Bug 109887

Summary: REGRESSION (r142734): Crash in JSObjectGetPrivate
Product: WebKit Reporter: Kevin M. Dean <kevin>
Component: WebCore JavaScriptAssignee: Nobody <webkit-unassigned>
Status: RESOLVED WORKSFORME    
Severity: Critical CC: ap, ggaren, jberlin, lj, mhahnenberg, mkwst, oliver
Priority: P1 Keywords: Regression
Version: 528+ (Nightly build)   
Hardware: Mac (Intel)   
OS: OS X 10.8   
Bug Depends on:    
Bug Blocks: 43891    
Attachments:
Description Flags
Crash Log
none
Crash Log 2
none
Crash Report
none
WebKit Crash Report none

Kevin M. Dean
Reported 2013-02-14 21:54:52 PST
Been crashing randomly on various sites throughout the last day. Not always repeatable. Process: WebProcess [17088] Path: /Applications/WebKit.app/Contents/Frameworks/10.8/WebKit2.framework/WebProcess.app/Contents/MacOS/WebProcess Identifier: com.apple.WebProcess Version: 537+ (537.32+) Code Type: X86-64 (Native) Parent Process: SafariForWebKitDevelopment [17086] User ID: 501 Date/Time: 2013-02-15 00:33:31.975 -0500 OS Version: Mac OS X 10.8.2 (12C60) Report Version: 10 Crashed Thread: 0 Dispatch queue: com.apple.main-thread Exception Type: EXC_BAD_ACCESS (SIGSEGV) Exception Codes: KERN_INVALID_ADDRESS at 0x0000000000000430 VM Regions Near 0x430: --> __TEXT 000000010d08c000-000000010d08d000 [ 4K] r-x/rwx SM=COW /Applications/WebKit.app/Contents/Frameworks/10.8/WebKit2.framework/WebProcess.app/Contents/MacOS/WebProcess Application Specific Information: Bundle controller class: BrowserBundleController Thread 0 Crashed:: Dispatch queue: com.apple.main-thread 0 com.apple.JavaScriptCore 0x000000010d67c50d JSObjectGetPrivate + 13 1 com.apple.Safari.framework 0x0000000111576e69 Safari::JSWrapper::wrap(OpaqueJSContext const*, Safari::JSWrappable*) + 131 2 com.apple.Safari.framework 0x00000001114d9b75 Safari::EventTarget::handleEvent(Safari::Event*, Safari::RegisteredEventListener const&) + 87 3 com.apple.Safari.framework 0x00000001114d9a9a Safari::EventTarget::fireEventListeners(Safari::Event*, Safari::EventTargetTracker*) + 312 4 com.apple.Safari.framework 0x00000001114d96bf Safari::EventTarget::fireEventListeners(Safari::Event*) + 173 5 com.apple.Safari.framework 0x00000001114d95ce Safari::EventTarget::dispatchEvent(Safari::Event*) + 370 6 com.apple.Safari.framework 0x00000001114a14ea Safari::ContentExtension::dispatchMessageToPage(Safari::WK::String const&, Safari::WK::SerializedScriptValue const&, Safari::WK::BundlePage const&) + 128 7 com.apple.Safari.framework 0x00000001114a44c0 Safari::ContentExtension::handleMessage(Safari::WK::String const&, Safari::WK::Type const&) + 140 8 com.apple.Safari.framework 0x0000000111407582 Safari::BrowserBundleController::dispatchMessage(Safari::WK::String const&, Safari::WK::Type const&) + 62 9 com.apple.Safari.framework 0x0000000111405cc2 Safari::BrowserBundleController::didReceiveMessage(Safari::WK::Bundle const&, Safari::WK::String const&, Safari::WK::Type const&) + 40 10 com.apple.Safari.framework 0x000000011148a6e3 Safari::WK::didReceiveMessage(OpaqueWKBundle const*, OpaqueWKString const*, void const*, void const*) + 91 11 com.apple.WebKit2 0x000000010d0f0140 WebKit::InjectedBundleClient::didReceiveMessage(WebKit::InjectedBundle*, WTF::String