Bug 210794 - WebKit.WebContent process crashes when web developer tools are opened in Safari
Summary: WebKit.WebContent process crashes when web developer tools are opened in Safari
Status: RESOLVED FIXED
Alias: None
Product: WebKit
Classification: Unclassified
Component: WebCore Misc. (show other bugs)
Version: Safari 13
Hardware: Unspecified Unspecified
: P2 Normal
Assignee: Devin Rousso
URL:
Keywords: InRadar
Depends on:
Blocks:
 
Reported: 2020-04-21 06:38 PDT by pmikolajczak
Modified: 2020-04-30 13:46 PDT (History)
10 users (show)

See Also:


Attachments
com.apple.WebKit.WebContent crash logs (193.78 KB, application/zip)
2020-04-21 06:38 PDT, pmikolajczak
no flags Details
Safari crash screen recording (4.61 MB, video/quicktime)
2020-04-22 23:03 PDT, pmikolajczak
no flags Details
[Patch] WIP (1.05 KB, patch)
2020-04-29 13:39 PDT, Devin Rousso
no flags Details | Formatted Diff | Diff
Patch (12.26 KB, patch)
2020-04-30 11:24 PDT, Devin Rousso
no flags Details | Formatted Diff | Diff
Patch (12.47 KB, patch)
2020-04-30 13:15 PDT, Devin Rousso
no flags Details | Formatted Diff | Diff

Note You need to log in before you can comment on or make changes to this bug.
Description pmikolajczak 2020-04-21 06:38:57 PDT
Created attachment 397076 [details]
com.apple.WebKit.WebContent crash logs

I am responsible for developing web conference app. My website crashes in Safari browser, but only when I have developer tools opened. After crash, content of the page is reloaded, at the top of the page message is displayed "This web page was reloaded because a problem occurred".

Few things I have noticed:
* I am not able to reproduce this issue on all devices.
* Crash only occurs in Safari. Chrome, Firefox works fine.
* As long developer tools are closed crash won't trigger.
* Currently I am using macOS Catalina 10.15.4 (19E287) but I was able to get crash also on macOS Sierra and older version of Safari.

Logs from macOS console in attachment. They show that com.apple.WebKit.WebContent process crashes.
Comment 1 Alexey Proskuryakov 2020-04-22 15:28:37 PDT
Happens on a worker thread. 

Thread[67] EXC_BREAKPOINT (SIGTRAP) (0x0000000000000002, 0x0000000000000000)
[  0] 0x00007fff33a960d3 JavaScriptCore`WTFCrashWithInfo(int, char const*, char const*, int) + 19 at Assertions.h:622:5
[  1] 0x00007fff33787185 JavaScriptCore`Inspector::InjectedScriptManager::injectedScriptFor(JSC::JSGlobalObject*) + 2133 at InjectedScriptManager.cpp:202:9
       198 	        if (stack.size() > 0)
       199 	            stack[0].computeLineAndColumn(line, column);
       200 	        WTFLogAlways("Error when creating injected script: %s (%d:%d)\n", error->value().toWTFString(globalObject).utf8().data(), line, column);
       201 	        WTFLogAlways("%s\n", injectedScriptSource().utf8().data());
    -> 202 	        RELEASE_ASSERT_NOT_REACHED();
       203 	    }
       204 	    if (!createResult.value()) {
       205 	        WTFLogAlways("Missing injected script object");
       206 	        WTFLogAlways("%s\n", injectedScriptSource().utf8().data());
    
[  2] 0x00007fff3f7bb846 WebCore`WebCore::InspectorDOMDebuggerAgent::willHandleEvent(WebCore::Event&, WebCore::RegisteredEventListener const&) + 86 at InspectorDOMDebuggerAgent.cpp:218:51
       214 	    if (!m_debuggerAgent->breakpointsActive())
       215 	        return;
       216 	
       217 	    auto state = event.target()->scriptExecutionContext()->execState();
    -> 218 	    auto injectedScript = m_injectedScriptManager.injectedScriptFor(state);
       219 	    ASSERT(!injectedScript.hasNoValue());
       220 	    {
       221 	        JSC::JSLockHolder lock(state);
       222 	
    
[  3] 0x00007fff3f3e809b WebCore`WebCore::EventTarget::innerInvokeEventListeners(WebCore::Event&, WTF::Vector<WTF::RefPtr<WebCore::RegisteredEventListener, WTF::DumbPtrTraits<WebCore::RegisteredEventListener> >, 1ul, WTF::CrashOnOverflow, 16ul, WTF::FastMalloc>, WebCore::EventTarget::EventInvokePhase) [inlined] WebCore::InspectorInstrumentation::willHandleEventImpl(WebCore::InstrumentingAgents&, WebCore::Event&, WebCore::RegisteredEventListener const&) + 59 at InspectorInstrumentation.cpp:415:27
       411 	    if (auto* webDebuggerAgent = instrumentingAgents.webDebuggerAgent())
       412 	        webDebuggerAgent->willHandleEvent(listener);
       413 	
       414 	    if (InspectorDOMDebuggerAgent* domDebuggerAgent = instrumentingAgents.inspectorDOMDebuggerAgent())
    -> 415 	        domDebuggerAgent->willHandleEvent(event, listener);
       416 	}
       417 	
       418 	void InspectorInstrumentation::didHandleEventImpl(InstrumentingAgents& instrumentingAgents)
       419 	{
Comment 2 Radar WebKit Bug Importer 2020-04-22 15:28:45 PDT
<rdar://problem/62214651>
Comment 3 Alexey Proskuryakov 2020-04-22 15:33:23 PDT
There should be some output going to the Console.app when this happens, could you please post it here? That would be "Error when creating injected script", and script content after it.

