macOS 26 beta 4 and iOS 26 beta 4 - WebKit XML parser crashes parsing XHTML with namespaces

Question

bthomale OP

Created Jul ’25

Replies 3

Boosts 1

Participants 3

Our app, VitalSource Bookshelf, is an EPUB reader that uses a WKWebView to display book content.

The EPUB content format is XHTML and uses namespaces (for the epub:type declaration).

On beta 4, the webkit process repeatedly crashes when loading our content. The crash appears to be in the XML parser. Here's what's at the top of the stack trace:

0   WebCore                       	       0x19166a878 WebCore::XMLDocumentParser::startElementNs(unsigned char const*, unsigned char const*, unsigned char const*, int, unsigned char const**, int, int, unsigned char const**) + 4968
1   libxml2.2.dylib               	       0x19c5a2bd0 xmlParseStartTag2 + 3940
2   libxml2.2.dylib               	       0x19c59e730 xmlParseTryOrFinish + 2984
3   libxml2.2.dylib               	       0x19c59d8e4 xmlParseChunk + 708
4   WebCore                       	       0x191668ec8 WebCore::XMLDocumentParser::doWrite(WTF::String const&) + 636
5   WebCore                       	       0x191665b78 WebCore::XMLDocumentParser::append(WTF::RefPtr<WTF::StringImpl, WTF::RawPtrTraits<WTF::StringImpl>, WTF::DefaultRefDerefTraits<WTF::StringImpl>>&&) + 304
6   WebCore                       	       0x190105db0 WebCore::DecodedDataDocumentParser::appendBytes(WebCore::DocumentWriter&, std::__1::span<unsigned char const, 18446744073709551615ul>) + 268
7   WebCore                       	       0x190861c3c WebCore::DocumentLoader::commitData(WebCore::SharedBuffer const&) + 1488
8   WebKit                        	       0x18e07ca3c WebKit::WebLocalFrameLoaderClient::committedLoad(WebCore::DocumentLoader*, WebCore::SharedBuffer const&) + 52
9   WebCore                       	       0x190869db4 WebCore::DocumentLoader::commitLoad(WebCore::SharedBuffer const&) + 228
10  WebCore                       	       0x1909521e4 WebCore::CachedRawResource::notifyClientsDataWasReceived(WebCore::SharedBuffer const&) + 268

I was able to reproduce this in Safari on beta 4 just by opening the following trivial xhtml file from the file system - it does the same thing it does in our app, which is reloads and crashes several times, followed by the "A problem repeatedly occurred with..." error message.

<?xml version="1.0" encoding="utf-8"?>
<!DOCTYPE html>
<html xmlns="http://www.w3.org/1999/xhtml" xmlns:epub="http://www.idpf.org/2007/ops" epub:prefix="vst: http://vitalsource.com/"><head></head><body class="dash" epub:type="chapter" data-begin-o="0" data-begin-o2="0" data-begin-o3="0" data-o="0" id="eid1844" data-end-o="14703" data-end-o2="14703" data-end-o3="14703"><h2 class="title" data-o="0" id="eid1845" data-out="33"><span class="label" data-o="0" id="eid1846"><span class="label-inner"><b data-o="0" id="eid1847">CHAPTER X</b> </span></span>THE SUBMARINE COAL-MINES</h2></body></html>

I've also filed a feedback. But posting here just to raise the visibility - this is critical for us. I think it was introduced in beta 4; that's at least when we first noticed it. It was working in the earlier betas, I just don't remember if I tried beta 3 or not.

It happens on iOS, macOS, and iPadOS.

This has never been a problem in any earlier release of macOS / iOS.

Answered by bthomale in 852583022

The feedback number was: FB19181123

It seems to be fixed in the beta 5 developer previews! Verified in Xcode beta 5 iOS 26 simulator, Tahoe beta 5 in a virtual buddy VM, and on an iOS device running the beta 5 release.

We've had users on the public beta hitting this as well in our app. Hopefully public beta 2 will be out shortly? They usually follow pretty closely after the developer releases.

Boost

Answer 1

DTS Engineer OP

Apple

Jul ’25

Hi. What is the Feedback number for the report you filed? I'm glad to check the status.

0

Answer 2

ahankinson OP

Aug ’25

I think we have also encountered this same problem when loading a webpage:

https://www.verovio.org/index.xhtml

Thread 0 Crashed:
0   WebCore                       	       0x1b70590ec WebCore::PendingCallbacks::appendCharactersCallback(std::__1::span<unsigned char const, 18446744073709551615ul>) + 76
1   WebCore                       	       0x1b406f54c WebCore::charactersHandler(void*, unsigned char const*, int) + 180
2   libxml2.2.dylib               	       0x19869b238 xmlParseCharData + 2168
3   libxml2.2.dylib               	       0x198693eac xmlParseTryOrFinish + 4380
4   libxml2.2.dylib               	       0x1986924a0 xmlParseChunk + 712
5   WebCore                       	       0x1b406e180 WebCore::XMLDocumentParser::doWrite(WTF::String const&) + 228
6   WebCore                       	       0x1b7056614 WebCore::XMLDocumentParser::append(WTF::RefPtr<WTF::StringImpl, WTF::RawPtrTraits<WTF::StringImpl>, WTF::DefaultRefDerefTraits<WTF::StringImpl>>&&) + 108
7   WebCore                       	       0x1b5bb03e8 WebCore::DecodedDataDocumentParser::appendBytes(WebCore::DocumentWriter&, std::__1::span<unsigned char const, 18446744073709551615ul>) + 208
8   WebCore                       	       0x1b628378c WebCore::DocumentLoader::commitData(WebCore::SharedBuffer const&) + 1668
9   WebKit                        	       0x1b8af54e8 WebKit::WebLocalFrameLoaderClient::committedLoad(WebCore::DocumentLoader*, WebCore::SharedBuffer const&) + 56
10  WebCore                       	       0x1b6289f4c WebCore::DocumentLoader::commitLoad(WebCore::SharedBuffer const&) + 256

The page is XHTML with an opening tag of:

<html lang="en" xml:lang="en" xmlns:svg="http://www.w3.org/2000/svg" xmlns="http://www.w3.org/1999/xhtml">

0

Answer 3

bthomale OP

Aug ’25

Accepted Answer

The feedback number was: FB19181123

It seems to be fixed in the beta 5 developer previews! Verified in Xcode beta 5 iOS 26 simulator, Tahoe beta 5 in a virtual buddy VM, and on an iOS device running the beta 5 release.

We've had users on the public beta hitting this as well in our app. Hopefully public beta 2 will be out shortly? They usually follow pretty closely after the developer releases.

0