Bug 194094 – Regression(PSON) Crash under WebProcessProxy::canTerminateChildProcess()

• Status: RESOLVED
• Resolution: FIXED
• Component: WebKit2

[Chris Dumez]

Crash under WebProcessProxy::canTerminateChildProcess():
Exception Type:  EXC_BAD_ACCESS (SIGSEGV)
Exception Subtype: KERN_INVALID_ADDRESS at 0x0000000000000018
VM Region Info: 0x18 is not in any region.  Bytes before following region: 4309712872
      REGION TYPE                      START - END             [ VSIZE] PRT/MAX SHRMOD  REGION DETAIL
      UNUSED SPACE AT START
--->  
      __TEXT                 0000000100e10000-0000000100fe8000 [ 1888K] r-x/r-x SM=COW  .../MobileSafari

Termination Signal: Segmentation fault: 11
Termination Reason: Namespace SIGNAL, Code 0xb
Terminating Process: exc handler [597]
Triggered by Thread:  0

Thread 0 name:  Dispatch queue: com.apple.main-thread
Thread 0 Crashed:
0   WebKit                        	0x00000001f1328c20 WebKit::WebProcessProxy::canTerminateChildProcess() + 48 (DumbPtrTraits.h:41)
1   WebKit                        	0x00000001f1327128 WebKit::WebProcessProxy::maybeShutDown() + 36 (WebProcessProxy.cpp:868)
2   WebKit                        	0x00000001f1327084 WebKit::WebProcessProxy::removeWebPage(WebKit::WebPageProxy&, unsigned long long, WebKit::WebProcessProxy::EndsUsingDataStore) + 124 (WebProcessProxy.cpp:473)
3   WebKit                        	0x00000001f12f5d00 WebKit::WebPageProxy::continueNavigationInNewProcess(API::Navigation&, std::__1::unique_ptr<WebKit::SuspendedPageProxy, std::__1::default_delete<WebKit::SuspendedPageProxy> >&&, WTF::Ref<WebKit::WebProcessProxy, WTF::DumbPtrTraits<WebKit::WebProcessProxy> >&&, WebKit::ProcessSwapRequestedByClient, WTF::Optional<WebKit::WebsitePoliciesData>&&) + 420 (WebPageProxy.cpp:2760)
4   WebKit                        	0x00000001f130d4f4 WTF::Function<void (WTF::Ref<WebKit::WebProcessProxy, WTF::DumbPtrTraits<WebKit::WebProcessProxy> >&&, WebKit::SuspendedPageProxy*, WTF::String const&)>::CallableWrapper<WebKit::WebPageProxy::receivedNavigationPolicyDecision(WebKit::WebPolicyAction, API::Navigation*, WebKit::ProcessSwapRequestedByClient, WebKit::WebFrameProxy&, API::WebsitePolicies*, WTF::Ref<WebKit::WebPageProxy::PolicyDecisionSender, WTF::DumbPtrTraits<WebKit::WebPageProxy::PolicyDecisionSender> >&&)::$_5>::call(WTF::Ref<WebKit::WebProcessProxy, WTF::DumbPtrTraits<WebKit::WebProcessProxy> >&&, WebKit::SuspendedPageProxy*, WTF::String const&) + 816 (WebPageProxy.cpp:2709)
5   WebKit                        	0x00000001f1332e08 WTF::Function<void (WTF::Ref<WebKit::WebProcessProxy, WTF::DumbPtrTraits<WebKit::WebProcessProxy> >&&, WebKit::SuspendedPageProxy*, WTF::String const&)>::CallableWrapper<WebKit::WebProcessPool::processForNavigation(WebKit::WebPageProxy&, API::Navigation const&, WebKit::ProcessSwapRequestedByClient, WTF::CompletionHandler<void (WTF::Ref<WebKit::WebProcessProxy, WTF::DumbPtrTraits<WebKit::WebProcessProxy> >&&, WebKit::SuspendedPageProxy*, WTF::String const&)>&&)::$_14>::call(WTF::Ref<WebKit::WebProcessProxy, WTF::DumbPtrTraits<WebKit::WebProcessProxy> >&&, WebKit::SuspendedPageProxy*, WTF::String const&) + 196 (Function.h:56)
6   WebKit                        	0x00000001f13330c0 WTF::Function<void (WebKit::SuspendedPageProxy*)>::CallableWrapper<WebKit::WebProcessPool::processForNavigationInternal(WebKit::WebPageProxy&, API::Navigation const&, WebKit::ProcessSwapRequestedByClient, WTF::CompletionHandler<void (WTF::Ref<WebKit::WebProcessProxy, WTF::DumbPtrTraits<WebKit::WebProcessProxy> >&&, WebKit::SuspendedPageProxy*, WTF::String const&)>&&)::$_15>::call(WebKit::SuspendedPageProxy*) + 348 (Function.h:56)
7   WebKit                        	0x00000001f12bfa54 WebKit::SuspendedPageProxy::~SuspendedPageProxy() + 72 (Function.h:56)
8   WebKit                        	0x00000001f12bfc4c WebKit::SuspendedPageProxy::~SuspendedPageProxy() + 12 (SuspendedPageProxy.cpp:93)
9   WebKit                        	0x00000001f132ee78 WTF::Deque<std::__1::unique_ptr<WebKit::SuspendedPageProxy, std::__1::default_delete<WebKit::SuspendedPageProxy> >, 0ul>::destroyAll() + 192 (memory:2321)
10  WebKit                        	0x00000001f1320d0c WTF::Deque<std::__1::unique_ptr<WebKit::SuspendedPageProxy, std::__1::default_delete<WebKit::SuspendedPageProxy> >, 0ul>::clear() + 20 (Deque.h:389)
11  WebKit                        	0x00000001f12cb0f0 WTF::Function<void (WTF::Critical, WTF::Synchronous)>::CallableWrapper<WebKit::installMemoryPressureHandler()::$_0>::call(WTF::Critical, WTF::Synchronous) + 60 (WebMemoryPressureHandlerCocoa.mm:49)
12  JavaScriptCore                	0x00000001e8dbdca8 WTF::MemoryPressureHandler::releaseMemory(WTF::Critical, WTF::Synchronous) + 92 (Function.h:56)
13  JavaScriptCore                	0x00000001e8dbe3bc invocation function for block in WTF::MemoryPressureHandler::install() + 140 (MemoryPressureHandlerCocoa.mm:192)
14  libdispatch.dylib             	0x00000001e0e457d4 _dispatch_client_callout + 16 (object.m:511)
15  libdispatch.dylib             	0x00000001e0dea018 _dispatch_continuation_pop$VARIANT$mp + 412 (inline_internal.h:2441)
16  libdispatch.dylib             	0x00000001e0df9fa4 _dispatch_source_invoke$VARIANT$mp + 1308 (source.c:568)
17  libdispatch.dylib             	0x00000001e0df2ee8 _dispatch_main_queue_callback_4CF$VARIANT$mp + 784 (inline_internal.h:2482)
18  CoreFoundation                	0x00000001e1391e7c __CFRUNLOOP_IS_SERVICING_THE_MAIN_DISPATCH_QUEUE__ + 12 (CFRunLoop.c:1813)
19  CoreFoundation                	0x00000001e138cdb0 __CFRunLoopRun + 1940 (CFRunLoop.c:3113)
20  CoreFoundation                	0x00000001e138c2fc CFRunLoopRunSpecific + 436 (CFRunLoop.c:3247)
21  GraphicsServices              	0x00000001e358d79c GSEventRunModal + 104 (GSEvent.c:2245)
22  UIKitCore                     	0x000000020ddf3558 UIApplicationMain + 212 (UIApplication.m:4353)
23  MobileSafari                  	0x0000000100e155a0 main + 1500 (main.m:121)
24  libdyld.dylib                 	0x00000001e0e55b80 start + 4

