Bug 268568 – [iOS] Assertion failure causing fast/forms/ios/file-upload-panel-capture.html to consistently crash.

• Status: RESOLVED
• Resolution: FIXED
• Component: Forms

[Ben Schwartz]

Created attachment 469662 [details]
file-upload-panel-capture-crash-log.ips

fast/forms/ios/file-upload-panel-capture.html

This test is consistently crashing due to an assertion failure on iOS.

HISTORY:

https://results.webkit.org/?suite=layout-tests&test=fast%2Fforms%2Fios%2Ffile-upload-panel-capture.html&version_name=iOS%2016&version_name=iOS%2017&recent=false

CRASH LOG:

Attached.

STDERR:

2024-02-01 08:41:00.762 WebKitTestRunnerApp[47327:3638186] *** Assertion failure in -[DOCWeakProxy forwardingTargetForSelector:], DOCRemoteViewController.m:42
*** Terminating app due to uncaught exception 'NSInternalInconsistencyException', reason: 'DocumentManager service tried to send a message to a deallocated host proxy'
*** First throw call stack:
(
	0   CoreFoundation                      0x00000001804658a8 __exceptionPreprocess + 172
	1   libobjc.A.dylib                     0x000000018005c09c objc_exception_throw + 56
	2   Foundation                          0x0000000180cf3a5c _userInfoForFileAndLine + 0
	3   DocumentManager                     0x000000010a9a5430 -[DOCWeakProxy forwardingTargetForSelector:] + 116
	4   CoreFoundation                      0x00000001804695c8 ___forwarding___ + 208
	5   CoreFoundation                      0x000000018046bd1c _CF_forwarding_prep_0 + 92
	6   Foundation                          0x0000000180e90364 __NSXPCCONNECTION_IS_CALLING_OUT_TO_EXPORTED_OBJECT_S2__ + 12
	7   Foundation                          0x0000000180e8f0bc -[NSXPCConnection _decodeAndInvokeMessageWithEvent:reply:flags:] + 1576
	8   Foundation                          0x0000000180e91170 message_handler_message + 84
	9   Foundation                          0x0000000180e906fc message_handler + 148
	10  libxpc.dylib                        0x00000001800957e0 _xpc_connection_call_event_handler + 68
	11  libxpc.dylib                        0x0000000180095ba0 _xpc_connection_mach_event + 904
	12  libdispatch.dylib                   0x0000000180143df0 _dispatch_client_callout4 + 16
	13  libdispatch.dylib                   0x0000000180160cb0 _dispatch_mach_msg_invoke + 620
	14  libdispatch.dylib                   0x000000018014bbcc _dispatch_lane_serial_drain + 336
	15  libdispatch.dylib                   0x0000000180161d70 _dispatch_mach_invoke + 464
	16  libdispatch.dylib                   0x000000018014bbcc _dispatch_lane_serial_drain + 336
	17  libdispatch.dylib                   0x000000018014c9b4 _dispatch_lane_invoke + 388
	18  libdispatch.dylib                   0x0000000180157d40 _dispatch_root_queue_drain_deferred_wlh + 276
	19  libdispatch.dylib                   0x000000018015738c _dispatch_workloop_worker_thread + 448
	20  libsystem_pthread.dylib             0x00000001056cb924 _pthread_wqthread + 284
	21  libsystem_pthread.dylib             0x00000001056ca6e4 start_wqthread + 8
)
libc++abi: terminating due to uncaught exception of type NSException

REPRODUCIBILITY:

I have been unable to reproduce this issue locally as of yet.

REGRESSION:

This test has been crashing since before iOS 16, so I'm not able to locate a clear regression point; however, it is crashing significantly more on iOS 17.

[Radar WebKit Bug Importer]

<rdar://problem/122127465>

[EWS]

Test gardening commit 273963@main (04fe52e0f160): <https://commits.webkit.org/273963@main>

Reviewed commits have been landed. Closing PR #23709 and removing active labels.

[Alexey Proskuryakov]

This test was added for bug 202039.

[Ben Schwartz]

*** Bug 269615 has been marked as a duplicate of this bug. ***

[Alexey Proskuryakov]

This test is still crashing, but I see a different stack trace now:

