff8ba5cfa2 llint_entry + 22764 15 com.apple.JavaScriptCore 0x00007fff8ba5cfa2 llint_entry + 22764 16 com.apple.JavaScriptCore 0x00007fff8ba5d0aa llint_entry + 23028 17 com.apple.JavaScriptCore 0x00007fff8ba5cfa2 llint_entry + 22764 18 com.apple.JavaScriptCore 0x00007fff8ba5cfa2 llint_entry + 22764 19 com.apple.JavaScriptCore 0x00007fff8ba5cfa2 llint_entry + 22764 20 com.apple.JavaScriptCore 0x00007fff8ba57491 callToJavaScript + 311 21 com.apple.JavaScriptCore 0x00007fff8b9db5e3 JSC::JITCode::execute(JSC::VM*, JSC::ProtoCallFrame*) + 35 22 com.apple.JavaScriptCore 0x00007fff8b67ed7c JSC::Interpreter::execute(JSC::ProgramExecutable*, JSC::ExecState*, JSC::JSObject*) + 8796 23 com.apple.JavaScriptCore 0x00007fff8b67c944 JSC::evaluate(JSC::ExecState*, JSC::SourceCode const&, JSC::JSValue, JSC::JSValue*) + 484 24 com.apple.WebCore 0x00007fff90263479 WebCore::ScriptController::evaluateInWorld(WebCore::ScriptSourceCode const&, WebCore::DOMWrapperWorld&) + 313 25 com.apple.WebCore 0x00007fff8f6ea6a9 WebCore::ScriptController::evaluate(WebCore::ScriptSourceCode const&) + 41 26 com.apple.WebCore 0x00007fff8f6ea5ba WebCore::ScriptElement::executeScript(WebCore::ScriptSourceCode const&) + 298 27 com.apple.WebCore 0x00007fff8f7a779f WebCore::ScriptElement::execute(WebCore::CachedScript*) + 95 28 com.apple.WebCore 0x00007fff9026929f WebCore::ScriptRunner::timerFired(WebCore::Timer&) + 511 29 com.apple.WebCore 0x00007fff8f62e33d WebCore::ThreadTimers::sharedTimerFiredInternal() + 157 30 com.apple.WebCore 0x00007fff8f62e264 WebCore::timerFired(__CFRunLoopTimer*, void*) + 20 31 com.apple.CoreFoundation 0x00007fff945db2e4 __CFRUNLOOP_IS_CALLING_OUT_TO_A_TIMER_CALLBACK_FUNCTION__ + 20 32 com.apple.CoreFoundation 0x00007fff945daf73 __CFRunLoopDoTimer + 1059 33 com.apple.CoreFoundation 0x00007fff9464e53d __CFRunLoopDoTimers + 301 34 com.apple.CoreFoundation 0x00007fff94596608 __CFRunLoopRun + 2024 35 com.apple.CoreFoundation 0x00007fff94595bd8 CFRunLoopRunSpecific + 296 36 com.apple.HIToolbox 0x00007fff8bb8656f RunCurrentEventLoopInMode + 235 37 com.apple.HIToolbox 0x00007fff8bb862ea ReceiveNextEventCommon + 431 38 com.apple.HIToolbox 0x00007fff8bb8612b _BlockUntilNextEventMatchingListInModeWithFilter + 71 39 com.apple.AppKit 0x00007fff8d11d9bb _DPSNextEvent + 978 40 com.apple.AppKit 0x00007fff8d11cf68 -[NSApplication nextEventMatchingMask:untilDate:inMode:dequeue:] + 346 41 com.apple.AppKit 0x00007fff8d112bf3 -[NSApplication run] + 594 42 com.apple.AppKit 0x00007fff8d08f354 NSApplicationMain + 1832 0x7fff97f7f000 - 0x7fff98240ff7 com.apple.WebKit (10600 - 10600.5.17) <5724ED63-1C75-3090-B60A-DA484A9DBDE2>
Attachments
Add attachment proposed patch, testcase, etc.
Ahmad Saleem
Comment 1 2023-10-21 07:02:59 PDT
Is this still happening? Potential Blink Commit: https://src.chromium.org/viewvc/blink?view=revision&revision=157914
Note You need to log in before you can comment on or make changes to this bug.