Bug 193907 - REGRESSION(r240553): [iOS] Crash in ScrollingTree::updateTreeFromStateNode when attempting to log in to icloud.com
Summary: REGRESSION(r240553): [iOS] Crash in ScrollingTree::updateTreeFromStateNode wh...
Status: RESOLVED FIXED
Alias: None
Product: WebKit
Classification: Unclassified
Component: Layout and Rendering (show other bugs)
Version: WebKit Nightly Build
Hardware: Unspecified Unspecified
: P2 Normal
Assignee: Simon Fraser (smfr)
URL:
Keywords: InRadar
: 193937 193955 (view as bug list)
Depends on:
Blocks:
 
Reported: 2019-01-28 07:32 PST by Wenson Hsieh
Modified: 2019-01-31 08:37 PST (History)
16 users (show)

See Also:


Attachments
Patch (29.09 KB, patch)
2019-01-28 20:54 PST, Simon Fraser (smfr)
no flags Details | Formatted Diff | Diff
Archive of layout-test-results from ews125 for ios-simulator-wk2 (2.67 MB, application/zip)
2019-01-29 03:59 PST, Build Bot
no flags Details
Patch (36.26 KB, patch)
2019-01-29 10:39 PST, Simon Fraser (smfr)
ews: commit-queue-
Details | Formatted Diff | Diff
Archive of layout-test-results from ews102 for mac-highsierra (2.56 MB, application/zip)
2019-01-29 11:42 PST, Build Bot
no flags Details
Archive of layout-test-results from ews107 for mac-highsierra-wk2 (2.68 MB, application/zip)
2019-01-29 11:55 PST, Build Bot
no flags Details
Archive of layout-test-results from ews113 for mac-highsierra (2.35 MB, application/zip)
2019-01-29 12:14 PST, Build Bot
no flags Details
Archive of layout-test-results from ews122 for ios-simulator-wk2 (9.21 MB, application/zip)
2019-01-29 12:37 PST, Build Bot
no flags Details

Note You need to log in before you can comment on or make changes to this bug.
Description Wenson Hsieh 2019-01-28 07:32:07 PST
Tested against trunk (as of r240557).

To reproduce:

0. Log out of icloud.com if logged in
1. Go to icloud.com
2. Enter in a valid Apple ID and password
3. Hit enter to try and log in

About when the 2FA modal prompt is shown, MobileSafari crashes:

Exception Type:  EXC_CRASH (SIGABRT)
Exception Codes: 0x0000000000000000, 0x0000000000000000
Exception Note:  EXC_CORPSE_NOTIFY
Triggered by Thread:  0

