Bug 242884

Summary:	Tests that resize the view (e.g. accessibility/visible-character-range-width-changes.html) trigger assertion under RemoteLayerTreeDrawingAreaProxy::didUpdateGeometry()
Product:	WebKit	Reporter:	Simon Fraser (smfr) <simon.fraser>
Component:	Tools / Tests	Assignee:	Cameron McCormack (:heycam) <heycam>
Status:	RESOLVED FIXED
Severity:	Normal	CC:	ap, heycam, simon.fraser, thorton, tyler_w, webkit-bug-importer, wenson_hsieh
Priority:	P2	Keywords:	InRadar
Version:	Safari Technology Preview
Hardware:	Unspecified
OS:	Unspecified
See Also:	https://bugs.webkit.org/show_bug.cgi?id=237678 https://bugs.webkit.org/show_bug.cgi?id=242832

Description Simon Fraser (smfr) 2022-07-18 20:08:21 PDT

Running accessibility/visible-character-range-width-changes.html in the simulator results in a crash:

Thread 0 Crashed::  Dispatch queue: com.apple.main-thread
0   JavaScriptCore                	       0x10c2ca97e WTFCrash + 14 (Assertions.cpp:328)
1   WebKit                        	       0x12a12aafb WTFCrashWithInfo(int, char const*, char const*, int) + 27 (Assertions.h:754)
2   WebKit                        	       0x12b7e7868 WebKit::RemoteLayerTreeDrawingAreaProxy::didUpdateGeometry() + 104 (RemoteLayerTreeDrawingAreaProxy.mm:188)
3   WebKit                        	       0x12a202dab void IPC::callMemberFunctionImpl<WebKit::DrawingAreaProxy, void (WebKit::DrawingAreaProxy::*)(), std::__1::tuple<> >(WebKit::DrawingAreaProxy*, void (WebKit::DrawingAreaProxy::*)(), std::__1::tuple<>&&, std::__1::integer_sequence<unsigned long>) + 123 (HandleMessage.h:131)
4   WebKit                        	       0x12a202d1d void IPC::callMemberFunction<WebKit::DrawingAreaProxy, void (WebKit::DrawingAreaProxy::*)(), std::__1::tuple<>, std::__1::integer_sequence<unsigned long> >(std::__1::tuple<>&&, WebKit::DrawingAreaProxy*, void (WebKit::DrawingAreaProxy::*)()) + 109 (HandleMessage.h:137)
5   WebKit                        	       0x12a1fd6ac void IPC::handleMessage<Messages::DrawingAreaProxy::DidUpdateGeometry, WebKit::DrawingAreaProxy, void (WebKit::DrawingAreaProxy::*)()>(IPC::Connection&, IPC::Decoder&, WebKit::DrawingAreaProxy*, void (WebKit::DrawingAreaProxy::*)()) + 204 (HandleMessage.h:259)
6   WebKit                        	       0x12a1fd0fa WebKit::DrawingAreaProxy::didReceiveMessage(IPC::Connection&, IPC::Decoder&) + 426 (DrawingAreaProxyMessageReceiver.cpp:57)
7   WebKit                        	       0x12a729756 WebKit::RemoteLayerTreeDrawingAreaProxy::didReceiveMessage(IPC::Connection&, IPC::Decoder&) + 294 (RemoteLayerTreeDrawingAreaProxyMessageReceiver.cpp:49)
8   WebKit                        	       0x12b6546b3 IPC::MessageReceiverMap::dispatchMessage(IPC::Connection&, IPC::Decoder&) + 387 (MessageReceiverMap.cpp:129)
9   WebKit                        	       0x12bb6deac WebKit::AuxiliaryProcessProxy::dispatchMessage(IPC::Connection&, IPC::Decoder&) + 44 (AuxiliaryProcessProxy.cpp:271)
10  WebKit                        	       0x12bd4f8d9 WebKit::WebProcessProxy::didReceiveMessage(IPC::Connection&, IPC::Decoder&) + 41 (WebProcessProxy.cpp:839)
11  WebKit                        	       0x12b61efb0 IPC::Connection::dispatchMessage(IPC::Decoder&) + 544 (Connection.cpp:1104)
12  WebKit                        	       0x12b61f6a5 IPC::Connection::dispatchMessage(std::__1::unique_ptr<IPC::Decoder, std::__1::default_delete<IPC::Decoder> >) + 629 (Connection.cpp:1149)
13  WebKit                        	       0x12b618ae3 IPC::Connection::SyncMessageState::ConnectionAndIncomingMessage::dispatch() + 67 (Connection.cpp:125)
14  WebKit                        	       0x12b6187b6 IPC::Connection::SyncMessageState::dispatchMessages(WTF::Function<void (IPC::MessageName, unsigned long long)>&&) + 550 (Connection.cpp:217)
15  WebKit                        	       0x12b61ea5a IPC::Connection::dispatchSyncMessage(IPC::Decoder&) + 586 (Connection.cpp:1008)
