100930 2012-11-01 01:44:40 -0700 [Chromium] debug builds: Use after free under ~PageOverlay() 2012-11-01 09:51:42 -0700 1 1 1 Unclassified WebKit Web Inspector (Deprecated) 528+ (Nightly build) Unspecified All RESOLVED FIXED P2 Normal --- 0 tapted vsevik apavlov danakj fsamuel jamesr keishi loislo pfeldman pmuellr vsevik web-inspector-bugs webkit.review.bot yurys oldest_to_newest 755990 0 tapted 2012-11-01 01:44:40 -0700 Downstream bug: http://crbug.com/157097 What steps will reproduce the problem? 0. Run a debug build of Chromium 1. Open a packaged app Shell window, or popout a Google Chat Panel window 2. Right-click -> Inspect Element, Developer tools opens in new window 3. Close the original Shell/Panel Window 4. segfault around: void GraphicsLayer::willBeDestroyed() { #ifndef NDEBUG if (m_client) m_client->verifyNotPainting(); #endif This code added in bug 81954 (from March) The problem is that WebKit::PageOverlay is declared like this: class PageOverlay { /* snip */ WebViewImpl* m_viewImpl; WebPageOverlay* m_overlay; OwnPtr<WebCore::GraphicsLayer> m_layer; OwnPtr<WebCore::GraphicsLayerClient> m_layerClient; int m_zOrder; }; So m_layerClient will be destroyed before m_layer at the end of ~PageOverlay(). So, it is not valid for GraphicsLayer::willBeDestroyed (called from the ~GraphicsLayerChromium leaf class) to access its own GraphicsLayerClient data member in this situation to do m_client->verifyNotPainting();. Some possible solutions: - Fix the destruction order (reorder members) - explicitly set PageOverlay::m_layer->m_client to NULL in ~PageOverlay - something-else-because-i-don't-really-know-webkit-that-well 756234 1 171850 vsevik 2012-11-01 07:35:35 -0700 Created attachment 171850 Patch 756236 2 171851 vsevik 2012-11-01 07:36:29 -0700 Created attachment 171851 Patch 756367 3 171851 webkit.review.bot 2012-11-01 09:51:39 -0700 Comment on attachment 171851 Patch Clearing flags on attachment: 171851 Committed r133188: <http://trac.webkit.org/changeset/133188> 756368 4 webkit.review.bot 2012-11-01 09:51:42 -0700 All reviewed patches have been landed. Closing bug. 171850 2012-11-01 07:35:35 -0700 2012-11-01 07:36:24 -0700 Patch bug-100930-20121101183356.patch text/plain 1265 vsevik U3VidmVyc2lvbiBSZXZpc2lvbjogMTMzMTY0CmRpZmYgLS1naXQgYS9Tb3VyY2UvV2ViS2l0L2No