Application Specific Information:
Pure virtual function called!
abort() called

Thread 0 name:  Dispatch queue: com.apple.main-thread
Thread 0 Crashed:
0   libsystem_kernel.dylib          __pthread_kill + 8
1   libsystem_pthread.dylib         pthread_kill + 300
2   libsystem_c.dylib               abort + 144
3   libc++abi.dylib                 __cxa_bad_cast + 0
4   libc++abi.dylib                 __cxa_deleted_virtual + 0
5   WebCore                         WebCore::ScrollingTree::updateTreeFromStateNode(WebCore::ScrollingStateNode const*, WTF::HashMap<unsigned long long, WTF::RefPtr<WebCore::ScrollingTreeNode, WTF::DumbPtrTraits<WebCore::ScrollingTreeNode> >, WTF::IntHash<unsigned long long>, WTF::HashTraits<unsigned long long>, WTF::HashTraits<WTF::RefPtr<WebCore::ScrollingTreeNode, WTF::DumbPtrTraits<WebCore::ScrollingTreeNode> > > >&) + 844
6   WebCore                         WebCore::ScrollingTree::updateTreeFromStateNode(WebCore::ScrollingStateNode const*, WTF::HashMap<unsigned long long, WTF::RefPtr<WebCore::ScrollingTreeNode, WTF::DumbPtrTraits<WebCore::ScrollingTreeNode> >, WTF::IntHash<unsigned long long>, WTF::HashTraits<unsigned long long>, WTF::HashTraits<WTF::RefPtr<WebCore::ScrollingTreeNode, WTF::DumbPtrTraits<WebCore::ScrollingTreeNode> > > >&) + 1080
7   WebCore                         WebCore::ScrollingTree::updateTreeFromStateNode(WebCore::ScrollingStateNode const*, WTF::HashMap<unsigned long long, WTF::RefPtr<WebCore::ScrollingTreeNode, WTF::DumbPtrTraits<WebCore::ScrollingTreeNode> >, WTF::IntHash<unsigned long long>, WTF::HashTraits<unsigned long long>, WTF::HashTraits<WTF::RefPtr<WebCore::ScrollingTreeNode, WTF::DumbPtrTraits<WebCore::ScrollingTreeNode> > > >&) + 1080
8   WebCore                         WebCore::ScrollingTree::updateTreeFromStateNode(WebCore::ScrollingStateNode const*, WTF::HashMap<unsigned long long, WTF::RefPtr<WebCore::ScrollingTreeNode, WTF::DumbPtrTraits<WebCore::ScrollingTreeNode> >, WTF::IntHash<unsigned long long>, WTF::HashTraits<unsigned long long>, WTF::HashTraits<WTF::RefPtr<WebCore::ScrollingTreeNode, WTF::DumbPtrTraits<WebCore::ScrollingTreeNode> > > >&) + 1080
9   WebCore                         WebCore::ScrollingTree::commitTreeState(std::__1::unique_ptr<WebCore::ScrollingStateTree, std::__1::default_delete<WebCore::ScrollingStateTree> >) + 356
10  WebKit                          WebKit::RemoteScrollingCoordinatorProxy::commitScrollingTreeState(WebKit::RemoteScrollingCoordinatorTransaction const&, WebKit::RemoteScrollingCoordinatorProxy::RequestedScrollInfo&) + 120
11  WebKit                          WebKit::RemoteLayerTreeDrawingAreaProxy::commitLayerTree(WebKit::RemoteLayerTreeTransaction const&, WebKit::RemoteScrollingCoordinatorTransaction const&) + 248
12  WebKit                          void IPC::handleMessage<Messages::RemoteLayerTreeDrawingAreaProxy::CommitLayerTree, WebKit::RemoteLayerTreeDrawingAreaProxy, void (WebKit::RemoteLayerTreeDrawingAreaProxy::*)(WebKit::RemoteLayerTreeTransaction const&, WebKit::RemoteScrollingCoordinatorTransaction const&)>(IPC::Decoder&, WebKit::RemoteLayerTreeDrawingAreaProxy*, void (WebKit::RemoteLayerTreeDrawingAreaProxy::*)(WebKit::RemoteLayerTreeTransaction const&, WebKit::RemoteScrollingCoordinatorTransaction const&)) + 148
13  WebKit                          IPC::MessageReceiverMap::dispatchMessage(IPC::Connection&, IPC::Decoder&) + 128
Comment 1 Wenson Hsieh 2019-01-28 08:20:01 PST
The crash is happening under this call:

    node->commitStateBeforeChildren(*stateNode);

...the ScrollingTreeNode that's trying to commitStateBeforeChildren has been destroyed already. Its node type is 1 (ScrollingNodeType::Subframe).
Comment 2 Radar WebKit Bug Importer 2019-01-28 11:27:27 PST
<rdar://problem/47604080>
Comment 3 Simon Fraser (smfr) 2019-01-28 20:53:16 PST
*** Bug 193937 has been marked as a duplicate of this bug. ***
Comment 4 Simon Fraser (smfr) 2019-01-28 20:54:20 PST
Created attachment 360431 [details]
Patch
Comment 5 Wenson Hsieh 2019-01-28 23:36:02 PST
*** Bug 193955 has been marked as a duplicate of this bug. ***
Comment 6 Frédéric Wang (:fredw) 2019-01-29 00:26:25 PST
Comment on attachment 360431 [details]
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=360431&action=review

> Source/WebCore/ChangeLog:26
> +

It looks like these two refactoring tasks are independent from this bug and could have been handled in separate patches, but ok.

> Source/WebCore/ChangeLog:27
> +        Tested by existing tests.

Shouldn't we add a crash test?
Comment 7 Frédéric Wang (:fredw) 2019-01-29 00:30:10 PST
Comment on attachment 360431 [details]
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=360431&action=review

>> Source/WebCore/ChangeLog:27
>> +        Tested by existing tests.
> 
> Shouldn't we add a crash test?

OK, I guess it's tested at least by compositing/iframes/remove-reinsert-webview-with-iframe.html (bug 193879 comment 4).
Comment 8 Build Bot 2019-01-29 03:59:41 PST
Comment on attachment 360431 [details]
Patch

Attachment 360431 [details] did not pass ios-sim-ews (ios-simulator-wk2):
Output: https://webkit-queues.webkit.org/results/10936542

New failing tests:
fast/scrolling/ios/hit-testing-iframe.html
fast/scrolling/ios/scroll-iframe.html
Comment 9 Build Bot 2019-01-29 03:59:43 PST
Created attachment 360456 [details]
Archive of layout-test-results from ews125 for ios-simulator-wk2

