ASSERTION FAILED: m_messageReceivers.contains(...) under ViewGestureController removeMessageReceiver Steps to Reproduce: 1. Load a web page in Safari 2. Kill WebContent Process for that page (kill -9) 3. Kill WebContent Process for that page again (kill -9) 4. Click the "Reload" button in Safari 5. Kill WebContent Process for that page again (kill -9) => ASSERT ASSERTION FAILED: m_messageReceivers.contains(std::make_pair(messageReceiverName, destinationID)) /Volumes/Data/Code/safari/OpenSource/Source/WebKit/Platform/IPC/MessageReceiverMap.cpp(72) : void IPC::MessageReceiverMap::removeMessageReceiver(IPC::StringReference, uint64_t) 1 0x110a97299 WTFCrash 2 0x119dad6ab WTFCrashWithInfo(int, char const*, char const*, int) 3 0x119e5c380 IPC::MessageReceiverMap::removeMessageReceiver(IPC::StringReference, unsigned long long) 4 0x11a4430a7 WebKit::ChildProcessProxy::removeMessageReceiver(IPC::StringReference, unsigned long long) 5 0x11a9172f0 WebKit::ViewGestureController::~ViewGestureController() 6 0x11a9174f5 WebKit::ViewGestureController::~ViewGestureController() 7 0x11a917519 WebKit::ViewGestureController::~ViewGestureController() 8 0x11a569269 WebKit::WebViewImpl::processDidExit() 9 0x11a813eeb WebKit::PageClientImpl::processDidExit() 10 0x11a67c8ba WebKit::WebPageProxy::resetStateAfterProcessExited(WebKit::ProcessTerminationReason) 11 0x11a649067 WebKit::WebPageProxy::processDidTerminate(WebKit::ProcessTerminationReason) 12 0x11a73af38 WebKit::WebProcessProxy::processDidTerminateOrFailedToLaunch() 13 0x11a73acbc WebKit::WebProcessProxy::didClose(IPC::Connection&) 14 0x119e157d6 IPC::Connection::connectionDidClose()::$_13::operator()() ... Notes: - Seems a receiver is being removed that wasn't registered? - This doesn't happen on simple process restarts, but does happen after the special safari "Reload" case, what is different?
A bit odd since we add in the constructor and remove in the destructor. Maybe something else emptied out the map?
*** Bug 191780 has been marked as a duplicate of this bug. ***
More practical steps to reproduce in bug 191780. Possibly a recent regression, given that both reports are recent. Chris, is this related to r237615?
<rdar://problem/46151497>
Could be related to PSON or process prewarming if this is recent. I'll investigate.
After clicking the reload button in Safari I see: CHRIS: addMessageReceiver(1, 0x7fce56c3dd90), process is 0x1324e3400 Then we killing the process I see: CHRIS: removeMessageReceiver(1, 0x7fce56c3dd90) process is 0x135ce1400 I added itself as a message receiver from one process and is trying to unregister itself from another.
Yes, this is a PSON regression. This is due to us not destroying the gesture controller in WebViewImpl::processWillSwap(). We only do it in WebViewImpl::processDidExit(). We did this to fix Bug 191083. I will fix it shortly.
Created attachment 355200 [details] API test
Created attachment 355201 [details] Patch
Comment on attachment 355201 [details] Patch View in context: https://bugs.webkit.org/attachment.cgi?id=355201&action=review Looks sane to me. I guess we should wait for EWS. > Source/WebKit/ChangeLog:10 > + after we've relaunched a new Webprocess. The ViewGestureController controller takes care Nit: Web*P*rocess. > Source/WebKit/ChangeLog:19 > + To address the issue, we now take sure the ViewGestureController unregisters itself from we now *make* sure?
Created attachment 355204 [details] Patch
Created attachment 355207 [details] Patch
Comment on attachment 355207 [details] Patch Clearing flags on attachment: 355207 Committed r238356: <https://trac.webkit.org/changeset/238356>
All reviewed patches have been landed. Closing bug.