16  WebKit                        	       0x12b61f68b IPC::Connection::dispatchMessage(std::__1::unique_ptr<IPC::Decoder, std::__1::default_delete<IPC::Decoder> >) + 603 (Connection.cpp:1147)
17  WebKit                        	       0x12b618ae3 IPC::Connection::SyncMessageState::ConnectionAndIncomingMessage::dispatch() + 67 (Connection.cpp:125)
18  WebKit                        	       0x12b6187b6 IPC::Connection::SyncMessageState::dispatchMessages(WTF::Function<void (IPC::MessageName, unsigned long long)>&&) + 550 (Connection.cpp:217)
19  WebKit                        	       0x12b61c7bc IPC::Connection::waitForSyncReply(WTF::ObjectIdentifier<IPC::Connection::SyncRequestIDType>, IPC::MessageName, IPC::Timeout, WTF::OptionSet<IPC::SendSyncOption>) + 236 (Connection.cpp:694)
20  WebKit                        	       0x12b61b7a8 IPC::Connection::sendSyncMessage(WTF::ObjectIdentifier<IPC::Connection::SyncRequestIDType>, WTF::UniqueRef<IPC::Encoder>&&, IPC::Timeout, WTF::OptionSet<IPC::SendSyncOption>) + 680 (Connection.cpp:675)
21  WebKit                        	       0x12b61af04 IPC::Connection::sendMessage(WTF::UniqueRef<IPC::Encoder>&&, WTF::OptionSet<IPC::SendOption>, std::__1::optional<WTF::Thread::QOS>) + 628 (Connection.cpp:493)
22  WebKit                        	       0x12bb6da3c WebKit::AuxiliaryProcessProxy::sendMessage(WTF::UniqueRef<IPC::Encoder>&&, WTF::OptionSet<IPC::SendOption>, std::__1::optional<std::__1::pair<WTF::CompletionHandler<void (IPC::Decoder*)>, unsigned long long> >&&, WebKit::AuxiliaryProcessProxy::ShouldStartProcessThrottlerActivity) + 1068 (AuxiliaryProcessProxy.cpp:232)
23  WebKit                        	       0x12bb72099 WebKit::DrawingAreaProxy::sendMessage(WTF::UniqueRef<IPC::Encoder>&&, WTF::OptionSet<IPC::SendOption>, std::__1::optional<std::__1::pair<WTF::CompletionHandler<void (IPC::Decoder*)>, unsigned long long> >&&) + 89 (DrawingAreaProxy.cpp:90)
24  WebKit                        	       0x12b7f7e90 bool IPC::MessageSender::send<Messages::DrawingArea::UpdateGeometry>(Messages::DrawingArea::UpdateGeometry&&, unsigned long long, WTF::OptionSet<IPC::SendOption>) + 192 (MessageSender.h:49)
25  WebKit                        	       0x12b7e78fb bool IPC::MessageSender::send<Messages::DrawingArea::UpdateGeometry>(Messages::DrawingArea::UpdateGeometry&&, WTF::OptionSet<IPC::SendOption>) + 75 (MessageSender.h:40)
26  WebKit                        	       0x12b7e76cb WebKit::RemoteLayerTreeDrawingAreaProxy::sendUpdateGeometry() + 123 (RemoteLayerTreeDrawingAreaProxy.mm:201)
27  WebKit                        	       0x12b7e7646 WebKit::RemoteLayerTreeDrawingAreaProxy::sizeDidChange() + 70 (RemoteLayerTreeDrawingAreaProxy.mm:178)
28  WebKit                        	       0x12bb71ece WebKit::DrawingAreaProxy::setSize(WebCore::IntSize const&, WebCore::IntSize const&) + 126 (DrawingAreaProxy.cpp:72)
29  WebKit                        	       0x12b5ad4a7 -[WKWebView(WKViewInternalIOS) _frameOrBoundsChanged] + 1111 (WKWebViewIOS.mm:2149)
30  WebKit                        	       0x12b599215 -[WKWebView(WKViewInternalIOS) setFrame:] + 325 (WKWebViewIOS.mm:129)
31  WebKitTestRunnerApp           	       0x10013cb4f WTR::PlatformWebView::setWindowFrame(WKRect, WTR::PlatformWebView::WebViewSizingMode) + 287 (PlatformWebViewIOS.mm:313)
32  WebKitTestRunnerApp           	       0x10013c970 WTR::PlatformWebView::resizeTo(unsigned int, unsigned int, WTR::PlatformWebView::WebViewSizingMode) + 160 (PlatformWebViewIOS.mm:284)
33  WebKitTestRunnerApp           	       0x1001c58f7 WTR::TestInvocation::didReceiveSynchronousMessageFromInjectedBundle(OpaqueWKString const*, void const*) + 1207 (TestInvocation.cpp:879)
34  WebKitTestRunnerApp           	       0x100173f07 WTR::TestController::didReceiveSynchronousMessageFromInjectedBundle(OpaqueWKString const*, void const*, OpaqueWKMessageListener const*) + 2903 (TestController.cpp:1990)