Also, is it possible at all to make and share a reproducible case?
Comment 4 pmikolajczak 2020-04-22 23:03:29 PDT
Created attachment 397322 [details]
Safari crash screen recording
Comment 5 pmikolajczak 2020-04-22 23:08:17 PDT
Here are logs from Console.app:

default	07:23:53.429732+0200	com.apple.WebKit.WebContent	AudioContext::willBeginPlayback(703282DBC9760CC7) returning false, not processing user gesture or capturing
default	07:23:53.674473+0200	hidd	[HID] [MT] dispatchEvent Dispatching event with 2 children, _eventMask=0x63 _childEventMask=0x62 Cancel=0 Touching=1 inRange=1
default	07:23:53.680335+0200	com.apple.WebKit.WebContent	AudioContext::willBeginPlayback(703282DBC9760CC7) returning false, not processing user gesture or capturing
default	07:23:53.894153+0200	hidd	[HID] [MT] dispatchEvent Dispatching event with 2 children, _eventMask=0x2 _childEventMask=0x2 Cancel=0 Touching=0 inRange=1
default	07:23:53.930664+0200	com.apple.WebKit.WebContent	AudioContext::willBeginPlayback(703282DBC9760CC7) returning false, not processing user gesture or capturing
default	07:23:54.123543+0200	com.apple.WebKit.WebContent	0x1101f5000 - [resourceLoader=0x110280900, frameLoader=0x1101dc780, frame=0x110772200, webPageID=33, frameID=25, resourceID=165] WebLoaderStrategy::scheduleLoad: URL will be scheduled with the NetworkProcess
default	07:23:54.123599+0200	com.apple.WebKit.WebContent	0x1101f5000 - [resourceLoader=0x110280900, frameLoader=0x1101dc780, frame=0x110772200, webPageID=33, frameID=25, resourceID=165] WebLoaderStrategy::scheduleLoad: Resource is being scheduled with the NetworkProcess (priority=2)
default	07:23:54.123677+0200	com.apple.WebKit.WebContent	Error when creating injected script: JavaScript execution terminated. (0:0)
default	07:23:54.123765+0200	com.apple.WebKit.Networking	0x10f6ff680 - [pageProxyID=32, webPageID=33, frameID=25, resourceID=165, isMainResource=0, isSynchronous=0] NetworkResourceLoader::startWithServiceWorker:
default	07:23:54.123792+0200	com.apple.WebKit.WebContent	//# sourceURL=__InjectedScript_InjectedScriptSource.js
(function(InjectedScriptHost,inspectedGlobalObject,injectedScriptId){var Object={}.constructor;function toString(obj)
{return String(obj);}
function toStringDescription(obj)
{if(obj===0&&1/obj<0)
return"-0";if(isBigInt(obj))
return toString(obj)+"n";return toString(obj);}
function isUInt32(obj)
{if(typeof obj==="number")
return obj>>>0===obj&&(obj>0||1/obj>0);return""+(obj>>>0)===obj;}
function isSymbol(value)
{return typeof value==="symbol";}
function isBigInt(value)
{return typeof value==="bigint";}
function isEmptyObject(object)
{for(let key in object)
return false;return true;}
function isDefined(value)
{return!!value||InjectedScriptHost.isHTMLAllCollection(value);}
function isPrimitiveValue(value)
{switch(typeof value){case"boolean":case"number":case"string":return true;case"undefined":return!InjectedScriptHost.isHTMLAllCollection(value);default:return false;}}
let InjectedScript=class InjectedScript
{constructor()
{this._lastBoundObjectId=1<…>
default	07:23:54.123893+0200	kernel	AMFI: SIP is off, allowing core dump for pid 62598
default	07:23:54.123816+0200	com.apple.WebKit.Networking	0x10f6ff680 - [pageProxyID=32, webPageID=33, frameID=25, resourceID=165, isMainResource=0, isSynchronous=0] NetworkResourceLoader::serviceWorkerDidNotHandle: (fetchIdentifier=0)
default	07:23:54.123845+0200	com.apple.WebKit.Networking	0x10f6ff680 - [pageProxyID=32, webPageID=33, frameID=25, resourceID=165, isMainResource=0, isSynchronous=0] NetworkResourceLoader::start: parentPID=62556, hasNetworkLoadChecker=1
default	07:23:54.123893+0200	com.apple.WebKit.Networking	0x10f6ff680 - [pageProxyID=32, webPageID=33, frameID=25, resourceID=165, isMainResource=0, isSynchronous=0] NetworkResourceLoader::start: NetworkLoadChecker::check is done
default	07:23:54.123927+0200	com.apple.WebKit.Networking	0x10f6ff680 - [pageProxyID=32, webPageID=33, frameID=25, resourceID=165, isMainResource=0, isSynchronous=0] NetworkResourceLoader::startNetworkLoad: (isFirstLoad=1, timeout=2147483647.000000)
default	07:23:54.124330+0200	Safari	0x113aa7300 - WebProcessProxy didClose (web process crash)
