Bug 264955 – Crash on infinitemac.org

• Status: RESOLVED
• Resolution: CONFIGURATION CHANGED
• Component: WebCore Misc.

[Matt Sephton]

A web worker crashes, but only when the web inspector is *not* open. 

https://github.com/mihaip/infinite-mac/issues/249 

- macOS 14.1.1 + Safari 17.1 (19616.2.9.11.7)
- macOS 12.7.1 + Safari 17.1 (17616.2.9.11.9)

[Matt Sephton]

happens in latest WebKit Build Archive 270824@main

[Ahmad Saleem]

It is happening on Safari Technology Preview 183 as well. From GitHub thread, the crash log indicates 'JavaScript':

GitHub comment: https://github.com/mihaip/infinite-mac/issues/249#issuecomment-1807514156

Crashed Thread:        11  WebCore: Worker

Exception Type:        EXC_BAD_ACCESS (SIGKILL)
Exception Codes:       KERN_PROTECTION_FAILURE at 0x000000792cfffffc
Exception Codes:       0x0000000000000002, 0x000000792cfffffc

Termination Reason:    Namespace PAC_EXCEPTION, Code 2 
...
Thread 11 Crashed:: WebCore: Worker
0   ???                           	       0x121aac188 ???
1   ???                           	       0x121ae38f4 ???
2   ???                           	       0x121a65c3c ???
3   ???                           	       0x1218412e8 ???
4   ???                           	       0x121808248 ???
5   ???                           	       0x121808248 ???
6   ???                           	       0x121808248 ???
7   ???                           	       0x121808248 ???
8   ???                           	       0x121808248 ???
9   ???                           	       0x121808248 ???
10  ???                           	       0x121808248 ???
11  ???                           	       0x121808008 ???
12  ???                           	       0x121808728 ???
13  JavaScriptCore                	       0x103f21388 JSC::Interpreter::executeCall(JSC::JSObject*, JSC::CallData const&, JSC::JSValue, JSC::ArgList const&) + 604
14  JavaScriptCore                	       0x1042a91bc JSC::runJSMicrotask(JSC::JSGlobalObject*, WTF::ObjectIdentifierGeneric<JSC::MicrotaskIdentifierType, WTF::ObjectIdentifierThreadSafeAccessTraits>, JSC::JSValue, JSC::JSValue, JSC::JSValue, JSC::JSValue, JSC::JSValue) + 388
15  WebCore                       	       0x1104d3204 WebCore::JSMicrotaskCallback::call() + 200
16  WebCore                       	       0x1108a2a38 WebCore::MicrotaskQueue::performMicrotaskCheckpoint() + 228
17  WebCore                       	       0x11087e8e0 WebCore::EventLoop::run() + 440
18  WebCore                       	       0x11179d080 WebCore::WorkerDedicatedRunLoop::Task::performTask(WebCore::WorkerOrWorkletGlobalScope*) + 224
19  WebCore                       	       0x11179cb90 WebCore::WorkerDedicatedRunLoop::runInMode(WebCore::WorkerOrWorkletGlobalScope*, WebCore::ModePredicate const&) + 816
20  WebCore                       	       0x11179b250 WebCore::WorkerDedicatedRunLoop::run(WebCore::WorkerOrWorkletGlobalScope*) + 132
21  WebCore                       	       0x11179b660 WebCore::WorkerOrWorkletThread::workerOrWorkletThread() + 548
22  JavaScriptCore                	       0x1032472ec WTF::Thread::entryPoint(WTF::Thread::NewThreadContext*) + 244
23  JavaScriptCore                	       0x103056da4 WTF::wtfThreadEntryPoint(void*) + 16
24  libsystem_pthread.dylib       	       0x196177fa8 _pthread_start + 148
25  libsystem_pthread.dylib       	       0x196172da0 thread_start + 8

[Ahmad Saleem]

Get this on WebKit ToT (270823@main):

RuntimeError: Out of bounds memory access (evaluating 'r(t,n)')

Test Case: https://infinitemac.org/1998/Mac%20OS%208.5

[Matt Sephton]

Thanks for the follow-up.

I'm intrigued why it doesn't happen when the web inspector is open? Would you enlighten me? Thank you

[Alexey Proskuryakov]

rdar://118510931

[Alexey Proskuryakov]

What are the exact steps to reproduce? I cannot make it crash using macOS 14.2 beta.

Could you please attach the complete crash log (.ips file from ~/Library/Logs/DiagnosticReports)?

> I'm intrigued why it doesn't happen when the web inspector is open? Would you enlighten me? Thank you

This is extremely common, JavaScript compilation changes a lot to aid debugging when Web Inspector is in use.

[Matt Sephton]

Steps to reproduce

1. visit this URL: https://infinitemac.org/1998/Mac%20OS%208.5
2. wait about 10 or so seconds as the page loads

Attachments:
- screenshot just prior to crash
- screen recording of crash
- selection of com.apple.WebKit.WebContent logs

[Matt Sephton]

Created attachment 468655 [details]
screenshot just prior to crash

[Matt Sephton]

Created attachment 468656 [details]
screen recording of crash

[Matt Sephton]

Created attachment 468657 [details]
selection of logs from ~/Library/Logs/DiagnosticReports

[Matt Sephton]

(In reply to Ahmad Saleem from comment #3)
> RuntimeError: Out of bounds memory access (evaluating 'r(t,n)')

I got this on iPhone Xs, iOS 16.7.1

[Alexey Proskuryakov]

Would it be possible for you to test with iOS 17.2 beta, and/or macOS 14.2 beta? There is not much we can do about iOS 16, but it would really help to get on the same page with regards to whether this reproduces in upcoming release.

[Matt Sephton]

Sadly I'm unable to do so at the moment as I won't be upgrade to the latest versions any time soon. Apologies. Hopefully somebody else in the thread who has been able to reproduce this can keep us updated on latest.

There's a new site from Software Applications Incorporated (the Workflow/Shortcuts founders) that uses the same technology stack, and that crashes in the same way too: https://software.inc

[Justin Michaud]

This no longer reproduces for me, is it reproducing for anyone else?

[Ahmad Saleem]

(In reply to Justin Michaud from comment #14)
> This no longer reproduces for me, is it reproducing for anyone else?

I am also no longer able to reproduce with Safari 17.2.1 and macOS 14.2.1 and it loads fine despite having gazillion tabs and browsers windows on 16 GB RAM M1 MacBook Pro.

[Matt Sephton]

(In reply to Justin Michaud from comment #14)
> This no longer reproduces for me, is it reproducing for anyone else?

I finally upgraded to Sonoma and Safari 17.2.1 no longer able to repro.

I can't recall but I think it was also resolved on Safari 17.2.1 on Monterey.