Bug 4357 – crash related to animated GIFs, reproducible in non-Safari WebKit application

• Status: RESOLVED
• Resolution: FIXED
• Component: WebKit Misc.

[Scott Garner]

This one is a little hard to explain, but basically once a page with an animated gif is loaded, used and 
released, *something* still tries to access the documentView containing the gif, thus causing an 
exception.

[Scott Garner]

Created attachment 3291 [details]
A small application that illustrates the bug.

[Scott Garner]

An obviously inelegant workaround that I've been using:

- (void)webView:(WebView *)sender willCloseFrame:(WebFrame *)frame
{
	WebDataSource*  dataSource;
	dataSource = [frame dataSource];
	NSEnumerator *enumerate = [[dataSource subresources] objectEnumerator];
	WebResource *curResource;
	
	while (curResource = [enumerate nextObject]) {
		if ([[curResource MIMEType] isEqualTo:@"image/gif"]) {
			NSView *documentView  = [[frame frameView] documentView];
			[documentView retain];
			break;
		}			
	}
}

The idea is to retain any DocumentViews that might contain an animated GIF.  Since this is all for an 
Automator action (Download URLs as PDFs), the resulting leak isn't terribly problematic. 

[Scott Garner]

For a little more commentary on this issue along with some attempted workarounds:

http://lists.apple.com/archives/Webkitsdk-dev//2005/Jul/msg00030.html

[Darin Adler]

Using zombie mode, I see a WebHTMLView being overreleased when I use this test program.

[Darin Adler]

I found the bug. Working on a fix.

[Darin Adler]

The problem is that this code, in a roundabout way, calls retain on a WebHTMLView object that's in its 
dealloc function. I'm fixing that now.

[Darin Adler]

By "this code", I mean "the WebImageData class".

[Darin Adler]

Created attachment 3734 [details]
patch to fix the problem (was a retain from inside dealloc!)

[Darin Adler]

Created attachment 3757 [details]
patch to fix the problem (retain inside dealloc)