35  WebKitTestRunnerApp           	       0x10016cbc1 WTR::TestController::didReceiveSynchronousPageMessageFromInjectedBundleWithListener(OpaqueWKPage const*, OpaqueWKString const*, void const*, OpaqueWKMessageListener const*, void const*) + 49 (TestController.cpp:1666)
36  WebKit                        	       0x12bcdfdcb WebKit::WebPageInjectedBundleClient::didReceiveSynchronousMessageFromInjectedBundle(WebKit::WebPageProxy*, WTF::String const&, API::Object*, WTF::CompletionHandler<void (WTF::RefPtr<API::Object, WTF::RawPtrTraits<API::Object>, WTF::DefaultRefDerefTraits<API::Object> >)>&&) + 475 (WebPageInjectedBundleClient.cpp:58)
37  WebKit                        	       0x12bce91af WebKit::WebPageProxy::handleSynchronousMessage(IPC::Connection&, WTF::String const&, WebKit::UserData const&, WTF::CompletionHandler<void (WebKit::UserData&&)>&&) + 431 (WebPageProxy.cpp:862)
38  WebKit                        	       0x12cbf15f8 void IPC::callMemberFunctionImpl<WebKit::WebPageProxy, void (WebKit::WebPageProxy::*)(IPC::Connection&, WTF::String const&, WebKit::UserData const&, WTF::CompletionHandler<void (WebKit::UserData&&)>&&), void (WebKit::UserData&&), std::__1::tuple<WTF::String, WebKit::UserData>, 0ul, 1ul>(IPC::Connection&, WebKit::WebPageProxy*, void (WebKit::WebPageProxy::*)(IPC::Connection&, WTF::String const&, WebKit::UserData const&, WTF::CompletionHandler<void (WebKit::UserData&&)>&&), WTF::CompletionHandler<void (WebKit::UserData&&)>&&, std::__1::tuple<WTF::String, WebKit::UserData>&&, std::__1::integer_sequence<unsigned long, 0ul, 1ul>) + 216 (HandleMessage.h:159)
39  WebKit                        	       0x12cbf14bb void IPC::callMemberFunction<WebKit::WebPageProxy, void (WebKit::WebPageProxy::*)(IPC::Connection&, WTF::String const&, WebKit::UserData const&, WTF::CompletionHandler<void (WebKit::UserData&&)>&&), void (WebKit::UserData&&), std::__1::tuple<WTF::String, WebKit::UserData>, std::__1::integer_sequence<unsigned long, 0ul, 1ul> >(IPC::Connection&, std::__1::tuple<WTF::String, WebKit::UserData>&&, WTF::CompletionHandler<void (WebKit::UserData&&)>&&, WebKit::WebPageProxy*, void (WebKit::WebPageProxy::*)(IPC::Connection&, WTF::String const&, WebKit::UserData const&, WTF::CompletionHandler<void (WebKit::UserData&&)>&&)) + 203 (HandleMessage.h:165)
40  WebKit                        	       0x12cabb4fa bool IPC::handleMessageSynchronousWantsConnection<Messages::WebPageProxy::HandleSynchronousMessage, WebKit::WebPageProxy, void (WebKit::WebPageProxy::*)(IPC::Connection&, WTF::String const&, WebKit::UserData const&, WTF::CompletionHandler<void (WebKit::UserData&&)>&&)>(IPC::Connection&, IPC::Decoder&, WTF::UniqueRef<IPC::Encoder>&, WebKit::WebPageProxy*, void (WebKit::WebPageProxy::*)(IPC::Connection&, WTF::String const&, WebKit::UserData const&, WTF::CompletionHandler<void (WebKit::UserData&&)>&&)) + 410 (HandleMessage.h:305)
41  WebKit                        	       0x12cab6c28 WebKit::WebPageProxy::didReceiveSyncMessage(IPC::Connection&, IPC::Decoder&, WTF::UniqueRef<IPC::Encoder>&) + 4536 (WebPageProxyMessageReceiver.cpp:2093)
42  WebKit                        	       0x12b654980 IPC::MessageReceiverMap::dispatchSyncMessage(IPC::Connection&, IPC::Decoder&, WTF::UniqueRef<IPC::Encoder>&) + 400 (MessageReceiverMap.cpp:144)
43  WebKit                        	       0x12bb6def4 WebKit::AuxiliaryProcessProxy::dispatchSyncMessage(IPC::Connection&, IPC::Decoder&, WTF::UniqueRef<IPC::Encoder>&) + 52 (AuxiliaryProcessProxy.cpp:276)
44  WebKit                        	       0x12bd4f9d1 WebKit::WebProcessProxy::didReceiveSyncMessage(IPC::Connection&, IPC::Decoder&, WTF::UniqueRef<IPC::Encoder>&) + 49 (WebProcessProxy.cpp:855)
45  WebKit                        	       0x12b61ea8a IPC::Connection::dispatchSyncMessage(IPC::Decoder&) + 634 (Connection.cpp:1011)