[Chris Dumez]

<rdar://problem/47580753>

[Chris Dumez]

Created attachment 360736 [details]
Patch

[WebKit Commit Bot]

Comment on attachment 360736 [details]
Patch

Clearing flags on attachment: 360736

Committed r240803: <https://trac.webkit.org/changeset/240803>

[WebKit Commit Bot]

All reviewed patches have been landed.  Closing bug.

[Chris Dumez]

Reopening as this seems to have caused API test failures on iOS:
https://build.webkit.org/builders/Apple%20iOS%2012%20Simulator%20Release%20WK2%20%28Tests%29/builds/2336

[Chris Dumez]

(In reply to Chris Dumez from comment #5)
> Reopening as this seems to have caused API test failures on iOS:
> https://build.webkit.org/builders/
> Apple%20iOS%2012%20Simulator%20Release%20WK2%20%28Tests%29/builds/2336

Actually, given the crashes, I strongly suspect this was caused by Jiewen's r240555:
Crashed

    TestWebKitAPI.ProcessSwap.CrossOriginSystemPreview
        Received data during response processing, queuing it.
        2019-01-31 15:44:39.513 TestWebKitAPI[84804:3453689] *** Terminating app due to uncaught exception 'NSInvalidArgumentException', reason: '[NSXPCConnection sendInvocation]: Block was not compiled using a compiler that inserts type information about arguments. (openAppLink:state:completionHandler:)'
        *** First throw call stack:
        (
        	0   CoreFoundation                      0x000000010b43cfb2 __exceptionPreprocess + 370
        	1   libobjc.A.dylib                     0x000000010b219ac5 objc_exception_throw + 48
        	2   Foundation                          0x000000010ae71954 -[NSXPCConnection _sendInvocation:orArguments:count:methodSignature:selector:withProxy:] + 4021
        	3   Foundation                          0x000000010ae70862 -[NSXPCConnection _sendSelector:withProxy:arg1:arg2:arg3:] + 133
        	4   Foundation                          0x000000010ae82b7e _NSXPCDistantObjectSimpleMessageSend3 + 57
        	5   CoreServices                        0x000000010b93be11 +[LSAppLink(Internal) _openWithAppLink:state:completionHandler:] + 279
        	6   CoreServices                        0x000000010b93aaf5 __66+[LSAppLink(QRCodes) openWithURL:configuration:completionHandler:]_block_invoke + 116
        	7   libdispatch.dylib                   0x000000010bc36ad0 _dispatch_call_block_and_release + 12
        	8   libdispatch.dylib                   0x000000010bc37c5e _dispatch_client_callout + 8
        	9   libdispatch.dylib                   0x000000010bc3e5fc _dispatch_lane_serial_drain + 672
        	10  libdispatch.dylib                   0x000000010bc3f0a0 _dispatch_lane_invoke + 444
        	11  libdispatch.dylib                   0x000000010bc494b7 _dispatch_workloop_worker_thread + 626
        	12  libsystem_pthread.dylib             0x000000010c03c60b _pthread_wqthread + 409
        	13  libsystem_pthread.dylib             0x000000010c03c405 start_wqthread + 13
        )
        libc++abi.dylib: terminating with uncaught exception of type NSException
        Child process terminated with signal 6: Abort trap


Unsure why Truitt accused me, Jiewen's patch is even the only patch in the range:
https://build.webkit.org/builders/Apple%20iOS%2012%20Simulator%20Release%20WK2%20%28Tests%29/builds/2336