Bug 193113 – Crash under WebPageProxy::continueNavigationInNewProcess()

• Status: RESOLVED
• Resolution: FIXED
• Component: WebKit2

[Chris Dumez]

Crash under WebPageProxy::continueNavigationInNewProcess():
Thread[0] EXC_BREAKPOINT (SIGTRAP) (0x0000000000000001, 0x000000019939e500)
[  0] 0x000000019939e500 WebKit`WTF::Function<void ()>::CallableWrapper<WebKit::WebPageProxy::continueNavigationInNewProcess(API::Navigation&, WTF::Ref<WebKit::WebProcessProxy, WTF::DumbPtrTraits<WebKit::WebProcessProxy> >&&, std::optional<WebKit::WebsitePoliciesData>&&)::$_6>::call() [inlined] std::optional<WebCore::FrameLoadType>::operator*() && at Optional.h:531:5

     0x000000019939e4f0:    ldraa x9, [x8, #0x8]!
     0x000000019939e4f4:     movk x8, #0xa345, lsl #48
     0x000000019939e4f8:    blraa x9, x8
     0x000000019939e4fc:        b 0x1e2134             ; <+300> at Function.h:101
 ->  0x000000019939e500:      brk #0x1
     0x000000019939e504:     adrp x1, 671
     0x000000019939e508:      add x1, x1, #0x238       ; =0x238 
     0x000000019939e50c:     adrp x2, 671
     0x000000019939e510:      add x2, x2, #0x990       ; =0x990 

[  0] 0x000000019939e500 WebKit`WTF::Function<void ()>::CallableWrapper<WebKit::WebPageProxy::continueNavigationInNewProcess(API::Navigation&, WTF::Ref<WebKit::WebProcessProxy, WTF::DumbPtrTraits<WebKit::WebProcessProxy> >&&, std::optional<WebKit::WebsitePoliciesData>&&)::$_6>::call() [inlined] WebKit::WebPageProxy::continueNavigationInNewProcess(API::Navigation&, WTF::Ref<WebKit::WebProcessProxy, WTF::DumbPtrTraits<WebKit::WebProcessProxy> >&&, std::optional<WebKit::WebsitePoliciesData>&&)::$_6::operator()() + 948 at WebPageProxy.cpp:2692
       2688	                }
       2689	                return &item != targetItem;
       2690	            });
       2691	            m_process->send(Messages::WebPage::UpdateBackForwardListForReattach(WTFMove(itemStates)), m_pageID);
    -> 2692	            m_process->send(Messages::WebPage::GoToBackForwardItem(navigation->navigationID(), item->itemID(), *navigation->backForwardFrameLoadType(), ShouldTreatAsContinuingLoad::Yes, WTFMove(websitePolicies)), m_pageID);
       2693	            m_process->responsivenessTimer().start();
       2694	
       2695	            return;
       2696	        }
    
[  0] 0x000000019939e14c WebKit`WTF::Function<void ()>::CallableWrapper<WebKit::WebPageProxy::continueNavigationInNewProcess(API::Navigation&, WTF::Ref<WebKit::WebProcessProxy, WTF::DumbPtrTraits<WebKit::WebProcessProxy> >&&, std::optional<WebKit::WebsitePoliciesData>&&)::$_6>::call() + 324 at Function.h:101
[  1] 0x000000019939e0d3 WebKit`WTF::Function<void ()>::CallableWrapper<WebKit::WebPageProxy::continueNavigationInNewProcess(API::Navigation&, WTF::Ref<WebKit::WebProcessProxy, WTF::DumbPtrTraits<WebKit::WebProcessProxy> >&&, std::optional<WebKit::WebsitePoliciesData>&&)::$_6>::call() [inlined] WebKit::WebPageProxy::continueNavigationInNewProcess(API::Navigation&, WTF::Ref<WebKit::WebProcessProxy, WTF::DumbPtrTraits<WebKit::WebProcessProxy> >&&, std::optional<WebKit::WebsitePoliciesData>&&)::$_6::operator()() + 167 at WebPageProxy.cpp:2691:24
       2687	                        return false;
       2688	                }
       2689	                return &item != targetItem;
       2690	            });
    -> 2691	            m_process->send(Messages::WebPage::UpdateBackForwardListForReattach(WTFMove(itemStates)), m_pageID);
       2692	            m_process->send(Messages::WebPage::GoToBackForwardItem(navigation->navigationID(), item->itemID(), *navigation->backForwardFrameLoadType(), ShouldTreatAsContinuingLoad::Yes, WTFMove(websitePolicies)), m_pageID);
       2693	            m_process->responsivenessTimer().start();
       2694	
       2695	            return;
    