default	07:23:54.123969+0200	com.apple.WebKit.Networking	0x10f6ff680 - [pageProxyID=32, webPageID=33, frameID=25, resourceID=165, isMainResource=0, isSynchronous=0] NetworkResourceLoader::startNetworkLoad: Going to the network (description=)
default	07:23:54.124473+0200	Safari	0x7faf77822220 - [pageProxyID=32, webPageID=33, PID=62598] WebPageProxy::processDidTerminate: (pid 62598), reason 3
default	07:23:54.124209+0200	com.apple.WebKit.Networking	0x10f6ff680 - [pageProxyID=32, webPageID=33, frameID=25, resourceID=165, isMainResource=0, isSynchronous=0] NetworkResourceLoader::didReceiveResponse: (httpStatusCode=200, MIMEType=text/javascript, expectedContentLength=212, hasCachedEntryForValidation=0, hasNetworkLoadChecker=1)
default	07:23:54.124263+0200	com.apple.WebKit.Networking	0x10f6ff680 - [pageProxyID=32, webPageID=33, frameID=25, resourceID=165, isMainResource=0, isSynchronous=0] NetworkResourceLoader::didReceiveResponse: Sending WebResourceLoader::DidReceiveResponse IPC (willWaitForContinueDidReceiveResponse=0)
default	07:23:54.124368+0200	com.apple.WebKit.Networking	0x10f6ff680 - [pageProxyID=32, webPageID=33, frameID=25, resourceID=165, isMainResource=0, isSynchronous=0] NetworkResourceLoader::didReceiveResponse: Using response
default	07:23:54.124563+0200	com.apple.WebKit.Networking	0x10f6ff680 - [pageProxyID=32, webPageID=33, frameID=25, resourceID=165, isMainResource=0, isSynchronous=0] NetworkResourceLoader::didReceiveBuffer: Started receiving data (reportedEncodedDataLength=212)
default	07:23:54.124614+0200	com.apple.WebKit.Networking	0x10f6ff680 - [pageProxyID=32, webPageID=33, frameID=25, resourceID=165, isMainResource=0, isSynchronous=0] NetworkResourceLoader::didFinishLoading: (numBytesReceived=212, hasCacheEntryForValidation=0)
default	07:23:54.124752+0200	com.apple.WebKit.Networking	0x10f6ff680 - [pageProxyID=32, webPageID=33, frameID=25, resourceID=165, isMainResource=0, isSynchronous=0] NetworkResourceLoader::tryStoreAsCacheEntry: Not storing cache entry because request is not eligible
default	07:23:54.124895+0200	com.apple.WebKit.Networking	0x10f6ff680 - [pageProxyID=32, webPageID=33, frameID=25, resourceID=165, isMainResource=0, isSynchronous=0] NetworkResourceLoader::cleanup: (result=1)
default	07:23:54.125696+0200	com.apple.WebKit.Networking	TCP Conn 0x7f8076b3f340 canceled
default	07:23:54.126729+0200	Safari	WebMediaSessionManager::removeAllPlaybackTargetPickerClients 29 { IsNotPlaying }
default	07:23:54.126756+0200	Safari	WebMediaSessionManager::removeAllPlaybackTargetPickerClients 28 { HasAudioOrVideo }
default	07:23:54.125741+0200	com.apple.WebKit.Networking	[C35 6F79B883-6EB6-4BBC-9909-589959C4325D Hostname#17663dc7:443 tcp, pid: 62556, legacy-socket] cancel
default	07:23:54.126776+0200	Safari	WebMediaSessionManager::removeAllPlaybackTargetPickerClients 27 { HasAudioOrVideo }
default	07:23:54.126791+0200	Safari	WebMediaSessionManager::removeAllPlaybackTargetPickerClients 26 { HasAudioOrVideo }
default	07:23:54.126804+0200	Safari	WebMediaSessionManager::removeAllPlaybackTargetPickerClients 25 { HasAudioOrVideo }
default	07:23:54.126816+0200	Safari	WebMediaSessionManager::removeAllPlaybackTargetPickerClients 24 { IsNotPlaying }
default	07:23:54.126049+0200	com.apple.WebKit.Networking	[C35 6F79B883-6EB6-4BBC-9909-589959C4325D Hostname#17663dc7:443 tcp, pid: 62556, legacy-socket] cancelled
	[C35.1 C190731D-6400-4CD3-88FC-5A9D09231AF5 192.168.0.52:62280<->IPv4#290e7320:443]
	Connected Path: satisfied (Path is satisfied), interface: en0, ipv4, ipv6, dns
	Duration: 30.930s, DNS @0.000s took 0.047s, TCP @0.048s took 0.136s
	bytes in/out: 29454/11156, packets in/out: 67/34, rtt: 0.142s, retransmitted packets: 0, out-of-order packets: 0
default	07:23:54.126832+0200	Safari	WebMediaSessionManager::removeAllPlaybackTargetPickerClients 23 { HasAudioOrVideo }
default	07:23:54.126162+0200	com.apple.WebKit.Networking	0.000s [C35 6BEFCF24-1273-4BB1-AC88-D6BC21C26B96 Hostname#17663dc7:443 resolver path=satisfied (Path is satisfied), interface: en0, ipv4, ipv6, dns] path:start
default	07:23:54.126900+0200	Safari	WebMediaSessionManager::removeAllPlaybackTargetPickerClients 22 { HasAudioOrVideo }
