Title: [281964] trunk
Revision
281964
Author
[email protected]
Date
2021-09-02 16:21:24 -0700 (Thu, 02 Sep 2021)

Log Message

[ BigSur arm64 Debug EWS ] ASSERTION FAILED: m_uncommittedState.state == State::Provisional
https://bugs.webkit.org/show_bug.cgi?id=229769
<rdar://problem/82645706>

Reviewed by Alex Christensen.

Source/WebKit:

I am unable to reproduce the crash but we know that we're crashing when committing the load
after a process-swap, because the WebPageProxy doesn't know that a provisional load is going
on. One possible explanation for this, and the most likely one is that the WebPageProxy got
a DidFailProvisionalLoadForFrame IPC from the current process while the provisional load is
proceeding in the new provisional process. We had logic in WebPageProxy::didFailProvisionalLoadForFrame()
to try and discard such IPC but the check was relying on the navigationID and was therefore
fragile. I updated the check in didFailProvisionalLoadForFrame() to ignore all
DidFailProvisionalLoadForFrame IPCs for the main frame from the current process when there
is a ProvisionalPageProxy, without relying on the navigationID. This should be more robust
and will hopefully fix this flaky crash.

No new tests, unskipped existing tests.

* UIProcess/ProvisionalPageProxy.cpp:
(WebKit::ProvisionalPageProxy::didFailProvisionalLoadForFrame):
* UIProcess/WebPageProxy.cpp:
(WebKit::WebPageProxy::didFailProvisionalLoadForFrame):
(WebKit::WebPageProxy::didFailProvisionalLoadForFrameShared):
* UIProcess/WebPageProxy.h:

LayoutTests:

Unskip test that should no longer be flakily crashing in debug.

* platform/mac-wk2/TestExpectations:

Modified Paths

Diff

Modified: trunk/LayoutTests/ChangeLog (281963 => 281964)


--- trunk/LayoutTests/ChangeLog	2021-09-02 23:10:11 UTC (rev 281963)
+++ trunk/LayoutTests/ChangeLog	2021-09-02 23:21:24 UTC (rev 281964)
@@ -1,3 +1,15 @@
+2021-09-02  Chris Dumez  <[email protected]>
+
+        [ BigSur arm64 Debug EWS ] ASSERTION FAILED: m_uncommittedState.state == State::Provisional
+        https://bugs.webkit.org/show_bug.cgi?id=229769
+        <rdar://problem/82645706>
+
+        Reviewed by Alex Christensen.
+
+        Unskip test that should no longer be flakily crashing in debug.
+
+        * platform/mac-wk2/TestExpectations:
+
 2021-09-02  Alex Christensen  <[email protected]>
 
         Reject non-IPv4 hostnames that end in numbers

Modified: trunk/LayoutTests/platform/mac-wk2/TestExpectations (281963 => 281964)


--- trunk/LayoutTests/platform/mac-wk2/TestExpectations	2021-09-02 23:10:11 UTC (rev 281963)
+++ trunk/LayoutTests/platform/mac-wk2/TestExpectations	2021-09-02 23:21:24 UTC (rev 281964)
@@ -778,8 +778,6 @@
 
 webkit.org/b/168235 [ Debug ] imported/w3c/web-platform-tests/html/semantics/text-level-semantics/the-a-element/a-download-click.html [ Pass Failure ]
 
-webkit.org/b/229769 [ BigSur arm64 Debug ] imported/w3c/web-platform-tests/html/semantics/forms/the-button-element/button-submit-children.html [ Pass Crash ]
-
 webkit.org/b/229831 imported/w3c/web-platform-tests/html/dom/idlharness.https.html [ Pass Failure ]
 
 webkit.org/b/168085 tiled-drawing/scrolling/latched-to-deleted-node.html [ Pass Failure ]
@@ -1655,4 +1653,4 @@
 
 webkit.org/b/229764 animations/background-position.html [ Pass ImageOnlyFailure ]
 