The attached test failures were seen while running run-webkit-tests on the ios-sim-ews.
Bot: ews125  Port: ios-simulator-wk2  Platform: Mac OS X 10.13.6
Comment 10 Simon Fraser (smfr) 2019-01-29 10:39:47 PST
Created attachment 360472 [details]
Patch
Comment 11 Build Bot 2019-01-29 11:42:34 PST
Comment on attachment 360472 [details]
Patch

Attachment 360472 [details] did not pass mac-ews (mac):
Output: https://webkit-queues.webkit.org/results/10940796

New failing tests:
compositing/iframes/scrolling-iframe.html
compositing/iframes/connect-compositing-iframe.html
compositing/iframes/remove-reinsert-webview-with-iframe.html
compositing/iframes/overlapped-iframe.html
compositing/visible-rect/iframe-with-layers-outside-viewport.html
compositing/iframes/enter-compositing-iframe.html
compositing/iframes/iframe-resize.html
compositing/visible-rect/iframe-and-layers.html
compositing/iframes/composited-parent-iframe.html
compositing/iframes/invisible-nested-iframe-show.html
compositing/iframes/connect-compositing-iframe-delayed.html
compositing/iframes/page-cache-layer-tree.html
compositing/iframes/resizer.html
compositing/repaint/iframes/compositing-iframe-scroll-repaint.html
compositing/iframes/connect-compositing-iframe2.html
compositing/repaint/iframes/compositing-iframe-with-fixed-background-doc-repaint.html
compositing/iframes/resize-from-zero-size.html
compositing/iframes/connect-compositing-iframe3.html
compositing/iframes/become-composited-nested-iframes.html
compositing/iframes/overlapped-iframe-iframe.html
compositing/iframes/become-overlapped-iframe.html
Comment 12 Build Bot 2019-01-29 11:42:36 PST
Created attachment 360481 [details]
Archive of layout-test-results from ews102 for mac-highsierra

The attached test failures were seen while running run-webkit-tests on the mac-ews.
Bot: ews102  Port: mac-highsierra  Platform: Mac OS X 10.13.6
Comment 13 Build Bot 2019-01-29 11:55:06 PST
Comment on attachment 360472 [details]
Patch

Attachment 360472 [details] did not pass mac-wk2-ews (mac-wk2):
Output: https://webkit-queues.webkit.org/results/10940829

New failing tests:
compositing/iframes/scrolling-iframe.html
compositing/iframes/overlapped-nested-iframes.html
compositing/iframes/iframe-resize.html
compositing/tiling/tiled-drawing-async-frame-scrolling.html
compositing/iframes/connect-compositing-iframe-delayed.html
tiled-drawing/tile-coverage-iframe-to-zero-coverage.html
compositing/iframes/connect-compositing-iframe2.html
compositing/iframes/overlapped-iframe-iframe.html
compositing/iframes/remove-reinsert-webview-with-iframe.html
compositing/iframes/overlapped-iframe.html
compositing/visible-rect/iframe-with-layers-outside-viewport.html
compositing/visible-rect/iframe-and-layers.html
compositing/iframes/become-overlapped-iframe.html
compositing/iframes/page-cache-layer-tree.html
compositing/iframes/connect-compositing-iframe3.html
compositing/iframes/enter-compositing-iframe.html
compositing/iframes/resize-from-zero-size.html
compositing/iframes/connect-compositing-iframe.html
compositing/iframes/become-composited-nested-iframes.html
compositing/repaint/iframes/compositing-iframe-with-fixed-background-doc-repaint.html
compositing/iframes/composited-parent-iframe.html
compositing/iframes/invisible-nested-iframe-show.html
compositing/iframes/resizer.html
compositing/repaint/iframes/compositing-iframe-scroll-repaint.html
Comment 14 Build Bot 2019-01-29 11:55:08 PST
Created attachment 360483 [details]
Archive of layout-test-results from ews107 for mac-highsierra-wk2

The attached test failures were seen while running run-webkit-tests on the mac-wk2-ews.
Bot: ews107  Port: mac-highsierra-wk2  Platform: Mac OS X 10.13.6
Comment 15 Build Bot 2019-01-29 12:14:13 PST
Comment on attachment 360472 [details]
Patch

Attachment 360472 [details] did not pass mac-debug-ews (mac):
Output: https://webkit-queues.webkit.org/results/10940804