[  1] 0x000000019939e02c WebKit`WTF::Function<void ()>::CallableWrapper<WebKit::WebPageProxy::continueNavigationInNewProcess(API::Navigation&, WTF::Ref<WebKit::WebProcessProxy, WTF::DumbPtrTraits<WebKit::WebProcessProxy> >&&, std::optional<WebKit::WebsitePoliciesData>&&)::$_6>::call() + 36 at Function.h:101
[  2] 0x000000019937f443 WebKit`WebKit::WebPageProxy::swapToWebProcess(WTF::Ref<WebKit::WebProcessProxy, WTF::DumbPtrTraits<WebKit::WebProcessProxy> >&&, API::Navigation&, std::optional<unsigned long long>, WTF::CompletionHandler<void ()>&&)::$_1::operator()() [inlined] WTF::Function<void ()>::operator()() const + 19 at Function.h:56:35
[  2] 0x000000019937f430 WebKit`WebKit::WebPageProxy::swapToWebProcess(WTF::Ref<WebKit::WebProcessProxy, WTF::DumbPtrTraits<WebKit::WebProcessProxy> >&&, API::Navigation&, std::optional<unsigned long long>, WTF::CompletionHandler<void ()>&&)::$_1::operator()() [inlined] WTF::CompletionHandler<void ()>::operator()() + 8 at CompletionHandler.h:59
[  2] 0x000000019937f428 WebKit`WebKit::WebPageProxy::swapToWebProcess(WTF::Ref<WebKit::WebProcessProxy, WTF::DumbPtrTraits<WebKit::WebProcessProxy> >&&, API::Navigation&, std::optional<unsigned long long>, WTF::CompletionHandler<void ()>&&)::$_1::operator()() + 348 at WebPageProxy.cpp:801
[  3] 0x000000019937f1ef WebKit`WebKit::WebPageProxy::swapToWebProcess(WTF::Ref<WebKit::WebProcessProxy, WTF::DumbPtrTraits<WebKit::WebProcessProxy> >&&, API::Navigation&, std::optional<unsigned long long>, WTF::CompletionHandler<void ()>&&) + 443 at WebPageProxy.cpp:807:9
[  4] 0x000000019938684b WebKit`WebKit::WebPageProxy::continueNavigationInNewProcess(API::Navigation&, WTF::Ref<WebKit::WebProcessProxy, WTF::DumbPtrTraits<WebKit::WebProcessProxy> >&&, std::optional<WebKit::WebsitePoliciesData>&&) + 439 at WebPageProxy.cpp:2677:5
[  5] 0x0000000199386307 WebKit`WebKit::WebPageProxy::receivedNavigationPolicyDecision(WebCore::PolicyAction, API::Navigation*, WebKit::ProcessSwapRequestedByClient, WebKit::WebFrameProxy&, API::WebsitePolicies*, WTF::Ref<WebKit::WebPageProxy::PolicyDecisionSender, WTF::DumbPtrTraits<WebKit::WebPageProxy::PolicyDecisionSender> >&&) + 1011 at WebPageProxy.cpp:2632:9
[  6] 0x000000019939fa57 WebKit`WTF::Function<void (WebCore::PolicyAction, API::WebsitePolicies*, WebKit::ProcessSwapRequestedByClient, WTF::RefPtr<WebKit::SafeBrowsingWarning, WTF::DumbPtrTraits<WebKit::SafeBrowsingWarning> >&&)>::CallableWrapper<WebKit::WebPageProxy::decidePolicyForNavigationAction(WebKit::WebFrameProxy&, WebCore::SecurityOriginData&&, unsigned long long, WebKit::NavigationActionData&&, WebKit::FrameInfoData&&, unsigned long long, WebCore::ResourceRequest const&, WebCore::ResourceRequest&&, IPC::FormDataReference&&, WebCore::ResourceResponse&&, WebKit::UserData