Bug 186850 – Regression(r226990) : Crash under WebCore::Page::applicationWillResignActive

• Status: RESOLVED
• Resolution: FIXED
• Component: WebKit2

[Chris Dumez]

Regression(r226990) : Crash under WebCore::Page::applicationWillResignActive:
Thread[0] EXC_BAD_ACCESS (SIGSEGV) (KERN_INVALID_ADDRESS at 0x0000000000000070)
[  0] 0x000000018cff6acc WebCore`WebCore::Page::applicationWillResignActive() [inlined] WTF::DumbPtrTraits<WebCore::MainFrame>::unwrap(WebCore::MainFrame* const&) at DumbPtrTraits.h:41:69

     0x000000018cff6abc:     adrp x8, 2147
     0x000000018cff6ac0:      add x8, x8, #0xcc8       ; =0xcc8 
     0x000000018cff6ac4:      add x8, x8, #0x10        ; =0x10 
     0x000000018cff6ac8:      str x8, [x19]
 ->  0x000000018cff6acc:      ldr x20, [x20, #0x70]
     0x000000018cff6ad0:      cbz x20, 0xfd5b04        ; <+100> [inlined] std::__1::default_delete<WTF::Function<void (WebCore::Document&)>::CallableWrapperBase>::operator()(WTF::Function<void (WebCore::Document&)>::CallableWrapperBase*) const + 4 at memory:2552
     0x000000018cff6ad4:      ldr x1, [x20, #0xa8]
     0x000000018cff6ad8:      cbz x1, 0xfd5aec         ; <+76> [inlined] WebCore::Frame::tree() const at Page.cpp:2354
     0x000000018cff6adc:      ldr x8, [x19]

[  0] 0x000000018cff6acc WebCore`WebCore::Page::applicationWillResignActive() [inlined] WTF::Ref<WebCore::MainFrame, WTF::DumbPtrTraits<WebCore::MainFrame> >::get() const at Ref.h:118
[  0] 0x000000018cff6acc WebCore`WebCore::Page::applicationWillResignActive() [inlined] WebCore::Page::mainFrame() at Page.h:177
       173 	
       174 	    EditorClient& editorClient() { return m_editorClient.get(); }
       175 	    PlugInClient* plugInClient() const { return m_plugInClient; }
       176 	
    -> 177 	    MainFrame& mainFrame() { return m_mainFrame.get(); }
       178 	    const MainFrame& mainFrame() const { return m_mainFrame.get(); }
       179 	
       180 	    bool openedByDOM() const;
       181 	    void setOpenedByDOM();
    
[  0] 0x000000018cff6acc WebCore`WebCore::Page::applicationWillResignActive() [inlined] WebCore::Page::forEachDocument(WTF::Function<void (WebCore::Document&)> const&) at Page.cpp:2354
       2350	}
       2351	
       2352	void Page::forEachDocument(const Function<void(Document&)>& functor)
       2353	{
    -> 2354	    for (Frame* frame = &mainFrame(); frame; frame = frame->tree().traverseNext()) {
       2355	        if (!frame->document())
       2356	            continue;
       2357	
       2358	        functor(*frame->document());
    
[  0] 0x000000018cff6acc WebCore`WebCore::Page::applicationWillResignActive() + 44 at Page.cpp:2364
       2360	}
       2361	
       2362	void Page::applicationWillResignActive()
       2363	{
    -> 2364	    forEachDocument([&] (Document& document) {
       2365	        document.forEachApplicationStateChangeListener([&] (ApplicationStateChangeListener& listener) {
       2366	            listener.applicationWillResignActive();
       2367	        });
       2368	    });
    
[  1] 0x000000018cff6ab7 WebCore`WebCore::Page::applicationWillResignActive() [inlined] WTF::Function<void (WebCore::Document&)>::CallableWrapperBase::operator new(unsigned long) + 7 at Function.h:83:9
[  1] 0x000000018cff6ab0 WebCore`WebCore::Page::applicationWillResignActive() [inlined] std::__1::__unique_if<WTF::Function<void (WebCore::Document&)>::CallableWrapper<WebCore::Page::applicationWillResignActive()::$_3> >::__unique_single std::__1::make_unique<WTF::Function<void (WebCore::Document&)>::CallableWrapper<WebCore::Page::applicationWillResignActive()::$_3>, WebCore::Page::applicationWillResignActive()::$_3>(WebCore::Page::applicationWillResignActive()::$_3&&) at memory:3032
[  1] 0x000000018cff6ab0 WebCore`WebCore::Page::applicationWillResignActive() [inlined] WTF::Function<void (WebCore::Document&)>::Function<WebCore::Page::applicationWillResignActive()::$_3, void>(WebCore::Page::applicationWillResignActive()::$_3&&) at Function.h:43
[  1] 0x000000018cff6ab0 WebCore`WebCore::Page::applicationWillResignActive() [inlined] WTF::Function<void (WebCore::Document&)>::Function<WebCore::Page::applicationWillResignActive()::$_3, void>(WebCore::Page::applicationWillResignActive()::$_3&&) at Function.h:44
[  1] 0x000000018cff6ab0 WebCore`WebCore::Page::applicationWillResignActive() + 16 at Page.cpp:2364
       2360	}
       2361	
       2362	void Page::applicationWillResignActive()
       2363	{
    -> 2364	    forEachDocument([&] (Document& document) {
       2365	        document.forEachApplicationStateChangeListener([&] (ApplicationStateChangeListener& listener) {
       2366	            listener.applicationWillResignActive();
       2367	        });
       2368	    });
    
