Bug 197902 – Constant crashes under WebPage::isThrottleable() after r245299

• Status: RESOLVED
• Resolution: FIXED
• Component: WebKit2

[Tim Horton]

If you window.open (I can give you exact repro steps offline), you'll often crash under this stack:

WebKit::WebPage::isThrottleable() const
auto WebKit::WebProcess::areAllPagesThrottleable()
bool WTF::allOf<WTF::SizedIteratorRange<WTF::HashMap<unsigned long long, ...
WebKit::WebProcess::areAllPagesThrottleable() const
WebKit::WebSWClientConnection::updateThrottleState()
WebKit::WebPage::updateThrottleState()
WebKit::WebPage::WebPage(unsigned long long, WebKit::WebPageCreationParameters&&)
WebKit::WebPage::WebPage(unsigned long long, WebKit::WebPageCreationParameters&&) [inlined]
WebKit::WebPage::create(unsigned long long, WebKit::WebPageCreationParameters&&)
WebKit::WebProcess::createWebPage(unsigned long long, WebKit::WebPageCreationParameters&&)
void IPC::handleMessage<Messages::WebProcess::CreateWebPage, WebKit::WebProcess...

Because WebProcess::createWebPage has added an item to m_pageMap, and then areAllPagesThrottleable iterates m_pageMap before the new item has been assigned a value.

[Radar WebKit Bug Importer]

<rdar://problem/50793796>

[youenn fablet]

Created attachment 369924 [details]
Patch

[youenn fablet]

Created attachment 369951 [details]
Patch

[EWS Watchlist]

Comment on attachment 369951 [details]
Patch

Attachment 369951 [details] did not pass win-ews (win):
Output: https://webkit-queues.webkit.org/results/12197730

New failing tests:
fast/shadow-dom/svg-use-href-change-in-shadow-tree.html

[EWS Watchlist]

Created attachment 369956 [details]
Archive of layout-test-results from ews215 for win-future

The attached test failures were seen while running run-webkit-tests on the win-ews.
Bot: ews215  Port: win-future  Platform: CYGWIN_NT-10.0-17763-3.0.5-338.x86_64-x86_64-64bit

[youenn fablet]

Comment on attachment 369951 [details]
Patch

Win error unrelated

[WebKit Commit Bot]

Comment on attachment 369951 [details]
Patch

Clearing flags on attachment: 369951

Committed r245327: <https://trac.webkit.org/changeset/245327>

[WebKit Commit Bot]

All reviewed patches have been landed.  Closing bug.