Bug 288804 – Safari iOS: WASM Touch Input Crash

• Status: NEW
• Component: New Bugs

[Matthew Rister]

Created attachment 474374 [details]
Unity project build for the web platform that can be used to reproduce the crash on Safari iOS 18.3.

I'm a software engineer at Unity on the Web Platform team, where we compile our engine to WebAssembly using Emscripten. We're observing a crash on Safari iOS 18.3 when responding to touch input for a game that downloads scene content dynamically, which is consistently reproducible across a wide range of devices including iPhone 11, iPhone 14 Pro, and iPad Gen 3. This crash has been particularly difficult to debug because Safari does not produce any logs to help diagnose the issue, but I was able to trace it to just before an Emscripten touchmove event handler is expected to be invoked. Although the crash is deterministic, the point at which it crashes seemingly depends on the device (e.g., newer devices will crash when processing touch input after the scene content has downloaded dynamically, whereas older devices will crash while the scene content is loading), which leads us to believe this may be related to Gigacage memory fragmentation, as reported by my colleague in https://bugs.webkit.org/show_bug.cgi?id=269937. Furthermore, we also observed that enabling compiler optimizations to aggressively reduce the generated WASM file size helped mitigate the issue for single touch input (it unfortunately did not resolve crashing due to multitouch input).

Steps to reproduce the crash:
1. Unzip the attached Unity project build.
2. Start a server using either node.js http-server or python -m http.server.
3. Navigate to the URL on an iOS device.
4. Wait for the scene to download.
5. Touch the screen.

Expected Result:
The camera rotates around the scene.

Actual Result:
The web page crashes, followed by Safari attempting to reload the page. Repeating this process results in a hard crash.

Additional Notes:
1. This was reproduced all the way back to iOS 17.4 so it does not appear to be a regression.

[Matthew Rister]

Created attachment 474375 [details]
sysdiagnose logs taken just after the reported crash on an iPhone 11 running Safari 18.3.

[Radar WebKit Bug Importer]

<rdar://problem/146445318>