ASSERTION FAILED: mediaTypes.count
/Users/ap/Safari/OpenSource/Source/WebKit/UIProcess/ios/forms/WKFileUploadPanel.mm(663) : -[WKFileUploadPanel _mediaTypesForPickerSourceType:]
1   0x12cf9891c -[WKFileUploadPanel _mediaTypesForPickerSourceType:]
2   0x12cf9a4ec -[WKFileUploadPanel _showCamera]
3   0x12cf976b4 -[WKFileUploadPanel presentWithParameters:resultListener:]
4   0x12ed3a628 -[WKContentView(WKInteraction) _showRunOpenPanel:frameInfo:resultListener:]
5   0x12cef7894 WebKit::PageClientImpl::handleRunOpenPanel(WebKit::WebPageProxy*, WebKit::WebFrameProxy*, WebKit::FrameInfoData const&, API::OpenPanelParameters*, WebKit::WebOpenPanelResultListenerProxy*)
6   0x12d255de8 WebKit::WebPageProxy::runOpenPanel(IPC::Connection&, WebCore::ProcessQualified<WTF::ObjectIdentifierGeneric<WebCore::FrameIdentifierType, WTF::ObjectIdentifierMainThreadAccessTraits<unsigned long long>, unsigned long long, (WTF::SupportsObjectIdentifierNullState)1>>, WebKit::FrameInfoData&&, WebCore::FileChooserSettings const&)
7   0x12e9705a4 auto void IPC::callMemberFunction<WebKit::WebPageProxy, WebKit::WebPageProxy, void (IPC::Connection&, WebCore::ProcessQualified<WTF::ObjectIdentifierGeneric<WebCore::FrameIdentifierType, WTF::ObjectIdentifierMainThreadAccessTraits<unsigned long long>, unsigned long long, (WTF::SupportsObjectIdentifierNullState)1>>, WebKit::FrameInfoData&&, WebCore::FileChooserSettings const&), std::__1::tuple<WebCore::ProcessQualified<WTF::ObjectIdentifierGeneric<WebCore::FrameIdentifierType, WTF::ObjectIdentifierMainThreadAccessTraits<unsigned long long>, unsigned long long, (WTF::SupportsObjectIdentifierNullState)1>>, WebKit::FrameInfoData, WebCore::FileChooserSettings>>(WebKit::WebPageProxy*, void (WebKit::WebPageProxy::*)(IPC::Connection&, WebCore::ProcessQualified<WTF::ObjectIdentifierGeneric<WebCore::FrameIdentifierType, WTF::ObjectIdentifierMainThreadAccessTraits<unsigned long long>, unsigned long long, (WTF::SupportsObjectIdentifierNullState)1>>, WebKit::FrameInfoData&&, WebCore::FileChooserSettings const&), IPC::Connection&, std::__1::tuple<WebCore::ProcessQualified<WTF::ObjectIdentifierGeneric<WebCore::FrameIdentifierType, WTF::ObjectIdentifierMainThreadAccessTraits<unsigned long long>, unsigned long long, (WTF::SupportsObjectIdentifierNullState)1>>, WebKit::FrameInfoData, WebCore::FileChooserSettings>&&)::'lambda'(auto&&...)::operator()<WebCore::ProcessQualified<WTF::ObjectIdentifierGeneric<WebCore::FrameIdentifierType, WTF::ObjectIdentifierMainThreadAccessTraits<unsigned long long>, unsigned long long, (WTF::SupportsObjectIdentifierNullState)1>>, WebKit::FrameInfoData, WebCore::FileChooserSettings>(auto&&...) const

[Alexey Proskuryakov]

*** Bug 289019 has been marked as a duplicate of this bug. ***

[Robert Jenner]

We have decided to run the following four tests singly to temporarily get us around this issue, as it is impacting EWS very negatively:

fast/forms/ios/focus-input-via-button.html
fast/forms/ios/file-upload-panel-accept.html
fast/forms/ios/file-upload-panel-capture.html
fast/forms/ios/file-upload-panel.html

[Robert Jenner]

Pull request: https://github.com/WebKit/WebKit/pull/43859

[EWS]

Committed 293486@main (d2256c7cec01): <https://commits.webkit.org/293486@main>

Reviewed commits have been landed. Closing PR #43859 and removing active labels.

[Marta Darbinyan]

This assertion still occurs when it runs in the following order in EWS, even after the change that made the tests run singly. 
fast/forms/ios/file-upload-panel-accept.html
fast/forms/ios/file-upload-panel-capture.html
fast/forms/ios/file-upload-panel-dismiss-when-view-removed-from-window.html

I could reproduce the crash locally with the command:
run-webkit-tests  --release --ios-simulator fast/forms/ios/file-upload-panel-accept.html fast/forms/ios/file-upload-panel-capture.html fast/forms/ios/file-upload-panel-dismiss-when-view-removed-from-window.html --iterations=50 --child-processes 1

Test results from EWS:
https://ews-build.webkit.org/#/builders/132/builds/15938

I think gardening those tests like Pass Crash can temporarily help with flakiness we see in EWS.

[EWS]

Test gardening commit 294092@main (f51a1b85cc72): <https://commits.webkit.org/294092@main>

Reviewed commits have been landed. Closing PR #44494 and removing active labels.