const&, WebKit::APIObject*) + 134 12 com.apple.WebKit2 0x000000010d1ec624 WebKit::WebProcess::postInjectedBundleMessage(CoreIPC::DataReference const&) + 144 13 com.apple.WebKit2 0x000000010d1f2943 void CoreIPC::handleMessage<Messages::WebProcess::PostInjectedBundleMessage, WebKit::WebProcess, void (WebKit::WebProcess::*)(CoreIPC::DataReference const&)>(CoreIPC::MessageDecoder&, WebKit::WebProcess*, void (WebKit::WebProcess::*)(CoreIPC::DataReference const&)) + 69 14 com.apple.WebKit2 0x000000010d0d30dd CoreIPC::Connection::dispatchMessage(WTF::PassOwnPtr<CoreIPC::MessageDecoder>) + 105 15 com.apple.WebKit2 0x000000010d0d477a CoreIPC::Connection::dispatchOneMessage() + 96 16 com.apple.WebCore 0x000000010e469fd9 WebCore::RunLoop::performWork() + 153 17 com.apple.WebCore 0x000000010e46a675 WebCore::RunLoop::performWork(void*) + 53 18 com.apple.CoreFoundation 0x00007fff87db0101 __CFRUNLOOP_IS_CALLING_OUT_TO_A_SOURCE0_PERFORM_FUNCTION__ + 17 19 com.apple.CoreFoundation 0x00007fff87dafaed __CFRunLoopDoSources0 + 445 20 com.apple.CoreFoundation 0x00007fff87dd2dc5 __CFRunLoopRun + 789 21 com.apple.CoreFoundation 0x00007fff87dd26b2 CFRunLoopRunSpecific + 290 22 com.apple.HIToolbox 0x00007fff8dc4e0a4 RunCurrentEventLoopInMode + 209 23 com.apple.HIToolbox 0x00007fff8dc4de42 ReceiveNextEventCommon + 356 24 com.apple.HIToolbox 0x00007fff8dc4dcd3 BlockUntilNextEventMatchingListInMode + 62 25 com.apple.AppKit 0x00007fff8b88d613 _DPSNextEvent + 685 26 com.apple.AppKit 0x00007fff8b88ced2 -[NSApplication nextEventMatchingMask:untilDate:inMode:dequeue:] + 128 27 com.apple.AppKit 0x00007fff8b884283 -[NSApplication run] + 517 28 com.apple.WebCore 0x000000010e46ac5d WebCore::RunLoop::run() + 77 29 com.apple.WebKit2 0x000000010d163d2d int WebKit::ChildProcessMain<WebKit::WebProcess, WebKit::WebContentProcessMainDelegate>(int, char**) + 631 30 com.apple.WebProcess 0x000000010d08ce43 main + 307 31 libdyld.dylib 0x00007fff8936d7e1 start + 1
Attachments
Crash Log (57.08 KB, text/plain)
2013-02-15 22:42 PST, Kevin M. Dean 		no flags
Details
Crash Log 2 (64.72 KB, text/plain)
2013-02-15 22:47 PST, Kevin M. Dean 		no flags
Details
Crash Report (68.87 KB, text/plain)
2013-02-16 11:01 PST, Luc Jallois 		no flags
Details
WebKit Crash Report (67.69 KB, text/plain)
2013-02-16 15:33 PST, Luc Jallois 		no flags
Details
Show Obsolete (2) View All Add attachment proposed patch, testcase, etc.
Alexey Proskuryakov
Comment 1 2013-02-15 12:41:17 PST
Can you please try running the nightly build with GuardMalloc from command line to hopefully catch the error earlier and more reproducibly? The following should be a single line in Terminal: DYLD_FRAMEWORK_PATH=/Applications/WebKit.app/Contents/Frameworks/10.8 DYLD_INSERT_LIBRARIES=/usr/lib/libgmalloc.dylib /Applications/Safari.app/Contents/MacOS/SafariForWebKitDevelopment
Alexey Proskuryakov
Comment 2 2013-02-15 12:46:49 PST
*** Bug 109938 has been marked as a duplicate of this bug. ***
Kevin M. Dean
Comment 3 2013-02-15 16:31:10 PST
(In reply to comment #1) > Can you please try running the nightly build with GuardMalloc from command line to hopefully catch the error earlier and more reproducibly? Ok, doing now. We'll see what happens.