46  WebKit                        	       0x12b61f68b IPC::Connection::dispatchMessage(std::__1::unique_ptr<IPC::Decoder, std::__1::default_delete<IPC::Decoder> >) + 603 (Connection.cpp:1147)
47  WebKit                        	       0x12b618ae3 IPC::Connection::SyncMessageState::ConnectionAndIncomingMessage::dispatch() + 67 (Connection.cpp:125)
48  WebKit                        	       0x12b618d78 IPC::Connection::SyncMessageState::dispatchMessagesAndResetDidScheduleDispatchMessagesForConnection(IPC::Connection&) + 632 (Connection.cpp:240)
49  WebKit                        	       0x12b630cfc IPC::Connection::SyncMessageState::processIncomingMessage(IPC::Connection&, std::__1::unique_ptr<IPC::Decoder, std::__1::default_delete<IPC::Decoder> >&)::$_5::operator()() + 44 (Connection.cpp:190)
50  WebKit                        	       0x12b630c29 WTF::Detail::CallableWrapper<IPC::Connection::SyncMessageState::processIncomingMessage(IPC::Connection&, std::__1::unique_ptr<IPC::Decoder, std::__1::default_delete<IPC::Decoder> >&)::$_5, void>::call() + 25 (Function.h:53)
51  JavaScriptCore                	       0x10c2f6852 WTF::Function<void ()>::operator()() const + 130 (Function.h:82)
52  JavaScriptCore                	       0x10c3861f2 WTF::RunLoop::performWork() + 322 (RunLoop.cpp:133)
53  JavaScriptCore                	       0x10c389b2e WTF::RunLoop::performWork(void*) + 30 (RunLoopCF.cpp:46)
54  CoreFoundation                	       0x1052ae833 __CFRUNLOOP_IS_CALLING_OUT_TO_A_SOURCE0_PERFORM_FUNCTION__ + 17
55  CoreFoundation                	       0x1052ae72b __CFRunLoopDoSource0 + 180
56  CoreFoundation                	       0x1052adbf8 __CFRunLoopDoSources0 + 242
57  CoreFoundation                	       0x1052a82f4 __CFRunLoopRun + 871
58  CoreFoundation                	       0x1052a7a90 CFRunLoopRunSpecific + 562
59  Foundation                    	       0x1020dce31 -[NSRunLoop(NSRunLoop) runMode:beforeDate:] + 213
60  WebKitTestRunnerApp           	       0x1001aa202 WTR::TestController::platformRunUntil(bool&, WTF::Seconds) + 290 (TestControllerCocoa.mm:261)
61  WebKitTestRunnerApp           	       0x10016a82f WTR::TestController::runUntil(bool&, WTF::Seconds) + 79 (TestController.cpp:1628)
62  WebKitTestRunnerApp           	       0x1001c1ca6 WTR::TestInvocation::invoke() + 406 (TestInvocation.cpp:173)
63  WebKitTestRunnerApp           	       0x100172aa5 WTR::TestController::runTest(char const*) + 581 (TestController.cpp:1558)
64  WebKitTestRunnerApp           	       0x100172ec1 WTR::TestController::runTestingServerLoop() + 225 (TestController.cpp:1604)
65  WebKitTestRunnerApp           	       0x10016b237 WTR::TestController::run() + 39 (TestController.cpp:1612)
66  WebKitTestRunnerApp           	       0x10016aba0 WTR::TestController::TestController(int, char const**) + 848 (TestController.cpp:196)
67  WebKitTestRunnerApp           	       0x10016b303 WTR::TestController::TestController(int, char const**) + 35 (TestController.cpp:193)
68  WebKitTestRunnerApp           	       0x10013a6cc -[WebKitTestRunnerApp _runTestController] + 44 (mainIOS.mm:45)
69  Foundation                    	       0x1021063bf __NSThreadPerformPerform + 179
70  CoreFoundation                	       0x1052ae833 __CFRUNLOOP_IS_CALLING_OUT_TO_A_SOURCE0_PERFORM_FUNCTION__ + 17
71  CoreFoundation                	       0x1052ae72b __CFRunLoopDoSource0 + 180
72  CoreFoundation                	       0x1052adc5a __CFRunLoopDoSources0 + 340
73  CoreFoundation                	       0x1052a82f4 __CFRunLoopRun + 871
74  CoreFoundation                	       0x1052a7a90 CFRunLoopRunSpecific + 562
75  GraphicsServices              	       0x100e67c8e GSEventRunModal + 139
76  UIKitCore                     	       0x1253e890e -[UIApplication _run] + 928
77  UIKitCore                     	       0x1253ed569 UIApplicationMain + 101
78  WebKitTestRunnerApp           	       0x10013a854 main + 84 (mainIOS.mm:74)

