Bug 244338

Summary:

Test addition (250224@main): [ macOS wk1 Debug ] storage/domstorage/sessionstorage/window-open-remove-item.html is a consistent crash

Product:

WebKit

Reporter:

Karl Rackler <rackler>

Component:

New Bugs

Assignee:

Chris Dumez <cdumez>

Status:

RESOLVED FIXED

Severity:

Normal

CC:

cdumez, sihui_liu, webkit-bot-watchers-bugzilla, webkit-bug-importer

Priority:

Keywords:

InRadar

Version:

WebKit Nightly Build

Hardware:

Unspecified

OS:

Unspecified

Attachments:

Description	Flags
Crash Log	none

Description Karl Rackler 2022-08-25 10:03:00 PDT

Description:
storage/domstorage/sessionstorage/window-open-remove-item.html

This test was added at 250224@main and has been a consistent crash since.

REPRODUCTION STEPS
I can reproduce this on <commit> but cannot reproduce it on <commit> or earlier.

Command: 
run-webkit-tests --debug -1 --exit-after-n-failures 1 --exit-after-n-crashes-or-timeouts 1 --iterations 50 -f --no-retry storage/domstorage/sessionstorage/window-open-remove-item.html

Result: 
Regressions: Unexpected crashes (1)
  storage/domstorage/sessionstorage/window-open-remove-item.html [ Crash ]

History:
https://results.webkit.org/?suite=layout-tests&test=storage%2Fdomstorage%2Fsessionstorage%2Fwindow-open-remove-item.html&platform=mac&flavor=wk1&limit=50000&style=debug

Crash Log:
Thread 0 Crashed::   Dispatch queue: com.apple.main-thread
0   com.apple.JavaScriptCore      	       0x11653910e        WTFCrash
1   DumpRenderTree                	       0x102ba00fa        WTFCrashWithInfo(int, char const*, char const*, int)
2   DumpRenderTree                	       0x102c762ba        -[UIDelegate webView:createWebViewWithRequest:]
3   com.apple.WebKitLegacy        	       0x1073c9d8c        objc_object* wtfObjCMsgSend<objc_object*, WebView*, objc_object*>(objc_object*, objc_selector*, WebView*, objc_object*)
4   com.apple.WebKitLegacy        	       0x1073c714a        CallDelegate(WebView*, objc_object*, objc_selector*, objc_object*)
5   com.apple.WebKitLegacy        	       0x1073c70e4        CallUIDelegate(WebView*, objc_selector*, objc_object*)

Comment 1 Radar WebKit Bug Importer 2022-08-25 10:03:21 PDT

<rdar://problem/99143234>

Comment 2 Karl Rackler 2022-08-25 10:09:07 PDT

Created attachment 461859 [details]
Crash Log

Comment 3 Karl Rackler 2022-08-25 10:09:59 PDT

I have marked this test as a consistent crash while this issue is investigated.

Comment 4 EWS 2022-08-25 11:00:53 PDT

Test gardening commit 253781@main (44592aa28081): <https://commits.webkit.org/253781@main>

Reviewed commits have been landed. Closing PR #3657 and removing active labels.

Comment 5 Ryan Haddad 2022-08-25 12:55:28 PDT

ASSERTION FAILED: gTestRunner->waitToDump()
/Volumes/Data/worker/Apple-BigSur-Debug-Build/build/Tools/DumpRenderTree/mac/UIDelegate.mm(179) : -[UIDelegate webView:createWebViewWithRequest:]
1   0x10aa25129 WTFCrash
2   0x10464efab WTFCrashWithInfo(int, char const*, char const*, int)
3   0x10474ca8e -[UIDelegate webView:createWebViewWithRequest:]
4   0x10926828d objc_object* wtfObjCMsgSend<objc_object*, WebView*, objc_object*>(objc_object*, objc_selector*, WebView*, objc_object*)
5   0x1092656ba CallDelegate(WebView*, objc_object*, objc_selector*, objc_object*)
6   0x109265655 CallUIDelegate(WebView*, objc_selector*, objc_object*)
7   0x10924b195 WebChromeClient::createWindow(WebCore::Frame&, WebCore::WindowFeatures const&, WebCore::NavigationAction const&)
8   0x134c11492 WebCore::Chrome::createWindow(WebCore::Frame&, WebCore::WindowFeatures const&, WebCore::NavigationAction const&) const
9   0x134a59a80 WebCore::createWindow(WebCore::Frame&, WebCore::Frame&, WebCore::FrameLoadRequest&&, WebCore::WindowFeatures&, bool&)
10  0x134c39bde WebCore::DOMWindow::createWindow(WTF::String const&, WTF::AtomString const&, WebCore::WindowFeatures const&, WebCore::DOMWindow&, WebCore::Frame&, WebCore::Frame&, WTF::Function<void (WebCore::DOMWindow&)> const&)
11  0x134c3afbf WebCore::DOMWindow::open(WebCore::DOMWindow&, WebCore::DOMWindow&, WTF::String const&, WTF::AtomString const&, WTF::String const&)
12  0x130e2b159 WebCore::jsDOMWindowInstanceFunction_openBody(JSC::JSGlobalObject*, JSC::CallFrame*, WebCore::JSDOMWindow*)
13  0x130e2a9aa long long WebCore::IDLOperation<WebCore::JSDOMWindow>::call<&(WebCore::jsDOMWindowInstanceFunction_openBody(JSC::JSGlobalObject*, JSC::CallFrame*, WebCore::JSDOMWindow*)), (WebCore::CastedThisErrorBehavior)0>(JSC::JSGlobalObject&, JSC::CallFrame&, char const*)
14  0x130e28a04 WebCore::jsDOMWindowInstanceFunction_open(JSC::JSGlobalObject*, JSC::CallFrame*)
15  0x3a329820c038
16  0x10b1736a4 llint_entry
17  0x10b14f1a0 vmEntryToJavaScript

Comment 6 Chris Dumez 2022-08-25 13:12:40 PDT

The fix is trivial, just call window.open() in the load event handler.

Comment 7 Chris Dumez 2022-08-25 15:05:19 PDT

Pull request: https://github.com/WebKit/WebKit/pull/3657

Comment 8 Chris Dumez 2022-08-25 15:09:00 PDT

Pull request: https://github.com/WebKit/WebKit/pull/3678

Comment 9 EWS 2022-08-25 22:52:08 PDT

Committed 253806@main (118ff24f776c): <https://commits.webkit.org/253806@main>

Reviewed commits have been landed. Closing PR #3678 and removing active labels.