Bug 200996 – Crash under NetworkCache::Data::mapToFile()

• Status: RESOLVED
• Resolution: FIXED
• Component: WebKit2

[Chris Dumez]

Exception Type:  EXC_BAD_ACCESS (SIGBUS)
Exception Subtype: KERN_MEMORY_ERROR at 0x0000000109d68000 FS pagein error: 1 Operation not permitted
VM Region Info: 0x109d68000 is in 0x109d5c000-0x109d6c000;  bytes after start: 49152  bytes before end: 16383
      REGION TYPE                      START - END             [ VSIZE] PRT/MAX SHRMOD  REGION DETAIL
      MALLOC_LARGE           0000000109d54000-0000000109d5c000 [   32K] rw-/rwx SM=PRV  
--->  mapped file            0000000109d5c000-0000000109d6c000 [   64K] rw-/rw- SM=PRV  ...t_id=c11c2d21
      GAP OF 0x4000 BYTES
      MALLOC_LARGE           0000000109d70000-0000000109d84000 [   80K] rw-/rwx SM=PRV  

Termination Signal: Bus error: 10
Termination Reason: Namespace SIGNAL, Code 0xa
Crash under NetworkCache::Data::mapToFile():

Terminating Process: exc handler [13072]
Triggered by Thread:  9

Thread 9 name:  Dispatch queue: com.apple.WebKit.Cache.Storage.background
Thread 9 Crashed:
0   libsystem_platform.dylib      	0x000000019d209548 _platform_memmove + 88
1   WebKit                        	0x00000001a4c1c10c WTF::Detail::CallableWrapper<WebKit::NetworkCache::Data::mapToFile(WTF::String const&) const::$_100, bool, unsigned char const*, unsigned long>::call(unsigned char const*, unsigned long) + 36 (NetworkCacheData.cpp:62)
2   WebKit                        	0x00000001a4b60f00 invocation function for block in WebKit::NetworkCache::Data::apply(WTF::Function<bool (unsigned char const*, unsigned long)> const&) const + 44 (Function.h:79)
3   libdispatch.dylib             	0x000000019d1d4024 _dispatch_data_apply_client_callout + 16 (data.c:559)
4   WebKit                        	0x00000001a4b60ebc WebKit::NetworkCache::Data::apply(WTF::Function<bool (unsigned char const*, unsigned long)> const&) const + 96 (NetworkCacheDataCocoa.mm:76)
5   WebKit                        	0x00000001a4c0bec8 WebKit::NetworkCache::Data::mapToFile(WTF::String const&) const + 216 (NetworkCacheData.cpp:61)
6   WebKit                        	0x00000001a4c0ba90 WebKit::NetworkCache::BlobStorage::add(WTF::String const&, WebKit::NetworkCache::Data const&) + 360 (NetworkCacheBlobStorage.cpp:109)
7   WebKit                        	0x00000001a4c28250 WebKit::NetworkCache::Storage::storeBodyAsBlob(WebKit::NetworkCache::Storage::WriteOperation&) + 92 (NetworkCacheStorage.cpp:524)
8   WebKit                        	0x00000001a4c32cac WTF::Detail::CallableWrapper<WebKit::NetworkCache::Storage::dispatchWriteOperation(std::__1::unique_ptr<WebKit::NetworkCache::Storage::WriteOperation, std::__1::default_delete<WebKit::NetworkCache::Storage::WriteOperation> >)::$_20, void>::call() + 144 (NetworkCacheStorage.cpp:808)
9   JavaScriptCore                	0x00000001ac377c20 WTF::BlockPtr<void ()> WTF::BlockPtr<void ()>::fromCallable<WTF::WorkQueue::dispatch(WTF::Function<void ()>&&)::$_0>(WTF::WorkQueue::dispatch(WTF::Function<void ()>&&)::$_0)::'lambda'(void*)::__invoke(void*) + 32 (Function.h:79)
10  libdispatch.dylib             	0x000000019d1a7c2c _dispatch_call_block_and_release + 32 (init.c:1408)
11  libdispatch.dylib             	0x000000019d1a9088 _dispatch_client_callout + 20 (object.m:495)
12  libdispatch.dylib             	0x000000019d1ab808 _dispatch_continuation_pop + 408 (inline_internal.h:2487)
13  libdispatch.dylib             	0x000000019d1aaf68 _dispatch_async_redirect_invoke + 596 (queue.c:800)
14  libdispatch.dylib             	0x000000019d1b7c50 _dispatch_root_queue_drain + 348 (inline_internal.h:2528)
15  libdispatch.dylib             	0x000000019d1b8400 _dispatch_worker_thread2 + 120 (queue.c:6563)
16  libsystem_pthread.dylib       	0x000000019d20ea64 _pthread_wqthread + 216 (pthread.c:2336)
17  libsystem_pthread.dylib       	0x000000019d214c7c start_wqthread + 8

[Radar WebKit Bug Importer]

<rdar://problem/54570421>

[Chris Dumez]

Created attachment 376918 [details]
Patch

[Geoffrey Garen]

Comment on attachment 376918 [details]
Patch

r=me

[WebKit Commit Bot]

Comment on attachment 376918 [details]
Patch

Clearing flags on attachment: 376918

Committed r248973: <https://trac.webkit.org/changeset/248973>

[WebKit Commit Bot]

All reviewed patches have been landed.  Closing bug.