Comment 1 Simon Fraser (smfr) 2022-07-18 20:16:15 PDT

The test calls visibleRange() which resizes the web view to 100x500 via a synchronous SetViewSize message from the web process to the UI process. This ends up in `RemoteLayerTreeDrawingAreaProxy::sendUpdateGeometry()` which sends a sync DrawingArea::UpdateGeometry message to the web process. While sending that message we receive a `RemoteLayerTreeDrawingAreaProxy::didUpdateGeometry` message and assert.

Comment 2 Simon Fraser (smfr) 2022-07-18 20:20:03 PDT

It looks like this test has been crashing since it was added.

Comment 3 Radar WebKit Bug Importer 2022-07-25 20:09:15 PDT

<rdar://problem/97583976>

Comment 4 Cameron McCormack (:heycam) 2022-10-25 21:33:35 PDT

*** Bug 246971 has been marked as a duplicate of this bug. ***

Comment 5 Cameron McCormack (:heycam) 2022-10-25 21:39:18 PDT

Pull request: https://github.com/WebKit/WebKit/pull/5797

Comment 6 EWS 2022-10-26 17:16:06 PDT

Committed 256042@main (216acdc0bca8): <https://commits.webkit.org/256042@main>

Reviewed commits have been landed. Closing PR #5797 and removing active labels.