-webkit.org/b/228209 fast/speechrecognition/start-recognition-after-gum.html [ Slow ]
\ No newline at end of file
+webkit.org/b/228209 fast/speechrecognition/start-recognition-after-gum.html [ Slow ]

Modified: trunk/Source/WebKit/ChangeLog (281963 => 281964)


--- trunk/Source/WebKit/ChangeLog	2021-09-02 23:10:11 UTC (rev 281963)
+++ trunk/Source/WebKit/ChangeLog	2021-09-02 23:21:24 UTC (rev 281964)
@@ -1,3 +1,31 @@
+2021-09-02  Chris Dumez  <[email protected]>
+
+        [ BigSur arm64 Debug EWS ] ASSERTION FAILED: m_uncommittedState.state == State::Provisional
+        https://bugs.webkit.org/show_bug.cgi?id=229769
+        <rdar://problem/82645706>
+
+        Reviewed by Alex Christensen.
+
+        I am unable to reproduce the crash but we know that we're crashing when committing the load
+        after a process-swap, because the WebPageProxy doesn't know that a provisional load is going
+        on. One possible explanation for this, and the most likely one is that the WebPageProxy got
+        a DidFailProvisionalLoadForFrame IPC from the current process while the provisional load is
+        proceeding in the new provisional process. We had logic in WebPageProxy::didFailProvisionalLoadForFrame()
+        to try and discard such IPC but the check was relying on the navigationID and was therefore
+        fragile. I updated the check in didFailProvisionalLoadForFrame() to ignore all
+        DidFailProvisionalLoadForFrame IPCs for the main frame from the current process when there
+        is a ProvisionalPageProxy, without relying on the navigationID. This should be more robust
+        and will hopefully fix this flaky crash.
+
+        No new tests, unskipped existing tests.
+
+        * UIProcess/ProvisionalPageProxy.cpp:
+        (WebKit::ProvisionalPageProxy::didFailProvisionalLoadForFrame):
+        * UIProcess/WebPageProxy.cpp:
+        (WebKit::WebPageProxy::didFailProvisionalLoadForFrame):
+        (WebKit::WebPageProxy::didFailProvisionalLoadForFrameShared):
+        * UIProcess/WebPageProxy.h:
+
 2021-09-02  Alex Christensen  <[email protected]>
 
         Move PrivateClickMeasurementManager and PrivateClickMeasurementNetworkLoader into PrivateClickMeasurement directory

Modified: trunk/Source/WebKit/UIProcess/ProvisionalPageProxy.cpp (281963 => 281964)


--- trunk/Source/WebKit/UIProcess/ProvisionalPageProxy.cpp	2021-09-02 23:10:11 UTC (rev 281963)
+++ trunk/Source/WebKit/UIProcess/ProvisionalPageProxy.cpp	2021-09-02 23:21:24 UTC (rev 281964)
@@ -288,7 +288,10 @@
     if (auto* pageMainFrame = m_page.mainFrame())
         pageMainFrame->didFailProvisionalLoad();
 
-    m_page.didFailProvisionalLoadForFrameShared(m_process.copyRef(), frameID, WTFMove(frameInfo), WTFMove(request), navigationID, provisionalURL, error, willContinueLoading, userData); // May delete |this|.
+    WebFrameProxy* frame = m_process->webFrame(frameID);
+    MESSAGE_CHECK(m_process, frame);
+
+    m_page.didFailProvisionalLoadForFrameShared(m_process.copyRef(), *frame, WTFMove(frameInfo), WTFMove(request), navigationID, provisionalURL, error, willContinueLoading, userData); // May delete |this|.
 }
 
 void ProvisionalPageProxy::didCommitLoadForFrame(FrameIdentifier frameID, FrameInfoData&& frameInfo, ResourceRequest&& request, uint64_t navigationID, const String& mimeType, bool frameHasCustomContentProvider, WebCore::FrameLoadType frameLoadType, const WebCore::CertificateInfo& certificateInfo, bool usedLegacyTLS, bool containsPluginDocument, std::optional<WebCore::HasInsecureContent> forcedHasInsecureContent, WebCore::MouseEventPolicy mouseEventPolicy, const UserData& userData)