default	07:23:54.126324+0200	com.apple.WebKit.Networking	0.000s [C35 6BEFCF24-1273-4BB1-AC88-D6BC21C26B96 Hostname#17663dc7:443 resolver path=satisfied (Path is satisfied), interface: en0, ipv4, ipv6, dns] path:satisfied
default	07:23:54.127008+0200	Safari	WebMediaSessionManager::removeAllPlaybackTargetPickerClients 21 { HasAudioOrVideo }
default	07:23:54.127055+0200	Safari	WebMediaSessionManager::removeAllPlaybackTargetPickerClients 20 { HasAudioOrVideo }
default	07:23:54.127136+0200	Safari	WebMediaSessionManager::removeAllPlaybackTargetPickerClients 19 { IsNotPlaying }
default	07:23:54.126491+0200	com.apple.WebKit.Networking	0.000s [C35 6BEFCF24-1273-4BB1-AC88-D6BC21C26B96 Hostname#17663dc7:443 resolver path=satisfied (Path is satisfied), interface: en0, ipv4, ipv6, dns] resolver:start_dns
default	07:23:54.127191+0200	Safari	WebMediaSessionManager::removeAllPlaybackTargetPickerClients 18 { HasAudioOrVideo }
default	07:23:54.126626+0200	com.apple.WebKit.Networking	0.047s [C35 6BEFCF24-1273-4BB1-AC88-D6BC21C26B96 Hostname#17663dc7:443 resolver path=satisfied (Path is satisfied), interface: en0, ipv4, ipv6, dns] resolver:receive_dns
default	07:23:54.127262+0200	Safari	WebMediaSessionManager::removeAllPlaybackTargetPickerClients 17 { HasAudioOrVideo }
default	07:23:54.126750+0200	com.apple.WebKit.Networking	0.047s [C35.1 C190731D-6400-4CD3-88FC-5A9D09231AF5 192.168.0.52:62280<->IPv4#290e7320:443 socket-flow path=satisfied (Path is satisfied), interface: en0, ipv4, ipv6, dns] path:start
default	07:23:54.127311+0200	Safari	WebMediaSessionManager::removeAllPlaybackTargetPickerClients 16 { HasAudioOrVideo }
default	07:23:54.126974+0200	com.apple.WebKit.Networking	0.047s [C35.1 C190731D-6400-4CD3-88FC-5A9D09231AF5 192.168.0.52:62280<->IPv4#290e7320:443 socket-flow path=satisfied (Path is satisfied), interface: en0, ipv4, ipv6, dns] path:satisfied
default	07:23:54.127422+0200	Safari	WebMediaSessionManager::removeAllPlaybackTargetPickerClients 15 { HasAudioOrVideo }
default	07:23:54.127538+0200	Safari	WebMediaSessionManager::removeAllPlaybackTargetPickerClients 12 { HasAudioOrVideo }
default	07:23:54.127693+0200	runningboardd	[xpcservice<com.apple.WebKit.WebContent(501)>:62598] Death sentinel fired!
default	07:23:54.127211+0200	com.apple.WebKit.Networking	0.048s [C35.1 C190731D-6400-4CD3-88FC-5A9D09231AF5 192.168.0.52:62280<->IPv4#290e7320:443 socket-flow path=satisfied (Path is satisfied), interface: en0, ipv4, ipv6, dns] flow:start_connect
default	07:23:54.127656+0200	Safari	WebMediaSessionManager::removeAllPlaybackTargetPickerClients 11 { HasAudioOrVideo }
default	07:23:54.127419+0200	com.apple.WebKit.Networking	0.184s [C35.1 C190731D-6400-4CD3-88FC-5A9D09231AF5 192.168.0.52:62280<->IPv4#290e7320:443 socket-flow path=satisfied (Path is satisfied), interface: en0, ipv4, ipv6, dns] flow:finish_connect
default	07:23:54.127708+0200	Safari	WebMediaSessionManager::removeAllPlaybackTargetPickerClients 10 { HasAudioOrVideo }
default	07:23:54.127558+0200	com.apple.WebKit.Networking	0.184s [C35 6BEFCF24-1273-4BB1-AC88-D6BC21C26B96 Hostname#17663dc7:443 resolver path=satisfied (Path is satisfied), interface: en0, ipv4, ipv6, dns] flow:finish_connect
default	07:23:54.127767+0200	Safari	WebMediaSessionManager::removeAllPlaybackTargetPickerClients 9 { IsNotPlaying }
default	07:23:54.127685+0200	com.apple.WebKit.Networking	0.184s [C35.1 C190731D-6400-4CD3-88FC-5A9D09231AF5 192.168.0.52:62280<->IPv4#290e7320:443 socket-flow path=satisfied (Path is satisfied), interface: en0, ipv4, ipv6, dns] flow:changed_viability
default	07:23:54.127882+0200	Safari	WebMediaSessionManager::removeAllPlaybackTargetPickerClients 8 { HasAudioOrVideo }
default	07:23:54.127877+0200	com.apple.WebKit.Networking	0.184s [C35 6BEFCF24-1273-4BB1-AC88-D6BC21C26B96 Hostname#17663dc7:443 resolver path=satisfied (Path is satisfied), interface: en0, ipv4, ipv6, dns] flow:changed_viability
default	07:23:54.128014+0200	com.apple.WebKit.Networking	30.930s [C35] path:cancel
default	07:23:54.128045+0200	Safari	WebMediaSessionManager::removeAllPlaybackTargetPickerClients 7 { HasAudioOrVideo }
error	07:23:54.129301+0200	dprivacyd	<private>: Disabled by D&U switch