New failing tests:
compositing/iframes/scrolling-iframe.html
compositing/iframes/remove-reinsert-webview-with-iframe.html
compositing/iframes/overlapped-iframe.html
compositing/visible-rect/iframe-with-layers-outside-viewport.html
compositing/iframes/enter-compositing-iframe.html
compositing/iframes/iframe-resize.html
compositing/visible-rect/iframe-and-layers.html
compositing/iframes/composited-parent-iframe.html
compositing/iframes/invisible-nested-iframe-show.html
compositing/iframes/connect-compositing-iframe3.html
compositing/iframes/connect-compositing-iframe-delayed.html
compositing/iframes/page-cache-layer-tree.html
compositing/iframes/resizer.html
compositing/repaint/iframes/compositing-iframe-scroll-repaint.html
compositing/iframes/connect-compositing-iframe2.html
compositing/iframes/resize-from-zero-size.html
compositing/iframes/become-overlapped-iframe.html
compositing/iframes/connect-compositing-iframe.html
compositing/iframes/become-composited-nested-iframes.html
compositing/iframes/overlapped-iframe-iframe.html
compositing/repaint/iframes/compositing-iframe-with-fixed-background-doc-repaint.html
Comment 16 Build Bot 2019-01-29 12:14:15 PST
Created attachment 360486 [details]
Archive of layout-test-results from ews113 for mac-highsierra

The attached test failures were seen while running run-webkit-tests on the mac-debug-ews.
Bot: ews113  Port: mac-highsierra  Platform: Mac OS X 10.13.6
Comment 17 Build Bot 2019-01-29 12:37:41 PST
Comment on attachment 360472 [details]
Patch

Attachment 360472 [details] did not pass ios-sim-ews (ios-simulator-wk2):
Output: https://webkit-queues.webkit.org/results/10940972

New failing tests:
compositing/iframes/scrolling-iframe.html
compositing/iframes/overlapped-nested-iframes.html
compositing/iframes/iframe-resize.html
compositing/tiling/tiled-drawing-async-frame-scrolling.html
compositing/iframes/connect-compositing-iframe-delayed.html
compositing/rtl/rtl-iframe-fixed.html
compositing/iframes/overlapped-iframe-iframe.html
compositing/iframes/overlapped-iframe.html
compositing/visible-rect/iframe-with-layers-outside-viewport.html
compositing/visible-rect/iframe-and-layers.html
compositing/iframes/become-overlapped-iframe.html
compositing/iframes/page-cache-layer-tree.html
compositing/rtl/rtl-iframe-absolute.html
compositing/iframes/composited-parent-iframe.html
compositing/iframes/connect-compositing-iframe3.html
compositing/iframes/enter-compositing-iframe.html
compositing/iframes/leave-compositing-iframe.html
compositing/rtl/rtl-iframe-relative.html
http/wpt/service-workers/persistent-importScripts.html
compositing/iframes/resize-from-zero-size.html
compositing/iframes/connect-compositing-iframe.html
compositing/iframes/become-composited-nested-iframes.html
compositing/rtl/rtl-iframe-absolute-overflow.html
compositing/iframes/invisible-nested-iframe-show.html
compositing/iframes/resizer.html
compositing/iframes/connect-compositing-iframe2.html
Comment 18 Build Bot 2019-01-29 12:37:46 PST
Created attachment 360488 [details]
Archive of layout-test-results from ews122 for ios-simulator-wk2

The attached test failures were seen while running run-webkit-tests on the ios-sim-ews.
Bot: ews122  Port: ios-simulator-wk2  Platform: Mac OS X 10.13.6
Comment 19 Simon Fraser (smfr) 2019-01-29 13:29:57 PST
https://trac.webkit.org/changeset/240677/webkit
Comment 20 Truitt Savell 2019-01-29 16:49:06 PST
These two tests are failing after https://trac.webkit.org/changeset/240677/webkit

compositing/repaint/iframes/compositing-iframe-scroll-repaint.html 
compositing/repaint/iframes/compositing-iframe-with-fixed-background-doc-repaint.html


History:
https://webkit-test-results.webkit.org/dashboards/flakiness_dashboard.html#showAllRuns=true&tests=compositing%2Frepaint%2Fiframes%2Fcompositing-iframe-scroll-repaint.html%20compositing%2Frepaint%2Fiframes%2Fcompositing-iframe-with-fixed-background-doc-repaint.html

they are constant failure on High Sierra wk1
Comment 21 Simon Fraser (smfr) 2019-01-29 16:55:12 PST
They pass on Mojave. Please add new high Sierra baselines.
Comment 22 Truitt Savell 2019-01-29 17:14:49 PST
(In reply to Simon Fraser (smfr) from comment #21)
> They pass on Mojave. Please add new high Sierra baselines.

Expectations changed in https://trac.webkit.org/changeset/240694/webkit.
Comment 23 Michael Catanzaro 2019-01-31 08:37:45 PST
Committed r240788: <https://trac.webkit.org/changeset/240788>