const&, WTF::Ref<WebKit::WebPageProxy::PolicyDecisionSender, WTF::DumbPtrTraits<WebKit::WebPageProxy::PolicyDecisionSender> >&&)::$_2>::call(WebCore::PolicyAction, API::WebsitePolicies*, WebKit::ProcessSwapRequestedByClient, WTF::RefPtr<WebKit::SafeBrowsingWarning, WTF::DumbPtrTraits<WebKit::SafeBrowsingWarning> >&&) [inlined] WebKit::WebPageProxy::decidePolicyForNavigationAction(WebKit::WebFrameProxy&, WebCore::SecurityOriginData&&, unsigned long long, WebKit::NavigationActionData&&, WebKit::FrameInfoData&&, unsigned long long, WebCore::ResourceRequest const&, WebCore::ResourceRequest&&, IPC::FormDataReference&&, WebCore::ResourceResponse&&, WebKit::UserData const&, WTF::Ref<WebKit::WebPageProxy::PolicyDecisionSender, WTF::DumbPtrTraits<WebKit::WebPageProxy::PolicyDecisionSender> >&&)::$_2::operator()(WebCore::PolicyAction, API::WebsitePolicies*, WebKit::ProcessSwapRequestedByClient, WTF::RefPtr<WebKit::SafeBrowsingWarning, WTF::DumbPtrTraits<WebKit::SafeBrowsingWarning> >&&)::'lambda'(WebCore::PolicyAction)::operator()(WebCore::PolicyAction) + 31 at WebPageProxy.cpp:4280:13
[  6] 0x000000019939fa38 WebKit`WTF::Function<void (WebCore::PolicyAction, API::WebsitePolicies*, WebKit::ProcessSwapRequestedByClient, WTF::RefPtr<WebKit::SafeBrowsingWarning, WTF::DumbPtrTraits<WebKit::SafeBrowsingWarning> >&&)>::CallableWrapper<WebKit::WebPageProxy::decidePolicyForNavigationAction(WebKit::WebFrameProxy&, WebCore::SecurityOriginData&&, unsigned long long, WebKit::NavigationActionData&&, WebKit::FrameInfoData&&, unsigned long long, WebCore::ResourceRequest const&, WebCore::ResourceRequest&&, IPC::FormDataReference&&, WebCore::ResourceResponse&&, WebKit::UserData const&, WTF::Ref<WebKit::WebPageProxy::PolicyDecisionSender, WTF::DumbPtrTraits<WebKit::WebPageProxy::PolicyDecisionSender> >&&)::$_2>::call(WebCore::PolicyAction, API::WebsitePolicies*, WebKit::ProcessSwapRequestedByClient, WTF::RefPtr<WebKit::SafeBrowsingWarning, WTF::DumbPtrTraits<WebKit::SafeBrowsingWarning> >&&) [inlined] WebKit::WebPageProxy::decidePolicyForNavigationAction(WebKit::WebFrameProxy&, WebCore::SecurityOriginData&&, unsigned long long, WebKit::NavigationActionData&&, WebKit::FrameInfoData&&, unsigned long long, WebCore::ResourceRequest const&, WebCore::ResourceRequest&&, IPC::FormDataReference&&, WebCore::ResourceResponse&&, WebKit::UserData const&, WTF::Ref<WebKit::WebPageProxy::PolicyDecisionSender, WTF::DumbPtrTraits<WebKit::WebPageProxy::PolicyDecisionSender> >&&)::$_2::operator()(WebCore::PolicyAction, API::WebsitePolicies*, WebKit::ProcessSwapRequestedByClient, WTF::RefPtr<WebKit::SafeBrowsingWarning, WTF::DumbPtrTraits<WebKit::SafeBrowsingWarning> >&&) + 284 at WebPageProxy.cpp:4306