default	07:23:54.128213+0200	Safari	WebMediaSessionManager::removeAllPlaybackTargetPickerClients 6 { HasAudioOrVideo }
default	07:23:54.128921+0200	powerd	Process coreaudiod.196 Released PreventUserIdleDisplaySleep "com.apple.audio.context3398.preventuseridledisplaysleep" age:00:02:51  id:21474879257 [System: PrevIdle DeclUser kDisp]
default	07:23:54.128369+0200	Safari	WebMediaSessionManager::removeAllPlaybackTargetPickerClients 5 { HasAudioOrVideo }
default	07:23:54.129153+0200	powerd	Process coreaudiod.196 Released PreventUserIdleSystemSleep "com.apple.audio.context3398.preventuseridlesleep" age:00:02:51  id:4295010072 [System: PrevIdle DeclUser kDisp]
default	07:23:54.128437+0200	Safari	WebMediaSessionManager::removeAllPlaybackTargetPickerClients 4 { IsNotPlaying }
default	07:23:54.128703+0200	Safari	WebMediaSessionManager::removeAllPlaybackTargetPickerClients 3 { HasAudioOrVideo }
default	07:23:54.128972+0200	com.apple.WebKit.Networking	nw_flow_disconnected [C35.1 IPv4#290e7320:443 cancelled socket-flow ((null))] Output protocol disconnected
default	07:23:54.128849+0200	Safari	WebMediaSessionManager::removeAllPlaybackTargetPickerClients 2 { IsNotPlaying }
default	07:23:54.129100+0200	Safari	0x7faf77822220 - [pageProxyID=32, webPageID=33, PID=62598] WebPageProxy::dispatchProcessDidTerminate: reason = 3
default	07:23:54.129219+0200	com.apple.WebKit.Networking	nw_connection_report_state_with_handler_on_nw_queue [C35] reporting state cancelled
error	07:23:54.129189+0200	Safari	Process (pid: 0) for committed URL did exit
default	07:23:54.129699+0200	Safari	0x7faf77822220 - [pageProxyID=32, webPageID=33, PID=62598] WebPageProxy::reload:
default	07:23:54.129806+0200	Safari	0x7faf77822220 - [pageProxyID=32, webPageID=33, PID=62598] WebPageProxy::launchProcessForReload:
default	07:23:54.129887+0200	Safari	0x7faf77822220 - [pageProxyID=32, webPageID=33, PID=62598] WebPageProxy::launchProcess:llu
default	07:23:54.130265+0200	Safari	0x7faf75024c08 - WebProcessPool::processForRegistrableDomain: Using prewarmed process (process=0x10c6dc300, PID=62604)
default	07:23:54.131325+0200	ReportCrash	Parsing corpse data for pid 62598
default	07:23:54.131465+0200	ReportCrash	Parsing corpse data for process com.apple.WebKit [pid 62598]
error	07:23:54.131654+0200	webinspectord	XPC Connection Failed for Application: 62598 - PID:62598 - <private>
default	07:23:54.131709+0200	webinspectord	Application Disconnected: 62598 - PID:62598 - <private>
default	07:23:54.145370+0200	Safari	0x113aa7498 - [PID=0] ProcessThrottler::invalidateAllActivities: BEGIN
default	07:23:54.145386+0200	Safari	0x113aa7498 - [PID=0] ProcessThrottler::invalidateAllActivities: END
default	07:23:54.145634+0200	Safari	Target (CURRENTMACHINE) Application (PID:62598) Removed Debuggable (3557DDF9-72B5-4DA3-934A-87CE8AD1E742)
default	07:23:54.145661+0200	Safari	Target (CURRENTMACHINE) Application (PID:62556) Removed Debuggable (3557DDF9-72B5-4DA3-934A-87CE8AD1E742)
default	07:23:54.145683+0200	Safari	Target (CURRENTMACHINE) Removed Application (PID:62598)
default	07:23:54.157562+0200	mediaremoted	Client <MRDMediaRemoteClient 0x7f9cc3e28040, bundleIdentifier = com.apple.WebKit.WebContent, pid = 62598> invalidated.
default	07:23:54.157608+0200	launchservicesd	QUITTING: pid=62598 asn=0x-0xb12b12 foreground=0 wasFront=0
default	07:23:54.157623+0200	mediaremoted	[MRDAgentServer] Clearing agent <private>
default	07:23:54.158148+0200	mediaremoted	[MRDNowPlayingOriginClient] Removing nowPlayingClient <_MRNowPlayingClientProtobuf: 0x7f9cc3c095a0> {
    bundleIdentifier = "com.apple.WebKit.WebContent";
    nowPlayingVisibility = NeverVisible;
    processIdentifier = 62598;
    processUserIdentifier = 501;
} for origin-pmikolajczak.local-1280262988/client--0/player-(null)
error	07:23:54.158320+0200	ReportCrash	Invalid receipt [0 bytes]
default	07:23:54.158518+0200	kernel	Sandbox: 8 duplicate reports for com.apple.WebKit deny(1) mach-lookup com.apple.CoreDisplay.Notification
default	07:23:54.158528+0200	kernel	Sandbox: com.apple.WebKit(62604) allow iokit-open RootDomainUserClient
default	07:23:54.159637+0200	loginwindow	-[PersistentAppsSupport applicationQuit:] | for app:com.apple.WebKit.WebContent, _appTrackingState = 2