Modified: trunk/Source/WebKit/UIProcess/WebPageProxy.cpp (281963 => 281964)


--- trunk/Source/WebKit/UIProcess/WebPageProxy.cpp	2021-09-02 23:10:11 UTC (rev 281963)
+++ trunk/Source/WebKit/UIProcess/WebPageProxy.cpp	2021-09-02 23:21:24 UTC (rev 281964)
@@ -4781,37 +4781,37 @@
 
 void WebPageProxy::didFailProvisionalLoadForFrame(FrameIdentifier frameID, FrameInfoData&& frameInfo, WebCore::ResourceRequest&& request, uint64_t navigationID, const String& provisionalURL, const ResourceError& error, WillContinueLoading willContinueLoading, const UserData& userData)
 {
-    if (m_provisionalPage && m_provisionalPage->navigationID() == navigationID) {
+    WebFrameProxy* frame = m_process->webFrame(frameID);
+    MESSAGE_CHECK(m_process, frame);
+
+    if (m_provisionalPage && frame->isMainFrame()) {
         // The load did not fail, it is merely happening in a new provisional process.
         return;
     }
 
-    didFailProvisionalLoadForFrameShared(m_process.copyRef(), frameID, WTFMove(frameInfo), WTFMove(request), navigationID, provisionalURL, error, willContinueLoading, userData);
+    didFailProvisionalLoadForFrameShared(m_process.copyRef(), *frame, WTFMove(frameInfo), WTFMove(request), navigationID, provisionalURL, error, willContinueLoading, userData);
 }
 
-void WebPageProxy::didFailProvisionalLoadForFrameShared(Ref<WebProcessProxy>&& process, FrameIdentifier frameID, FrameInfoData&& frameInfo, WebCore::ResourceRequest&& request, uint64_t navigationID, const String& provisionalURL, const ResourceError& error, WillContinueLoading willContinueLoading, const UserData& userData)
+void WebPageProxy::didFailProvisionalLoadForFrameShared(Ref<WebProcessProxy>&& process, WebFrameProxy& frame, FrameInfoData&& frameInfo, WebCore::ResourceRequest&& request, uint64_t navigationID, const String& provisionalURL, const ResourceError& error, WillContinueLoading willContinueLoading, const UserData& userData)
 {
     LOG(Loading, "(Loading) WebPageProxy %" PRIu64 " in web process pid %i didFailProvisionalLoadForFrame to provisionalURL %s", m_identifier.toUInt64(), process->processIdentifier(), provisionalURL.utf8().data());
-    WEBPAGEPROXY_RELEASE_LOG_ERROR(Process, "didFailProvisionalLoadForFrame: frameID=%" PRIu64 ", domain=%s, code=%d", frameID.toUInt64(), error.domain().utf8().data(), error.errorCode());
+    WEBPAGEPROXY_RELEASE_LOG_ERROR(Process, "didFailProvisionalLoadForFrame: frameID=%" PRIu64 ", domain=%s, code=%d", frame.frameID().toUInt64(), error.domain().utf8().data(), error.errorCode());
 
     PageClientProtector protector(pageClient());
 
-    WebFrameProxy* frame = process->webFrame(frameID);
-    MESSAGE_CHECK(process, frame);
-
     if (m_controlledByAutomation) {
         if (auto* automationSession = process->processPool().automationSession())
-            automationSession->navigationOccurredForFrame(*frame);
+            automationSession->navigationOccurredForFrame(frame);
     }
 
     // FIXME: We should message check that navigationID is not zero here, but it's currently zero for some navigations through the back/forward cache.
     RefPtr<API::Navigation> navigation;
-    if (frame->isMainFrame() && navigationID)
+    if (frame.isMainFrame() && navigationID)
         navigation = navigationState().takeNavigation(navigationID);
 
     auto transaction = m_pageLoadState.transaction();
 
