Crash with QtWebEngine on macOS (Hardened Runtime)

[Dmitry Kravchenko]

Hi!

I'm developing an application with Qt 5.9.3 on macOS. My application uses QtWebEngine framework to display Web pages. QtWebEngine in turn uses Chromium/Blink code for rendering. It all worked successfully until recently Apple demanded all apps on macOS 10.15 to be notarized. Notarization involves enabling hardened runtime. After I enabled hardened runtime, QtWebEngine stopped working: nothing is rendered and in the background QtWebEngineProcess crashes repeatedly.

Why I'm asking for help here is because judging by call stack QtWebEngineProcess crashes inside Chromium code (specifically, Blink -> V8):

Thread 0 Crashed:: CrRendererMain  Dispatch queue: com.apple.main-thread
0   org.qt-project.Qt.QtWebEngineCore	0x000000010c32fdbe v8::internal::Deoptimizer::GetDeoptimizationEntry(v8::internal::Isolate*, int, v8::internal::Deoptimizer::BailoutType, v8::internal::Deoptimizer::GetEntryMode) + 94
1   org.qt-project.Qt.QtWebEngineCore	0x000000010c3703e1 v8::internal::ExternalReferenceTable::AddDeoptEntries(v8::internal::Isolate*) + 97
2   org.qt-project.Qt.QtWebEngineCore	0x000000010c36bc02 v8::internal::ExternalReferenceTable::ExternalReferenceTable(v8::internal::Isolate*) + 210
3   org.qt-project.Qt.QtWebEngineCore	0x000000010c36bb0e v8::internal::ExternalReferenceTable::instance(v8::internal::Isolate*) + 46
4   org.qt-project.Qt.QtWebEngineCore	0x000000010c6d72d9 v8::internal::Deserializer::Deserialize(v8::internal::Isolate*) + 25
5   org.qt-project.Qt.QtWebEngineCore	0x000000010c478d46 v8::internal::Isolate::Init(v8::internal::Deserializer*) + 9878
6   org.qt-project.Qt.QtWebEngineCore	0x000000010c6dfb53 v8::internal::Snapshot::Initialize(v8::internal::Isolate*) + 723
7   org.qt-project.Qt.QtWebEngineCore	0x000000010bfbdf09 v8::Isolate::New(v8::Isolate::CreateParams const&) + 361
8   org.qt-project.Qt.QtWebEngineCore	0x000000010bf8750c gin::IsolateHolder::IsolateHolder(gin::IsolateHolder::AccessMode) + 284
9   org.qt-project.Qt.QtWebEngineCore	0x000000010d2e9cbf blink::V8PerIsolateData::V8PerIsolateData() + 31
10  org.qt-project.Qt.QtWebEngineCore	0x000000010d2ea382 blink::V8PerIsolateData::initialize() + 34
11  org.qt-project.Qt.QtWebEngineCore	0x000000010d2e38cb blink::V8Initializer::initializeMainThread() + 107
12  org.qt-project.Qt.QtWebEngineCore	0x000000010d267ac4 blink::initialize(blink::Platform*) + 20
13  org.qt-project.Qt.QtWebEngineCore	0x000000010cedc97e content::RenderThreadImpl::InitializeWebKit(scoped_refptr<base::SingleThreadTaskRunner>&) + 174
14  org.qt-project.Qt.QtWebEngineCore	0x000000010cedaecc content::RenderThreadImpl::Init(scoped_refptr<base::SingleThreadTaskRunner>&) + 300
15  org.qt-project.Qt.QtWebEngineCore	0x000000010ceda65a content::RenderThreadImpl::RenderThreadImpl(std::__1::unique_ptr<base::MessageLoop, std::__1::default_delete<base::MessageLoop> >, std::__1::unique_ptr<blink::scheduler::RendererScheduler, std::__1::default_delete<blink::scheduler::RendererScheduler> >) + 1434
16  org.qt-project.Qt.QtWebEngineCore	0x000000010ceda07c content::RenderThreadImpl::Create(std::__1::unique_ptr<base::MessageLoop, std::__1::default_delete<base::MessageLoop> >, std::__1::unique_ptr<blink::scheduler::RendererScheduler, std::__1::default_delete<blink::scheduler::RendererScheduler> >) + 76
17  org.qt-project.Qt.QtWebEngineCore	0x000000010cf0b165 content::RendererMain(content::MainFunctionParams const&) + 517
18  org.qt-project.Qt.QtWebEngineCore	0x000000010aa395b5 content::ContentMainRunnerImpl::Run() + 437
19  org.qt-project.Qt.QtWebEngineCore	0x000000010aa38976 content::ContentMain(content::ContentMainParams const&) + 54
20  org.qt-project.Qt.QtWebEngineCore	0x0000000109ee2e36 QtWebEngine::processMain(int, char const**) + 70
21  org.qt-project.Qt.QtWebEngineProcess	0x0000000109e99f54 0x109e95000 + 20308
22  libdyld.dylib                 	0x00007fff7e1433d5 start + 1