How do I test atm:
* I open Safari and visit https://app.livewebinar.com/safari-crash-test
* I enter some nickname
* I open web developer tools (alt+cmd+i), interact with page, for example type something in chat box.
* I might take a bit, but after some time Safari tab crashes

I have attached movie recording of this issue.

Also I am not sure what part of the code is responsible for this crash so at the moment it is hard to provide simple test sample to reproduce it.
Comment 6 Blaze Burg 2020-04-27 10:29:18 PDT
I'm able to reproduce this readily and continue to investigate a fix. Thank you for the detailed logs and live test case! 🙏🏼✨
Comment 7 Devin Rousso 2020-04-29 13:39:09 PDT
Created attachment 397995 [details]
[Patch] WIP

Speculative fix that seems to work.

Before this change, this was the order of events by adding `WTFReportBacktrace();` inside
 - the lambda given to the `ScriptExecutionContext::Task` created in `WorkerMessagingProxy::postMessageToWorkerGlobalScope`
 - in `WorkerScriptController::scheduleExecutionTermination` right before `m_isTerminatingExecution = true;`
 - in `WorkerScriptController::isTerminatingExecution` right before `return m_isTerminatingExecution;`

>>> m_isTerminatingExecution == false
1   0x1975840f5 WebCore::WorkerScriptController::isTerminatingExecution() const
2   0x1996ba5ad WebCore::WorkerRunLoop::Task::performTask(WebCore::WorkerGlobalScope*)
3   0x1996b9ad7 WebCore::WorkerRunLoop::runInMode(WebCore::WorkerGlobalScope*, WebCore::ModePredicate const&, WebCore::WorkerRunLoop::WaitMode)
4   0x1996b96d8 WebCore::WorkerRunLoop::run(WebCore::WorkerGlobalScope*)
5   0x1996bd518 WebCore::WorkerThread::runEventLoop()
6   0x19969e634 WebCore::DedicatedWorkerThread::runEventLoop()
7   0x1996bcfe1 WebCore::WorkerThread::workerThread()
8   0x1996d0118 WebCore::WorkerThread::start(WTF::Function<void (WTF::String const&)>&&)::$_16::operator()() const
9   0x1996d00ce WTF::Detail::CallableWrapper<WebCore::WorkerThread::start(WTF::Function<void (WTF::String const&)>&&)::$_16, void>::call()
10  0x1b06e5792 WTF::Function<void ()>::operator()() const
11  0x1b078be58 WTF::Thread::entryPoint(WTF::Thread::NewThreadContext*)
12  0x1b0797588 WTF::wtfThreadEntryPoint(void*)
13  0x7fff6bc80109 _pthread_start
14  0x7fff6bc7bb8b thread_start
>>> m_askedToTerminate == true



>>> m_isTerminatingExecution = true
1   0x1975842fe WebCore::WorkerScriptController::scheduleExecutionTermination()
2   0x1996b8ce2 WebCore::WorkerThread::stop(WTF::Function<void ()>&&)
3   0x1996b91b0 WebCore::WorkerMessagingProxy::terminateWorkerGlobalScope()
4   0x19969f7f4 WebCore::Worker::terminate()
5   0x1968ede4e WebCore::jsWorkerPrototypeFunctionTerminateBody(JSC::JSGlobalObject*, JSC::CallFrame*, WebCore::JSWorker*, JSC::ThrowScope&)
6   0x196868932 long long WebCore::IDLOperation<WebCore::JSWorker>::call<&(WebCore::jsWorkerPrototypeFunctionTerminateBody(JSC::JSGlobalObject*, JSC::CallFrame*, WebCore::JSWorker*, JSC::ThrowScope&)), (WebCore::CastedThisErrorBehavior)0>(JSC::JSGlobalObject&, JSC::CallFrame&, char const*)
7   0x196868614 WebCore::jsWorkerPrototypeFunctionTerminate(JSC::JSGlobalObject*, JSC::CallFrame*)
8   0x5a8095e011d8
9   0x1b0bdee3f llint_entry
10  0x1b0bbf763 vmEntryToJavaScript
11  0x1b197d277 JSC::JITCode::execute(JSC::VM*, JSC::ProtoCallFrame*)
12  0x1b197d9f1 JSC::Interpreter::executeCall(JSC::JSGlobalObject*, JSC::JSObject*, JSC::CallData const&, JSC::JSValue, JSC::ArgList const&)
13  0x1b1cd51ad JSC::call(JSC::JSGlobalObject*, JSC::JSValue, JSC::CallData const&, JSC::JSValue, JSC::ArgList const&)
14  0x1b1cd528f JSC::call(JSC::JSGlobalObject*, JSC::JSValue, JSC::CallData const&, JSC::JSValue, JSC::ArgList const&, WTF::NakedPtr<JSC::Exception>&)
15  0x1b1cd5572 JSC::profiledCall(JSC::JSGlobalObject*, JSC::ProfilingReason, JSC::JSValue, JSC::CallData const&, JSC::JSValue, JSC::ArgList const&, WTF::NakedPtr<JSC::Exception>&)
16  0x1974c77de WebCore::JSExecState::profiledCall(JSC::JSGlobalObject*, JSC::ProfilingReason, JSC::JSValue, JSC::CallData const&, JSC::JSValue, JSC::ArgList const&, WTF::NakedPtr<JSC::Exception>&)
17  0x1974e43bc WebCore::JSEventListener::handleEvent(WebCore::ScriptExecutionContext&, WebCore::Event&)
18  0x197b33a57 WebCore::EventTarget::innerInvokeEventListeners(WebCore::Event&, WTF::Vector<WTF::RefPtr<WebCore::RegisteredEventListener, WTF::DumbPtrTraits<WebCore::RegisteredEventListener> >, 1ul, WTF::CrashOnOverflow, 16ul, WTF::FastMalloc>, WebCore::EventTarget::EventInvokePhase)
19  0x197b2fd60 WebCore::EventTarget::fireEventListeners(WebCore::Event&, WebCore::EventTarget::EventInvokePhase)
20  0x197ba6002 WebCore::Node::handleLocalEvents(WebCore::Event&, WebCore::EventTarget::EventInvokePhase)
21  0x197b1e4a1 WebCore::EventContext::handleLocalEvents(WebCore::Event&, WebCore::EventTarget::EventInvokePhase) const
22  0x197b1e6db WebCore::MouseOrFocusEventContext::handleLocalEvents(WebCore::Event&, WebCore::EventTarget::EventInvokePhase) const
23  0x197b1ef6f WebCore::dispatchEventInDOM(WebCore::Event&, WebCore::EventPath const&)
24  0x197b1eaa7 WebCore::EventDispatcher::dispatchEvent(WebCore::Node&, WebCore::Event&)
25  0x197ba605d WebCore::Node::dispatchEvent(WebCore::Event&)
26  0x197ad573e WebCore::Element::dispatchMouseEvent(WebCore::PlatformMouseEvent const&, WTF::AtomString const&, int, WebCore::Element*)
27  0x19869aa1d WebCore::EventHandler::dispatchMouseEvent(WTF::AtomString const&, WebCore::Node*, bool, int, WebCore::PlatformMouseEvent const&, bool)
28  0x19869d8e4 WebCore::EventHandler::handleMouseReleaseEvent(WebCore::PlatformMouseEvent const&)
29  0x199284923 WebCore::UserInputBridge::handleMouseReleaseEvent(WebCore::PlatformMouseEvent const&, WebCore::InputSource)
30  0x1898b6847 WebKit::handleMouseEvent(WebKit::WebMouseEvent const&, WebKit::WebPage*)
31  0x1898b6609 WebKit::WebPage::mouseEvent(WebKit::WebMouseEvent const&)