[  6] 0x000000019939f91c WebKit`WTF::Function<void (WebCore::PolicyAction, API::WebsitePolicies*, WebKit::ProcessSwapRequestedByClient, WTF::RefPtr<WebKit::SafeBrowsingWarning, WTF::DumbPtrTraits<WebKit::SafeBrowsingWarning> >&&)>::CallableWrapper<WebKit::WebPageProxy::decidePolicyForNavigationAction(WebKit::WebFrameProxy&, WebCore::SecurityOriginData&&, unsigned long long, WebKit::NavigationActionData&&, WebKit::FrameInfoData&&, unsigned long long, WebCore::ResourceRequest const&, WebCore::ResourceRequest&&, IPC::FormDataReference&&, WebCore::ResourceResponse&&, WebKit::UserData const&, WTF::Ref<WebKit::WebPageProxy::PolicyDecisionSender, WTF::DumbPtrTraits<WebKit::WebPageProxy::PolicyDecisionSender> >&&)::$_2>::call(WebCore::PolicyAction, API::WebsitePolicies*, WebKit::ProcessSwapRequestedByClient, WTF::RefPtr<WebKit::SafeBrowsingWarning, WTF::DumbPtrTraits<WebKit::SafeBrowsingWarning> >&&) + 60 at Function.h:101
[  7] 0x0000000199374dc7 WebKit`WTF::Function<void (WebCore::PolicyAction, API::WebsitePolicies*, WebKit::ProcessSwapRequestedByClient, WTF::RefPtr<WebKit::SafeBrowsingWarning, WTF::DumbPtrTraits<WebKit::SafeBrowsingWarning> >&&)>::CallableWrapper<WebKit::WebFrameProxy::setUpPolicyListenerProxy(WTF::CompletionHandler<void (WebCore::PolicyAction, API::WebsitePolicies*, WebKit::ProcessSwapRequestedByClient, WTF::RefPtr<WebKit::SafeBrowsingWarning, WTF::DumbPtrTraits<WebKit::SafeBrowsingWarning> >&&)>&&, WebKit::ShouldExpectSafeBrowsingResult)::$_0>::call(WebCore::PolicyAction, API::WebsitePolicies*, WebKit::ProcessSwapRequestedByClient, WTF::RefPtr<WebKit::SafeBrowsingWarning, WTF::DumbPtrTraits<WebKit::SafeBrowsingWarning> >&&) [inlined] WTF::Function<void (WebCore::PolicyAction, API::WebsitePolicies*, WebKit::ProcessSwapRequestedByClient, WTF::RefPtr<WebKit::SafeBrowsingWarning, WTF::DumbPtrTraits<WebKit::SafeBrowsingWarning> >&&)>::operator()(WebCore::PolicyAction, API::WebsitePolicies*, WebKit::ProcessSwapRequestedByClient, WTF::RefPtr<WebKit::SafeBrowsingWarning, WTF::DumbPtrTraits<WebKit::SafeBrowsingWarning> >&&) const + 19 at Function.h:56:35
[  7] 0x0000000199374db4 WebKit`WTF::Function<void (WebCore::PolicyAction, API::WebsitePolicies*, WebKit::ProcessSwapRequestedByClient, WTF::RefPtr<WebKit::SafeBrowsingWarning, WTF::DumbPtrTraits<WebKit::SafeBrowsingWarning> >&&)>::CallableWrapper<WebKit::WebFrameProxy::setUpPolicyListenerProxy(WTF::CompletionHandler<void (WebCore::PolicyAction, API::WebsitePolicies*, WebKit::ProcessSwapRequestedByClient, WTF::RefPtr<WebKit::SafeBrowsingWarning, WTF::DumbPtrTraits<WebKit::SafeBrowsingWarning> >&&)>&&, WebKit::ShouldExpectSafeBrowsingResult)::$_0>::call(WebCore::PolicyAction, API::WebsitePolicies*, WebKit::ProcessSwapRequestedByClient, WTF::RefPtr<WebKit::SafeBrowsingWarning, WTF::DumbPtrTraits<WebKit::SafeBrowsingWarning> >&&) [inlined] WTF::CompletionHandler<void (WebCore::PolicyAction, API::WebsitePolicies*, WebKit::ProcessSwapRequestedByClient, WTF::RefPtr<WebKit::SafeBrowsingWarning, WTF::DumbPtrTraits<WebKit::SafeBrowsingWarning> >&&)>::operator()(WebCore::PolicyAction, API::WebsitePolicies*, WebKit::ProcessSwapRequestedByClient, WTF::RefPtr<WebKit::SafeBrowsingWarning, WTF::DumbPtrTraits<WebKit::SafeBrowsingWarning> >&&) + 8 at CompletionHandler.h:59