[  2] 0x000000019385f7fb WebKit`IPC::MessageReceiverMap::dispatchMessage(IPC::Connection&, IPC::Decoder&) + 119 at MessageReceiverMap.cpp:0:26
[  3] 0x0000000193a79533 WebKit`WebKit::WebProcess::didReceiveMessage(IPC::Connection&, IPC::Decoder&) + 35 at WebProcess.cpp:645:30
[  4] 0x0000000193822b47 WebKit`IPC::Connection::dispatchMessage(std::__1::unique_ptr<IPC::Decoder, std::__1::default_delete<IPC::Decoder> >) [inlined] IPC::Connection::dispatchMessage(IPC::Decoder&) + 19 at Connection.cpp:901:14
[  4] 0x0000000193822b34 WebKit`IPC::Connection::dispatchMessage(std::__1::unique_ptr<IPC::Decoder, std::__1::default_delete<IPC::Decoder> >) + 144 at Connection.cpp:928
[  5] 0x0000000193825537 WebKit`IPC::Connection::dispatchOneMessage() + 231 at Connection.cpp:959:5
[  6] 0x000000018b515913 JavaScriptCore`WTF::RunLoop::performWork() [inlined] WTF::Function<void ()>::operator()() const + 15 at Function.h:56:35
[  6] 0x000000018b515904 JavaScriptCore`WTF::RunLoop::performWork() + 332 at RunLoop.cpp:123
[  7] 0x000000018b515b83 JavaScriptCore`WTF::RunLoop::performWork(void*) + 35 at RunLoopCF.cpp:38:37
[  8] 0x000000018372d9e3 CoreFoundation`__CFRUNLOOP_IS_CALLING_OUT_TO_A_SOURCE0_PERFORM_FUNCTION__ + 23 at CFRunLoop.c:1982:9
[  9] 0x000000018372d20b CoreFoundation`__CFRunLoopDoSources0 [inlined] __CFRunLoopDoSource0 + 67 at CFRunLoop.c:2017:13
[  9] 0x000000018372d1c8 CoreFoundation`__CFRunLoopDoSources0 + 208 at CFRunLoop.c:2053
[ 10] 0x000000018372ad7b CoreFoundation`__CFRunLoopRun + 1203 at CFRunLoop.c:2920:41
[ 11] 0x000000018364b487 CoreFoundation`CFRunLoopRunSpecific + 551 at CFRunLoop.c:3245:18
[ 12] 0x00000001840c2003 Foundation`-[NSRunLoop(NSRunLoop) runMode:beforeDate:] + 303 at NSRunLoop.m:367:5
[ 13] 0x0000000184113c6b Foundation`-[NSRunLoop(NSRunLoop) run] + 87 at NSRunLoop.m:389:12
[ 14] 0x00000001833f7bdb libxpc.dylib`_xpc_objc_main + 515 at main.m:167:3
[ 15] 0x00000001833f9caf libxpc.dylib`xpc_main + 179 at init.c:1476:2
[ 16] 0x000000010245f5ab com.apple.WebKit.WebContent`main + 379 at XPCServiceMain.mm:148:5
[ 17] 0x00000001830e9fbf libdyld.dylib`start + 3

[Chris Dumez]

<rdar://problem/37394469>

[Chris Dumez]

Created attachment 343160 [details]
Patch

[EWS Watchlist]

Comment on attachment 343160 [details]
Patch

Attachment 343160 [details] did not pass mac-wk2-ews (mac-wk2):
Output: https://webkit-queues.webkit.org/results/8267078

New failing tests:
accessibility/mac/selection-notification-focus-change.html

[EWS Watchlist]

Created attachment 343170 [details]
Archive of layout-test-results from ews106 for mac-sierra-wk2

The attached test failures were seen while running run-webkit-tests on the mac-wk2-ews.
Bot: ews106  Port: mac-sierra-wk2  Platform: Mac OS X 10.12.6

[WebKit Commit Bot]

Comment on attachment 343160 [details]
Patch

Clearing flags on attachment: 343160

Committed r233034: <https://trac.webkit.org/changeset/233034>

[WebKit Commit Bot]

All reviewed patches have been landed.  Closing bug.