Can you please help me to find out exactly why Blink / V8 is crashing here? That would help me to workaround this.

I already asked on Qt forum, with no reply, and by the way, here's another developer experiencing similar issue with QtWebEngine: https://forum.qt.io/topic/102212/qtwebengine-signing-issues .
I tried what he suggests: adding entitlement to QtWebEngineProcess, with no success. I'm attaching a full crash report from QtWebEngineProcess with that entitlement enabled.

Thanks in advance!

[Avi Drissman]

This is deep in V8; perhaps the V8 folks can help? https://groups.google.com/group/v8-dev

I asked our code signing/notarization expert and this isn’t obviously misbehaving due to code signing.

[Dave Tapuska]

The article you point to says about "com.apple.security.cs.disable-executable-page-protection" Being that it is creating a new isolate. I'd expect this to be something to do with the executable pages V8 creates.

Perhaps you aren't setting it correctly as per the suggestion? You could also https://developer.apple.com/documentation/security/hardened_runtime_entitlements specifically around MAP_JIT.. Because we do set MAP_JIT on the pages.. see

https://cs.chromium.org/chromium/src/base/allocator/partition_allocator/page_allocator_internals_posix.h?q=MAP_JIT&sq=package:chromium&g=0&l=106

dave.

--
You received this message because you are subscribed to the Google Groups "blink-dev" group.
To unsubscribe from this group and stop receiving emails from it, send an email to blink-dev+...@chromium.org.
To view this discussion on the web visit https://groups.google.com/a/chromium.org/d/msgid/blink-dev/defd34a8-7a27-42b8-80fb-3a27f7a73798%40chromium.org.

[Dmitry Kravchenko]

Thanks for replies!

четверг, 19 сентября 2019 г., 0:04:54 UTC+7 пользователь Dmitry Kravchenko написал:

[Dmitry Kravchenko]

I think I'm setting it correctly. Here is what 'codesign' displays:

Dmitriys-Mac-mini:Frameworks kdg$ cd QtWebEngineCore.framework/Helpers

Dmitriys-Mac-mini:Helpers kdg$ codesign -d --entitlements :- ./QtWebEngineProcess.app
Executable=/MyFolder/Projects/MyApp/mac/build/Build/Products/Release/myapp_pkg/Applications/MyApp/MyApp.app/Contents/Frameworks/QtWebEngineCore.framework/Versions/5/Helpers/QtWebEngineProcess.app/Contents/MacOS/QtWebEngineProcess
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
    <key>com.apple.security.cs.disable-executable-page-protection</key>
    <true/>
</dict>
</plist>

I also tried adding all entitlements listed here: https://developer.apple.com/documentation/bundleresources/entitlements , with no success.

четверг, 19 сентября 2019 г., 1:31:26 UTC+7 пользователь Dave Tapuska написал:

To unsubscribe from this group and stop receiving emails from it, send an email to blin...@chromium.org.