Bug 228869 - Crash when connecting gamepad in a PWA
Summary: Crash when connecting gamepad in a PWA
Status: NEW
Alias: None
Product: WebKit
Classification: Unclassified
Component: WebCore Misc. (show other bugs)
Version: Safari 14
Hardware: iPhone / iPad iOS 14
: P2 Normal
Assignee: Nobody
Keywords: InRadar
Depends on:
Reported: 2021-08-06 11:28 PDT by Alec Bargas
Modified: 2021-08-13 11:29 PDT (History)
2 users (show)

See Also:

minimal test page (2.33 KB, text/html)
2021-08-06 11:28 PDT, Alec Bargas
no flags Details
raw crash file (97.62 KB, text/plain)
2021-08-06 11:29 PDT, Alec Bargas
no flags Details
symbolicated stack trace (3.17 KB, text/plain)
2021-08-06 11:30 PDT, Alec Bargas
no flags Details

Note You need to log in before you can comment on or make changes to this bug.
Description Alec Bargas 2021-08-06 11:28:21 PDT
Created attachment 435077 [details]
minimal test page

It is possible to crash a PWA by attaching a gamepad to the device. The stack trace indicates that the crash is happening internal to WebKit and not at the application level.

Attached is a minimal test page to reproduce the issue. The test page polls navigator.getGamepads() every 4 ms. Each poll it checks for the presence of gamepads and (un)checks boxes with the connection state of the first two gamepads it detects.

The crash seems to happen under different conditions, but the following is a consistent way to get a crash:
1. Restart device (power off/on).
2. Create PWA for test page.
3. Ensure all other Safari/PWA instances are killed.
4. Connect two gamepads (note the order)
5. Do inputs on both gamepads in the same order they were connected until they are detected (boxes on page checked)
6. Disconnect both gamepads (boxes on page unchecked)
7. Kill page (swipe away PWA)
8. Reopen page
9. Connect second gamepad and observe crash (screen will flash and crash dump will be present)

Reproduces with:
Version/14.1.2 Safari/605.1.15 (iOS 14.7.1)
Version/14.1.1 Safari/605.1.15 (iPadOS 14.6)
BT Dualshock 4 + Rotor Riot, BT Xbox One + Rotor Riot

The crash .ips file and symbolicated stack will be attached after the initial filing.
Comment 1 Alec Bargas 2021-08-06 11:29:14 PDT
Created attachment 435078 [details]
raw crash file
Comment 2 Alec Bargas 2021-08-06 11:30:32 PDT
Created attachment 435079 [details]
symbolicated stack trace
Comment 3 Radar WebKit Bug Importer 2021-08-13 11:29:22 PDT