[  7] 0x0000000199374dac WebKit`WTF::Function<void (WebCore::PolicyAction, API::WebsitePolicies*, WebKit::ProcessSwapRequestedByClient, WTF::RefPtr<WebKit::SafeBrowsingWarning, WTF::DumbPtrTraits<WebKit::SafeBrowsingWarning> >&&)>::CallableWrapper<WebKit::WebFrameProxy::setUpPolicyListenerProxy(WTF::CompletionHandler<void (WebCore::PolicyAction, API::WebsitePolicies*, WebKit::ProcessSwapRequestedByClient, WTF::RefPtr<WebKit::SafeBrowsingWarning, WTF::DumbPtrTraits<WebKit::SafeBrowsingWarning> >&&)>&&, WebKit::ShouldExpectSafeBrowsingResult)::$_0>::call(WebCore::PolicyAction, API::WebsitePolicies*, WebKit::ProcessSwapRequestedByClient, WTF::RefPtr<WebKit::SafeBrowsingWarning, WTF::DumbPtrTraits<WebKit::SafeBrowsingWarning> >&&) [inlined] WebKit::WebFrameProxy::setUpPolicyListenerProxy(WTF::CompletionHandler<void (WebCore::PolicyAction, API::WebsitePolicies*, WebKit::ProcessSwapRequestedByClient, WTF::RefPtr<WebKit::SafeBrowsingWarning, WTF::DumbPtrTraits<WebKit::SafeBrowsingWarning> >&&)>&&, WebKit::ShouldExpectSafeBrowsingResult)::$_0::operator()(WebCore::PolicyAction, API::WebsitePolicies*, WebKit::ProcessSwapRequestedByClient, WTF::RefPtr<WebKit::SafeBrowsingWarning, WTF::DumbPtrTraits<WebKit::SafeBrowsingWarning> >&&) at WebFrameProxy.cpp:185
[  7] 0x0000000199374dac WebKit`WTF::Function<void (WebCore::PolicyAction, API::WebsitePolicies*, WebKit::ProcessSwapRequestedByClient, WTF::RefPtr<WebKit::SafeBrowsingWarning, WTF::DumbPtrTraits<WebKit::SafeBrowsingWarning> >&&)>::CallableWrapper<WebKit::WebFrameProxy::setUpPolicyListenerProxy(WTF::CompletionHandler<void (WebCore::PolicyAction, API::WebsitePolicies*, WebKit::ProcessSwapRequestedByClient, WTF::RefPtr<WebKit::SafeBrowsingWarning, WTF::DumbPtrTraits<WebKit::SafeBrowsingWarning> >&&)>&&, WebKit::ShouldExpectSafeBrowsingResult)::$_0>::call(WebCore::PolicyAction, API::WebsitePolicies*, WebKit::ProcessSwapRequestedByClient, WTF::RefPtr<WebKit::SafeBrowsingWarning, WTF::DumbPtrTraits<WebKit::SafeBrowsingWarning> >&&) + 20 at Function.h:101
[  8] 0x000000019936b3f7 WebKit`WebKit::WebFramePolicyListenerProxy::didReceiveSafeBrowsingResults(WTF::RefPtr<WebKit::SafeBrowsingWarning, WTF::DumbPtrTraits<WebKit::SafeBrowsingWarning> >&&) [inlined] WTF::Function<void (WebCore::PolicyAction, API::WebsitePolicies*, WebKit::ProcessSwapRequestedByClient, WTF::RefPtr<WebKit::SafeBrowsingWarning, WTF::DumbPtrTraits<WebKit::SafeBrowsingWarning> >&&)>::operator()(WebCore::PolicyAction, API::WebsitePolicies*, WebKit::ProcessSwapRequestedByClient, WTF::RefPtr<WebKit::SafeBrowsingWarning, WTF::DumbPtrTraits<WebKit::SafeBrowsingWarning> >&&) const + 23 at Function.h:56:35