-    if (frame->isMainFrame()) {
+    if (frame.isMainFrame()) {
         reportPageLoadResult(error);
         m_pageLoadState.didFailProvisionalLoad(transaction);
         pageClient().didFailProvisionalLoadForMainFrame();
@@ -4819,7 +4819,7 @@
             navigation->setClientNavigationActivity(nullptr);
     }
 
-    frame->didFailProvisionalLoad();
+    frame.didFailProvisionalLoad();
 
     m_pageLoadState.commitChanges();
 
@@ -4827,7 +4827,7 @@
     m_failingProvisionalLoadURL = provisionalURL;
 
     if (m_loaderClient)
-        m_loaderClient->didFailProvisionalLoadWithErrorForFrame(*this, *frame, navigation.get(), error, process->transformHandlesToObjects(userData.object()).get());
+        m_loaderClient->didFailProvisionalLoadWithErrorForFrame(*this, frame, navigation.get(), error, process->transformHandlesToObjects(userData.object()).get());
     else {
         m_navigationClient->didFailProvisionalNavigationWithError(*this, FrameInfoData { frameInfo }, navigation.get(), error, process->transformHandlesToObjects(userData.object()).get());
         m_navigationClient->didFailProvisionalLoadWithErrorForFrame(*this, WTFMove(request), error, WTFMove(frameInfo));
@@ -4836,7 +4836,7 @@
     m_failingProvisionalLoadURL = { };
 
     // If the provisional page's load fails then we destroy the provisional page.
-    if (m_provisionalPage && m_provisionalPage->mainFrame() == frame && willContinueLoading == WillContinueLoading::No)
+    if (m_provisionalPage && m_provisionalPage->mainFrame() == &frame && willContinueLoading == WillContinueLoading::No)
         m_provisionalPage = nullptr;
 }
 

Modified: trunk/Source/WebKit/UIProcess/WebPageProxy.h (281963 => 281964)


--- trunk/Source/WebKit/UIProcess/WebPageProxy.h	2021-09-02 23:10:11 UTC (rev 281963)
+++ trunk/Source/WebKit/UIProcess/WebPageProxy.h	2021-09-02 23:21:24 UTC (rev 281964)
@@ -1735,7 +1735,7 @@
 
     // Logic shared between the WebPageProxy and the ProvisionalPageProxy.
     void didStartProvisionalLoadForFrameShared(Ref<WebProcessProxy>&&, WebCore::FrameIdentifier, FrameInfoData&&, WebCore::ResourceRequest&&, uint64_t navigationID, URL&&, URL&& unreachableURL, const UserData&);
-    void didFailProvisionalLoadForFrameShared(Ref<WebProcessProxy>&&, WebCore::FrameIdentifier, FrameInfoData&&, WebCore::ResourceRequest&&, uint64_t navigationID, const String& provisionalURL, const WebCore::ResourceError&, WebCore::WillContinueLoading, const UserData&);
+    void didFailProvisionalLoadForFrameShared(Ref<WebProcessProxy>&&, WebFrameProxy&, FrameInfoData&&, WebCore::ResourceRequest&&, uint64_t navigationID, const String& provisionalURL, const WebCore::ResourceError&, WebCore::WillContinueLoading, const UserData&);
     void didReceiveServerRedirectForProvisionalLoadForFrameShared(Ref<WebProcessProxy>&&, WebCore::FrameIdentifier, uint64_t navigationID, WebCore::ResourceRequest&&, const UserData&);
     void didPerformServerRedirectShared(Ref<WebProcessProxy>&&, const String& sourceURLString, const String& destinationURLString, WebCore::FrameIdentifier);
     void didPerformClientRedirectShared(Ref<WebProcessProxy>&&, const String& sourceURLString, const String& destinationURLString, WebCore::FrameIdentifier);
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes

Reply via email to