Bug 193110 – Crash under WebProcessPool::addSuspendedPage()

• Status: RESOLVED
• Resolution: FIXED
• Component: WebKit2

[Chris Dumez]

Crash under WebProcessPool::addSuspendedPage():
Crashed Thread:        0  Dispatch queue: com.apple.main-thread

Exception Type:        EXC_BAD_ACCESS (SIGSEGV)
Exception Codes:       KERN_INVALID_ADDRESS at 0x0000000000000000
Exception Note:        EXC_CORPSE_NOTIFY

Termination Signal:    Segmentation fault: 11
Termination Reason:    Namespace SIGNAL, Code 0xb
Terminating Process:   exc handler [98873]

VM Regions Near 0:
--> 
    __TEXT                 000000010f14d000-000000010f5b8000 [ 4524K] r-x/rwx SM=COW  /Volumes/VOLUME/*

Thread 0 Crashed:: Dispatch queue: com.apple.main-thread
0   com.apple.WebKit              	0x00000001112e1642 WTF::Deque<std::__1::unique_ptr<WebKit::SuspendedPageProxy, std::__1::default_delete<WebKit::SuspendedPageProxy> >, 0ul>::removeFirst() + 16 (memory:2595)
1   com.apple.WebKit              	0x00000001112e4c71 WebKit::WebProcessPool::addSuspendedPage(std::__1::unique_ptr<WebKit::SuspendedPageProxy, std::__1::default_delete<WebKit::SuspendedPageProxy> >&&) + 73 (Deque.h:472)
2   com.apple.WebKit              	0x00000001112a78db WebKit::WebPageProxy::suspendCurrentPageIfPossible(API::Navigation&, WTF::Optional<unsigned long long>, WebKit::ProcessSwapRequestedByClient) + 217 (memory:2595)
3   com.apple.WebKit              	0x00000001112b11c5 WebKit::WebPageProxy::continueNavigationInNewProcess(API::Navigation&, std::__1::unique_ptr<WebKit::SuspendedPageProxy, std::__1::default_delete<WebKit::SuspendedPageProxy> >&&, WTF::Ref<WebKit::WebProcessProxy, WTF::DumbPtrTraits<WebKit::WebProcessProxy> >&&, WebKit::ProcessSwapRequestedByClient, WTF::Optional<WebKit::WebsitePoliciesData>&&) + 431 (WebPageProxy.cpp:2763)
4   com.apple.WebKit              	0x00000001112cd962 WebKit::WebPageProxy::receivedNavigationPolicyDecision(WebKit::WebPolicyAction, API::Navigation*, WebKit::ProcessSwapRequestedByClient, WebKit::WebFrameProxy&, API::WebsitePolicies*, WTF::Ref<WebKit::WebPageProxy::PolicyDecisionSender, WTF::DumbPtrTraits<WebKit::WebPageProxy::PolicyDecisionSender> >&&)::$_5::operator()(WTF::Ref<WebKit::WebProcessProxy, WTF::DumbPtrTraits<WebKit::WebProcessProxy> >&&, WebKit::SuspendedPageProxy*, WTF::String const&) + 944 (memory:2595)
5   com.apple.WebKit              	0x00000001112f3d07 WebKit::WebProcessPool::processForNavigation(WebKit::WebPageProxy&, API::Navigation const&, WebKit::ProcessSwapRequestedByClient, WTF::CompletionHandler<void (WTF::Ref<WebKit::WebProcessProxy, WTF::DumbPtrTraits<WebKit::WebProcessProxy> >&&, WebKit::SuspendedPageProxy*, WTF::String const&)>&&)::$_12::operator()(WTF::Ref<WebKit::WebProcessProxy, WTF::DumbPtrTraits<WebKit::WebProcessProxy> >&&, WebKit::SuspendedPageProxy*, WTF::String const&) + 163 (memory:2597)
6   com.apple.WebKit              	0x00000001112e49c7 WebKit::WebProcessPool::processForNavigationInternal(WebKit::WebPageProxy&, API::Navigation const&, WebKit::ProcessSwapRequestedByClient, WTF::CompletionHandler<void (WTF::Ref<WebKit::WebProcessProxy, WTF::DumbPtrTraits<WebKit::WebProcessProxy> >&&, WebKit::SuspendedPageProxy*, WTF::String const&)>&&) + 2719 (memory:2597)
