Bug 264188

Summary: NSInternalInconsistencyException raised in NSView, followed by crash
Product: WebKit Reporter: Rich Siegel <siegel>
Component: WebKit APIAssignee: Nobody <webkit-unassigned>
Status: NEW ---    
Severity: Critical CC: ap, simon.fraser, webkit-bug-importer
Priority: P2 Keywords: InRadar
Version: Safari 17   
Hardware: Mac (Apple Silicon)   
OS: macOS 13   
Attachments:
Description Flags
Crash log for Yojimbo as requested none

Description Rich Siegel 2023-11-03 17:19:54 PDT 
Recently we've been getting some crash report submissions from Yojimbo customers, with the crash occurring in code that uses legacy WebKit to generate a PDF from a web site. (This code predates WKWebView and the public WebKit2 APIs for generating PDFs, so we have to keep supporting it in the field for a while.)

I've been able to reproduce it using Paparazzi <https://derailer.org/paparazzi/> , so I don't think it is a bug in our code specifically.

A public URL which reproduces this crash is <https://docs.netgate.com/pfsense/en/latest/recipes/wireguard-s2s.html>; you can plug that into Paparazzi's address bar to reproduce.

The crash takes the form of an internal exception:

Exception Name: NSInternalInconsistencyException
Description: <WebLayerHostingFlippedView 0x7f9550f23c30> has reached dealloc but still has a super view. Super views strongly reference their children, so this is being over-released, or has been over-released in the past.
User Info: {
    NSAssertFile = "NSView.m";
    NSAssertLine = 1551;
}

0   CoreFoundation                      0x00007ff804258b72 __exceptionPreprocess + 242
1   libobjc.A.dylib                     0x00007ff803d8041c objc_exception_throw + 48
2   Foundation                          0x00007ff80508fcd8 -[NSCalendarDate initWithCoder:] + 0
3   AppKit                              0x00007ff8072254fb -[NSView dealloc] + 322
4   libobjc.A.dylib                     0x00007ff803d785fc _ZN19AutoreleasePoolPage12releaseUntilEPP11objc_object + 168
5   libobjc.A.dylib                     0x00007ff803d75a89 objc_autoreleasePoolPop + 227
6   CoreFoundation                      0x00007ff8041a5a26 _CFAutoreleasePoolPop + 22
7   CoreFoundation                      0x00007ff8042ad912 __CFRunLoopPerCalloutARPEnd + 41
8   CoreFoundation                      0x00007ff8041e18d0 __CFRunLoopRun + 2490
9   CoreFoundation                      0x00007ff8041e08bc CFRunLoopRunSpecific + 560
10  HIToolbox                           0x00007ff80e12bf3d RunCurrentEventLoopInMode + 292
11  HIToolbox                           0x00007ff80e12bd4e ReceiveNextEventCommon + 657
12  HIToolbox                           0x00007ff80e12baa8 _BlockUntilNextEventMatchingListInModeWithFilter + 64
13  AppKit                              0x00007ff8071dc25c _DPSNextEvent + 858
14  AppKit                              0x00007ff8071db106 -[NSApplication(NSEvent) _nextEventMatchingEventMask:untilDate:inMode:dequeue:] + 1214
15  AppKit                              0x00007ff8071cd788 -[NSApplication run] + 586
16  AppKit                              0x00007ff8071a19a1 NSApplicationMain + 817
17  dyld                                0x0000000204e6a41f start + 1903

If the application is allowed to continue past this point, the exception is raised again, and subsequently the application will crash with what looks like an overrelease.

The WebKit framework version on my machine (macOS 13.6.1, M1) is "18615.3.12.11.2".

I do not yet know what the oldest WebKit version is that reproduces this crash. I *think* the issue is of recent onset, coincident with Safari 17 and the contemporary WebKit version, but I don't have a regression test case to back that up.

I have also filed this using Feedback Assistant as FB13332340, in case that is useful.
Comment 1 Alexey Proskuryakov 2023-11-06 10:30:07 PST 
rdar://117923158

Thank you for the report! With steps to reproduce and the sysdiagnose in Feedback Assistant, this should be actionable, however here are a few questions and comments that should help us better navigate the issue.

- Yojimbo and Paparazzi are separate products if I understand correctly; are you saying that it's happening while unreproducible in Yojimbo, and reproduces at will in Paparazzi?

- As you pointed out, the version of WebKit used corresponds to what shipped with the OS (aligned with Safari 16.x); installing Safari 17 on the machine should have to effect on these apps.

- Could you please attach some more crash logs to FB13332340, including some from Yojimbo? The one included doesn't match anything captured automatically for some reason.

- Do you happen to k ow if this reproduces in any other OS versions, especially macOS 14?

My guess at this point is that this could be a WebKit or AppKit change that went into macOS 13.6.1 or some release around that, not a Safari 17 change.
Comment 2 Rich Siegel 2023-11-06 10:59:49 PST 
Created attachment 468495 [details]
Crash log for Yojimbo as requested
Comment 3 Rich Siegel 2023-11-06 11:06:40 PST 
To answer your questions:

> - Yojimbo and Paparazzi are separate products if I understand correctly; are you saying that it's happening while unreproducible in Yojimbo, and reproduces at will in Paparazzi?

Yojimbo and Paparzzi are indeed distinct products. Using the test URL I provided, both products exhibit the same exception and crash.

> - Could you please attach some more crash logs to FB13332340, including some from Yojimbo? The one included doesn't match anything captured automatically for some reason.

Done, and I have attached a crash log from Yojimbo here as well. (The backtrace for the crash is different from the backtrace shown for the InternalConsistencyException.)

> - Do you happen to k ow if this reproduces in any other OS versions, especially macOS 14?

I have just reproduced it on macOS 14.2 (23C5030f) beta, and the backtrace is the same. The reported WebKit version from /System/Library/Frameworks is "19617.1.11.11.3".