[  8] 0x000000019936b3e0 WebKit`WebKit::WebFramePolicyListenerProxy::didReceiveSafeBrowsingResults(WTF::RefPtr<WebKit::SafeBrowsingWarning, WTF::DumbPtrTraits<WebKit::SafeBrowsingWarning> >&&) [inlined] WTF::CompletionHandler<void (WebCore::PolicyAction, API::WebsitePolicies*, WebKit::ProcessSwapRequestedByClient, WTF::RefPtr<WebKit::SafeBrowsingWarning, WTF::DumbPtrTraits<WebKit::SafeBrowsingWarning> >&&)>::operator()(WebCore::PolicyAction, API::WebsitePolicies*, WebKit::ProcessSwapRequestedByClient, WTF::RefPtr<WebKit::SafeBrowsingWarning, WTF::DumbPtrTraits<WebKit::SafeBrowsingWarning> >&&) + 4 at CompletionHandler.h:59
[  8] 0x000000019936b3dc WebKit`WebKit::WebFramePolicyListenerProxy::didReceiveSafeBrowsingResults(WTF::RefPtr<WebKit::SafeBrowsingWarning, WTF::DumbPtrTraits<WebKit::SafeBrowsingWarning> >&&) + 44 at WebFramePolicyListenerProxy.cpp:53
[  9] 0x000000019936895b WebKit`WTF::Function<void ()>::CallableWrapper<WebKit::WebPageProxy::beginSafeBrowsingCheck(WTF::URL const&, WebKit::WebFramePolicyListenerProxy&)::$_1::operator()(SSBLookupResult*, NSError*)::'lambda'()>::call() [inlined] WebKit::WebPageProxy::beginSafeBrowsingCheck(WTF::URL const&, WebKit::WebFramePolicyListenerProxy&)::$_1::operator()(SSBLookupResult*, NSError*)::'lambda'()::operator()() const + 255 at WebPageProxyCocoa.mm:94:23
[  9] 0x000000019936885c WebKit`WTF::Function<void ()>::CallableWrapper<WebKit::WebPageProxy::beginSafeBrowsingCheck(WTF::URL const&, WebKit::WebFramePolicyListenerProxy&)::$_1::operator()(SSBLookupResult*, NSError*)::'lambda'()>::call() + 152 at Function.h:101
[ 10] 0x0000000190aca843 JavaScriptCore`WTF::RunLoop::performWork() [inlined] WTF::Function<void ()>::operator()() const + 19 at Function.h:56:35
[ 10] 0x0000000190aca830 JavaScriptCore`WTF::RunLoop::performWork() + 336 at RunLoop.cpp:123
[ 11] 0x0000000190acaabf JavaScriptCore`WTF::RunLoop::performWork(void*) + 39 at RunLoopCF.cpp:38:37
[ 12] 0x0000000188eae857 CoreFoundation`__CFRUNLOOP_IS_CALLING_OUT_TO_A_SOURCE0_PERFORM_FUNCTION__ + 27 at CFRunLoop.c:1980:9
[ 13] 0x0000000188eae7d3 CoreFoundation`__CFRunLoopDoSource0 + 91 at CFRunLoop.c:2015:13
[ 14] 0x0000000188eae08f CoreFoundation`__CFRunLoopDoSources0 + 179 at CFRunLoop.c:2051:29
[ 15] 0x0000000188ea8d5f CoreFoundation`__CFRunLoopRun + 991 at CFRunLoop.c:2922:41
[ 16] 0x0000000188ea865f CoreFoundation`CFRunLoopRunSpecific + 451 at CFRunLoop.c:3247:18
[ 17] 0x000000018b0e4dc7 GraphicsServices`GSEventRunModal + 107 at GSEvent.c:2245:9
[ 18] 0x00000001b7050c1b UIKitCore`UIApplicationMain + 215 at UIApplication.m:4353:5
[ 19] 0x000000010427ea8f MobileSafari`main + 1503
[ 20] 0x00000001889651fb libdyld.dylib`start + 3

[Chris Dumez]

<rdar://problem/46938686>

[Chris Dumez]

Created attachment 358262 [details]
Patch

[Chris Dumez]

Comment on attachment 358262 [details]
Patch

Clearing flags on attachment: 358262

Committed r239638: <https://trac.webkit.org/changeset/239638>

[Chris Dumez]

All reviewed patches have been landed.  Closing bug.