>>> m_isTerminatingExecution == true
1   0x1975840f5 WebCore::WorkerScriptController::isTerminatingExecution() const
2   0x1974e447e WebCore::JSEventListener::handleEvent(WebCore::ScriptExecutionContext&, WebCore::Event&)
3   0x197b33a57 WebCore::EventTarget::innerInvokeEventListeners(WebCore::Event&, WTF::Vector<WTF::RefPtr<WebCore::RegisteredEventListener, WTF::DumbPtrTraits<WebCore::RegisteredEventListener> >, 1ul, WTF::CrashOnOverflow, 16ul, WTF::FastMalloc>, WebCore::EventTarget::EventInvokePhase)
4   0x197b2fd60 WebCore::EventTarget::fireEventListeners(WebCore::Event&, WebCore::EventTarget::EventInvokePhase)
5   0x197b3354d WebCore::EventTarget::dispatchEvent(WebCore::Event&)
6   0x1996c5b2f WebCore::WorkerMessagingProxy::postMessageToWorkerGlobalScope(WebCore::MessageWithMessagePorts&&)::$_5::operator()(WebCore::ScriptExecutionContext&)
7   0x1996c58f3 WTF::Detail::CallableWrapper<WebCore::WorkerMessagingProxy::postMessageToWorkerGlobalScope(WebCore::MessageWithMessagePorts&&)::$_5, void, WebCore::ScriptExecutionContext&>::call(WebCore::ScriptExecutionContext&)
8   0x19735f44a WTF::Function<void (WebCore::ScriptExecutionContext&)>::operator()(WebCore::ScriptExecutionContext&) const
9   0x19734abdd WebCore::ScriptExecutionContext::Task::performTask(WebCore::ScriptExecutionContext&)
10  0x1996ba5e0 WebCore::WorkerRunLoop::Task::performTask(WebCore::WorkerGlobalScope*)
11  0x1996b9ad7 WebCore::WorkerRunLoop::runInMode(WebCore::WorkerGlobalScope*, WebCore::ModePredicate const&, WebCore::WorkerRunLoop::WaitMode)
12  0x1996b96d8 WebCore::WorkerRunLoop::run(WebCore::WorkerGlobalScope*)
13  0x1996bd518 WebCore::WorkerThread::runEventLoop()
14  0x19969e634 WebCore::DedicatedWorkerThread::runEventLoop()
15  0x1996bcfe1 WebCore::WorkerThread::workerThread()
16  0x1996d0118 WebCore::WorkerThread::start(WTF::Function<void (WTF::String const&)>&&)::$_16::operator()() const
17  0x1996d00ce WTF::Detail::CallableWrapper<WebCore::WorkerThread::start(WTF::Function<void (WTF::String const&)>&&)::$_16, void>::call()
18  0x1b06e5792 WTF::Function<void ()>::operator()() const
19  0x1b078be58 WTF::Thread::entryPoint(WTF::Thread::NewThreadContext*)
20  0x1b0797588 WTF::wtfThreadEntryPoint(void*)
21  0x7fff6bc80109 _pthread_start
22  0x7fff6bc7bb8b thread_start