7   com.apple.WebKit              	0x00000001112e3f05 WebKit::WebProcessPool::processForNavigation(WebKit::WebPageProxy&, API::Navigation const&, WebKit::ProcessSwapRequestedByClient, WTF::CompletionHandler<void (WTF::Ref<WebKit::WebProcessProxy, WTF::DumbPtrTraits<WebKit::WebProcessProxy> >&&, WebKit::SuspendedPageProxy*, WTF::String const&)>&&) + 131 (memory:2595)
8   com.apple.WebKit              	0x00000001112b0b66 WebKit::WebPageProxy::receivedNavigationPolicyDecision(WebKit::WebPolicyAction, API::Navigation*, WebKit::ProcessSwapRequestedByClient, WebKit::WebFrameProxy&, API::WebsitePolicies*, WTF::Ref<WebKit::WebPageProxy::PolicyDecisionSender, WTF::DumbPtrTraits<WebKit::WebPageProxy::PolicyDecisionSender> >&&) + 582 (memory:2595)
9   com.apple.WebKit              	0x00000001112cecf1 WTF::Function<void (WebKit::WebPolicyAction, API::WebsitePolicies*, WebKit::ProcessSwapRequestedByClient, WTF::RefPtr<WebKit::SafeBrowsingWarning, WTF::DumbPtrTraits<WebKit::SafeBrowsingWarning> >&&)>::CallableWrapper<WebKit::WebPageProxy::decidePolicyForNavigationAction(WebKit::WebFrameProxy&, WebCore::SecurityOriginData&&, unsigned long long, WebKit::NavigationActionData&&, WebKit::FrameInfoData&&, unsigned long long, WebCore::ResourceRequest const&, WebCore::ResourceRequest&&, IPC::FormDataReference&&, WebCore::ResourceResponse&&, WebKit::UserData const&, WTF::Ref<WebKit::WebPageProxy::PolicyDecisionSender, WTF::DumbPtrTraits<WebKit::WebPageProxy::PolicyDecisionSender> >&&)::$_2>::call(WebKit::WebPolicyAction, API::WebsitePolicies*, WebKit::ProcessSwapRequestedByClient, WTF::RefPtr<WebKit::SafeBrowsingWarning, WTF::DumbPtrTraits<WebKit::SafeBrowsingWarning> >&&) + 575 (utility:896)
10  com.apple.WebKit              	0x000000011129de22 WTF::Function<void (WebKit::WebPolicyAction, API::WebsitePolicies*, WebKit::ProcessSwapRequestedByClient, WTF::RefPtr<WebKit::SafeBrowsingWarning, WTF::DumbPtrTraits<WebKit::SafeBrowsingWarning> >&&)>::CallableWrapper<WebKit::WebFrameProxy::setUpPolicyListenerProxy(WTF::CompletionHandler<void (WebKit::WebPolicyAction, API::WebsitePolicies*, WebKit::ProcessSwapRequestedByClient, WTF::RefPtr<WebKit::SafeBrowsingWarning, WTF::DumbPtrTraits<WebKit::SafeBrowsingWarning> >&&)>&&, WebKit::ShouldExpectSafeBrowsingResult)::$_0>::call(WebKit::WebPolicyAction, API::WebsitePolicies*, WebKit::ProcessSwapRequestedByClient, WTF::RefPtr<WebKit::SafeBrowsingWarning, WTF::DumbPtrTraits<WebKit::SafeBrowsingWarning> >&&) + 30 (memory:2597)
11  com.apple.WebKit              	0x0000000111299846 WebKit::WebFramePolicyListenerProxy::didReceiveSafeBrowsingResults(WTF::RefPtr<WebKit::SafeBrowsingWarning, WTF::DumbPtrTraits<WebKit::SafeBrowsingWarning> >&&) + 54 (memory:2285)
12  com.apple.WebKit              	0x00000001112703f1 WTF::Function<void ()>::CallableWrapper<WebKit::WebPageProxy::beginSafeBrowsingCheck(WTF::URL const&, bool, WebKit::WebFramePolicyListenerProxy&)::$_1::operator()(SSBLookupResult*, NSError*)::'lambda'()>::call() + 449 (utility:896)
13  com.apple.JavaScriptCore      	0x000000010fb3ed17 WTF::RunLoop::performWork() + 231 (Function.h:56)

[Chris Dumez]

Created attachment 358257 [details]
Patch

[WebKit Commit Bot]

Comment on attachment 358257 [details]
Patch

Clearing flags on attachment: 358257

Committed r239617: <https://trac.webkit.org/changeset/239617>

[WebKit Commit Bot]

All reviewed patches have been landed.  Closing bug.

[Radar WebKit Bug Importer]

<rdar://problem/47050388>