Kevin M. Dean
Comment 4 2013-02-15 16:44:16 PST
Crashed running in the other mode. Crash doesn't really look any different. Process: WebProcess [17088] Path: /Applications/WebKit.app/Contents/Frameworks/10.8/WebKit2.framework/WebProcess.app/Contents/MacOS/WebProcess Identifier: com.apple.WebProcess Version: 537+ (537.32+) Code Type: X86-64 (Native) Parent Process: SafariForWebKitDevelopment [17086] User ID: 501 Date/Time: 2013-02-15 00:33:31.975 -0500 OS Version: Mac OS X 10.8.2 (12C60) Report Version: 10 Interval Since Last Report: 46 sec Crashes Since Last Report: 1 Per-App Interval Since Last Report: 24 sec Per-App Crashes Since Last Report: 1 Anonymous UUID: 3FB4F99D-AA2A-BF09-84EE-B9783AA375CE Crashed Thread: 0 Dispatch queue: com.apple.main-thread Exception Type: EXC_BAD_ACCESS (SIGSEGV) Exception Codes: KERN_INVALID_ADDRESS at 0x0000000000000430 VM Regions Near 0x430: --> __TEXT 000000010d08c000-000000010d08d000 [ 4K] r-x/rwx SM=COW /Applications/WebKit.app/Contents/Frameworks/10.8/WebKit2.framework/WebProcess.app/Contents/MacOS/WebProcess Application Specific Information: Bundle controller class: BrowserBundleController Thread 0 Crashed:: Dispatch queue: com.apple.main-thread 0 com.apple.JavaScriptCore 0x000000010d67c50d JSObjectGetPrivate + 13 1 com.apple.Safari.framework 0x0000000111576e69 Safari::JSWrapper::wrap(OpaqueJSContext const*, Safari::JSWrappable*) + 131 2 com.apple.Safari.framework 0x00000001114d9b75 Safari::EventTarget::handleEvent(Safari::Event*, Safari::RegisteredEventListener const&) + 87 3 com.apple.Safari.framework 0x00000001114d9a9a Safari::EventTarget::fireEventListeners(Safari::Event*, Safari::EventTargetTracker*) + 312 4 com.apple.Safari.framework 0x00000001114d96bf Safari::EventTarget::fireEventListeners(Safari::Event*) + 173 5 com.apple.Safari.framework 0x00000001114d95ce Safari::EventTarget::dispatchEvent(Safari::Event*) + 370 6 com.apple.Safari.framework 0x00000001114a14ea Safari::ContentExtension::dispatchMessageToPage(Safari::WK::String const&, Safari::WK::SerializedScriptValue const&, Safari::WK::BundlePage const&) + 128 7 com.apple.Safari.framework 0x00000001114a44c0 Safari::ContentExtension::handleMessage(Safari::WK::String const&, Safari::WK::Type const&) + 140 8 com.apple.Safari.framework 0x0000000111407582 Safari::BrowserBundleController::dispatchMessage(Safari::WK::String const&, Safari::WK::Type const&) + 62 9 com.apple.Safari.framework 0x0000000111405cc2 Safari::BrowserBundleController::didReceiveMessage(Safari::WK::Bundle const&, Safari::WK::String const&, Safari::WK::Type const&) + 40 10 com.apple.Safari.framework 0x000000011148a6e3 Safari::WK::didReceiveMessage(OpaqueWKBundle const*, OpaqueWKString const*, void const*, void const*) + 91 11 com.apple.WebKit2 0x000000010d0f0140 WebKit::InjectedBundleClient::didReceiveMessage(WebKit::InjectedBundle*, WTF::String const&, WebKit::APIObject*) + 134 12 com.apple.WebKit2 0x000000010d1ec624 WebKit::WebProcess::postInjectedBundleMessage(CoreIPC::DataReference const&) + 144 13 com.apple.WebKit2 0x000000010d1f2943 void CoreIPC::handleMessage<Messages::WebProcess::PostInjectedBundleMessage, WebKit::WebProcess, void (WebKit::WebProcess::*)(CoreIPC::DataReference const&)>(CoreIPC::MessageDecoder&, WebKit::WebProcess*, void (WebKit::WebProcess::*)(CoreIPC::DataReference const&)) + 69 14 com.apple.WebKit2 0x000000010d0d30dd CoreIPC::Connection::dispatchMessage(WTF::PassOwnPtr<CoreIPC::MessageDecoder>) + 105 15 com.apple.WebKit2 0x000000010d0d477a CoreIPC::Connection::dispatchOneMessage() + 96 16 com.apple.WebCore 0x000000010e469fd9 WebCore::RunLoop::performWork() + 153 17 com.apple.WebCore 0x000000010e46a675 WebCore::RunLoop::performWork(void*) + 53 18 com.apple.CoreFoundation 0x00007fff87db0101 __CFRUNLOOP_IS_CALLING_OUT_TO_A_SOURCE0_PERFORM_FUNCTION__ + 17 19 com.apple.CoreFoundation 0x00007fff87dafaed __CFRunLoopDoSources0 + 445 20 com.apple.CoreFoundation 0x00007fff87dd2dc5 __CFRunLoopRun + 789 21 com.apple.CoreFoundation 0x00007fff87dd26b2 CFRunLoopRunSpecific + 290 22 com.apple.HIToolbox 0x00007fff8dc4e0a4 RunCurrentEventLoopInMode + 209 23 com.apple.HIToolbox 0x00007fff8dc4de42 ReceiveNextEventCommon + 356 24 com.apple.HIToolbox 0x00007fff8dc4dcd3 BlockUntilNextEventMatchingListInMode + 62 25 com.apple.AppKit 0x00007fff8b88d613 _DPSNextEvent + 685 26 com.apple.AppKit 0x00007fff8b88ced2 -[NSApplication nextEventMatchingMask:untilDate:inMode:dequeue:] + 128 27 com.apple.AppKit 0x00007fff8b884283 -[NSApplication run] + 517 28 com.apple.WebCore 0x000000010e46ac5d WebCore::RunLoop::run() + 77 29 com.apple.WebKit2 0x000000010d163d2d int WebKit::ChildProcessMain<WebKit::WebProcess, WebKit::WebContentProcessMainDelegate>(int, char**) + 631 30 com.apple.WebProcess 0x000000010d08ce43 main + 307 31 libdyld.dylib 0x00007fff8936d7e1 start + 1
Kevin M. Dean
Comment 5 2013-02-15 16:49:39 PST
Currently crashing when I visit the following page: http://www.aintitcool.com/node/60976 Doesn't happen every time. I thinking clearing the cache first helps increase the chances of having a crash.
Alexey Proskuryakov
Comment 6 2013-02-15 20:55:14 PST
> Currently crashing when I visit the following page: Can you please attach a complete crash log? That would tell us what extensions you have installed (the crash happens in extension support code).
Kevin M. Dean
Comment 7 2013-02-15 22:42:59 PST
Created attachment 188693 [details] Crash Log
Kevin M. Dean
Comment 8 2013-02-15 22:47:54 PST
Created attachment 188694 [details] Crash Log 2 Noticed previous crash log didn't have as much data as earlier ones, so here's the first crash I had.
Kevin M. Dean
Comment 9 2013-02-15 22:49:59 PST
Note that I'm also not seeing any extensions listed in these crash logs.
Alexey Proskuryakov
Comment 10 2013-02-15 23:05:30 PST
(In reply to comment #9) > Note that I'm also not seeing any extensions listed in these crash logs. Indeed, not sure what's up with that. Can you tell us what extensions you have installed and enabled?
Kevin M. Dean
Comment 11 2013-02-16 00:27:16 PST
Copy All Links 1.0 Franker 1.3.1 BuiltWith 1.0 User CSS 1.3.2 ClicktoFlash 2.7.4 Maximieren 0.95 IMDb Links 2.4 Social Fixer 7.501 NinjaKit 0.9.1 YoutubeWide 10.0 The Tracktor 1.1 OpenSearch for Safari 1.09 NoMoreiTunes 2.3.1 autocomplete 1.0 gDirectLinks 1.0.3 IP Address and Domain Information 2.3 Ghostery 1.4.1 RSS Menu 1.9.3 3camels 1.0 Google Search by Image 1.0
Luc Jallois
Comment 12 2013-02-16 11:01:11 PST
Created attachment 188721 [details] Crash Report
Kevin M. Dean
Comment 13 2013-02-16 11:10:14 PST
(In reply to comment #12) > Created an attachment (id=188721) [details] > Crash Report That's a different crash that's being reviewed in Bug 109838 Although that crash did start around the same time as this one, so maybe they're related.
Kevin M. Dean
Comment 14 2013-02-16 14:23:02 PST
Will see if the rollout in Bug 110018 has any affect on this.
Luc Jallois
Comment 15 2013-02-16 15:33:25 PST
Created attachment 188732 [details] WebKit Crash Report
Kevin M. Dean
Comment 16 2013-02-16 21:48:12 PST
(In reply to comment #14) > Will see if the rollout in Bug 110018 has any affect on this. So far no crash with the recent nightly after this rollout, so maybe... need to test some more to be sure.
Kevin M. Dean
Comment 17 2013-02-17 13:32:50 PST
Well... no crashes anymore after that rollout for me.
Alexey Proskuryakov
Comment 18 2013-02-17 14:00:56 PST
Oh well.
Note You need to log in before you can comment on or make changes to this bug.