SHOULD NEVER BE REACHED
./bindings/ScriptValue.cpp(45) : RefPtr<JSON::Value> Inspector::jsToInspectorValue(JSC::JSGlobalObject *, JSC::JSValue, int)
1   0x1b06be9e9 WTFCrash
2   0x1b0e031bb WTFCrashWithInfo(int, char const*, char const*, int)
3   0x1b100b193 Inspector::jsToInspectorValue(JSC::JSGlobalObject*, JSC::JSValue, int)
4   0x1b100b0f9 Inspector::toInspectorValue(JSC::JSGlobalObject*, JSC::JSValue)
5   0x1b184c920 Inspector::InjectedScriptBase::makeCall(Deprecated::ScriptFunctionCall&)
6   0x1b184ee10 Inspector::InjectedScript::clearEventValue()
7   0x1b185160a Inspector::InjectedScriptManager::clearEventValue()
8   0x1982df1f9 WebCore::InspectorDOMDebuggerAgent::didHandleEvent()
9   0x198218e41 WebCore::InspectorInstrumentation::didHandleEventImpl(WebCore::InstrumentingAgents&)
10  0x197b33f9a WebCore::InspectorInstrumentation::didHandleEvent(WebCore::ScriptExecutionContext&)
11  0x197b33a60 WebCore::EventTarget::innerInvokeEventListeners(WebCore::Event&, WTF::Vector<WTF::RefPtr<WebCore::RegisteredEventListener, WTF::DumbPtrTraits<WebCore::RegisteredEventListener> >, 1ul, WTF::CrashOnOverflow, 16ul, WTF::FastMalloc>, WebCore::EventTarget::EventInvokePhase)
12  0x197b2fd60 WebCore::EventTarget::fireEventListeners(WebCore::Event&, WebCore::EventTarget::EventInvokePhase)
13  0x197b3354d WebCore::EventTarget::dispatchEvent(WebCore::Event&)
14  0x1996c5b2f WebCore::WorkerMessagingProxy::postMessageToWorkerGlobalScope(WebCore::MessageWithMessagePorts&&)::$_5::operator()(WebCore::ScriptExecutionContext&)
15  0x1996c58f3 WTF::Detail::CallableWrapper<WebCore::WorkerMessagingProxy::postMessageToWorkerGlobalScope(WebCore::MessageWithMessagePorts&&)::$_5, void, WebCore::ScriptExecutionContext&>::call(WebCore::ScriptExecutionContext&)
16  0x19735f44a WTF::Function<void (WebCore::ScriptExecutionContext&)>::operator()(WebCore::ScriptExecutionContext&) const
17  0x19734abdd WebCore::ScriptExecutionContext::Task::performTask(WebCore::ScriptExecutionContext&)
18  0x1996ba5e0 WebCore::WorkerRunLoop::Task::performTask(WebCore::WorkerGlobalScope*)
19  0x1996b9ad7 WebCore::WorkerRunLoop::runInMode(WebCore::WorkerGlobalScope*, WebCore::ModePredicate const&, WebCore::WorkerRunLoop::WaitMode)
20  0x1996b96d8 WebCore::WorkerRunLoop::run(WebCore::WorkerGlobalScope*)
21  0x1996bd518 WebCore::WorkerThread::runEventLoop()
22  0x19969e634 WebCore::DedicatedWorkerThread::runEventLoop()
23  0x1996bcfe1 WebCore::WorkerThread::workerThread()
24  0x1996d0118 WebCore::WorkerThread::start(WTF::Function<void (WTF::String const&)>&&)::$_16::operator()() const
25  0x1996d00ce WTF::Detail::CallableWrapper<WebCore::WorkerThread::start(WTF::Function<void (WTF::String const&)>&&)::$_16, void>::call()
26  0x1b06e5792 WTF::Function<void ()>::operator()() const
27  0x1b078be58 WTF::Thread::entryPoint(WTF::Thread::NewThreadContext*)
28  0x1b0797588 WTF::wtfThreadEntryPoint(void*)
29  0x7fff6bc80109 _pthread_start
30  0x7fff6bc7bb8b thread_start
Comment 8 Devin Rousso 2020-04-30 11:24:58 PDT
Created attachment 398069 [details]
Patch

I managed to create a valid LayoutTest for this, and with that it showed that the attempted fix in attachment 397995 [details] was not valid, as it's possible for the event to already be dispatched by the time that `m_isTerminatingExecution` is set. As such, I've added logic to the Web Inspector `InjectedScript` (and various manager classes) to handle `TerminatedExecutionError` instead.
Comment 9 Mark Lam 2020-04-30 11:36:29 PDT
Comment on attachment 398069 [details]
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=398069&action=review

> Source/WebInspectorUI/ChangeLog:13
> +        Be sure to update the active execution context display even if the removed execution context
> +        was not the active execution context.

Can you add a bit more comment about why this should be done?
Comment 10 Devin Rousso 2020-04-30 12:23:21 PDT
Comment on attachment 398069 [details]
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=398069&action=review

>> Source/WebInspectorUI/ChangeLog:13
>> +        was not the active execution context.
> 
> Can you add a bit more comment about why this should be done?

This relates to the execution context picker at the end of the console prompt.  If a Worker is removed and is NOT the active execution context, we should hide the execution context picker if there is only one other execution context (e.g. the main page).  Previously, we would only hide the picker if the Worker was the active execution context.
Comment 11 Blaze Burg 2020-04-30 12:33:30 PDT
Comment on attachment 398069 [details]
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=398069&action=review

r=me with a question

>> Source/WebInspectorUI/ChangeLog:13
>> +        was not the active execution context.
> 
> Can you add a bit more comment about why this should be done?

I had the same question. Devin said on Slack that this is needed to hide the drop-down picker if, after a worker terminates, there are no longer any additional contexts besides the main frame.

> Source/JavaScriptCore/inspector/InjectedScriptBase.cpp:-86
> -        return JSON::Value::create("Exception while making a call.");

Yay, glad we no longer drop the error message on the floor.
Comment 12 Blaze Burg 2020-04-30 12:33:59 PDT
(In reply to Brian Burg from comment #11)
> Comment on attachment 398069 [details]
> Patch
> 
> View in context:
> https://bugs.webkit.org/attachment.cgi?id=398069&action=review
> 
> r=me with a question

[- with a question]
Comment 13 Devin Rousso 2020-04-30 13:15:48 PDT
Created attachment 398087 [details]
Patch
Comment 14 EWS 2020-04-30 13:46:10 PDT
Committed r260963: <https://trac.webkit.org/changeset/260963>

All reviewed patches have been landed. Closing bug and clearing flags on attachment 398087 [details].