cm9taXVtL0NoYW5nZUxvZyBiL1NvdXJjZS9XZWJLaXQvY2hyb21pdW0vQ2hhbmdlTG9nCmluZGV4 IDBmYTdlMTFhYzE0OTZiZTRkZTQ4ZWI1ODg0Yzk1ZWVkYjM3ODEwNDguLjEzNDgwMGVmOTYxNTUx MzY3N2RkNzUxMTVkZWQxMGVhMWRlODdkZmMgMTAwNjQ0Ci0tLSBhL1NvdXJjZS9XZWJLaXQvY2hy b21pdW0vQ2hhbmdlTG9nCisrKyBiL1NvdXJjZS9XZWJLaXQvY2hyb21pdW0vQ2hhbmdlTG9nCkBA IC0xLDMgKzEsMTMgQEAKKzIwMTItMTEtMDEgIFZzZXZvbG9kIFZsYXNvdiAgPHZzZXZpa0BjaHJv bWl1bS5vcmc+CisKKyAgICAgICAgW0Nocm9taXVtXSBkZWJ1ZyBidWlsZHM6IFVzZSBhZnRlciBm cmVlIHVuZGVyIH5QYWdlT3ZlcmxheSgpCisgICAgICAgIGh0dHBzOi8vYnVncy53ZWJraXQub3Jn L3Nob3dfYnVnLmNnaT9pZD0xMDA5MzAKKworICAgICAgICBSZXZpZXdlZCBieSBOT0JPRFkgKE9P UFMhKS4KKworICAgICAgICAqIHNyYy9QYWdlT3ZlcmxheS5oOgorICAgICAgICAoUGFnZU92ZXJs YXkpOgorCiAyMDEyLTExLTAxICBKYW1lcyBSb2JpbnNvbiAgPGphbWVzckBjaHJvbWl1bS5vcmc+ CiAKICAgICAgICAgW2Nocm9taXVtXSBBdm9pZCBhdHRlbXB0aW5nIHRvIGRlZmVyIGNvbW1pdHMg d2hlbiB0aGV5IGFyZSBhbHJlYWR5IGRlZmVycmVkCmRpZmYgLS1naXQgYS9Tb3VyY2UvV2ViS2l0 L2Nocm9taXVtL3NyYy9QYWdlT3ZlcmxheS5oIGIvU291cmNlL1dlYktpdC9jaHJvbWl1bS9zcmMv UGFnZU92ZXJsYXkuaAppbmRleCBiZjg1MjZmY2M2Mjk5NGU5MDMwZTk2ZjJiNGMyMWRmMWVhZDI2 ODRlLi4yMTAxY2JmNWJiNWMxZGU2NWQ4ZWE4NzE3ZjI0NWU3N2E3ZWZiNTlmIDEwMDY0NAotLS0g YS9Tb3VyY2UvV2ViS2l0L2Nocm9taXVtL3NyYy9QYWdlT3ZlcmxheS5oCisrKyBiL1NvdXJjZS9X ZWJLaXQvY2hyb21pdW0vc3JjL1BhZ2VPdmVybGF5LmgKQEAgLTY1LDggKzY1LDggQEAgcHJpdmF0 ZToKIAogICAgIFdlYlZpZXdJbXBsKiBtX3ZpZXdJbXBsOwogICAgIFdlYlBhZ2VPdmVybGF5KiBt X292ZXJsYXk7Ci0gICAgT3duUHRyPFdlYkNvcmU6OkdyYXBoaWNzTGF5ZXI+IG1fbGF5ZXI7CiAg ICAgT3duUHRyPFdlYkNvcmU6OkdyYXBoaWNzTGF5ZXJDbGllbnQ+IG1fbGF5ZXJDbGllbnQ7Cisg ICAgT3duUHRyPFdlYkNvcmU6OkdyYXBoaWNzTGF5ZXI+IG1fbGF5ZXI7CiAgICAgaW50IG1fek9y ZGVyOwogfTsKIAo= 171851 2012-11-01 07:36:29 -0700 2012-11-01 09:51:39 -0700 Patch bug-100930-20121101183450.patch text/plain 1376 vsevik U3VidmVyc2lvbiBSZXZpc2lvbjogMTMzMTY0CmRpZmYgLS1naXQgYS9Tb3VyY2UvV2ViS2l0L2No cm9taXVtL0NoYW5nZUxvZyBiL1NvdXJjZS9XZWJLaXQvY2hyb21pdW0vQ2hhbmdlTG9nCmluZGV4 IDBmYTdlMTFhYzE0OTZiZTRkZTQ4ZWI1ODg0Yzk1ZWVkYjM3ODEwNDguLjRlOTdkM2U0YzhiNzMw NzQ4YTQyZGZlZjEwZDkwZjczMWU3YjJkZDYgMTAwNjQ0Ci0tLSBhL1NvdXJjZS9XZWJLaXQvY2hy b21pdW0vQ2hhbmdlTG9nCisrKyBiL1NvdXJjZS9XZWJLaXQvY2hyb21pdW0vQ2hhbmdlTG9nCkBA IC0xLDMgKzEsMTUgQEAKKzIwMTItMTEtMDEgIFZzZXZvbG9kIFZsYXNvdiAgPHZzZXZpa0BjaHJv bWl1bS5vcmc+CisKKyAgICAgICAgW0Nocm9taXVtXSBkZWJ1ZyBidWlsZHM6IFVzZSBhZnRlciBm cmVlIHVuZGVyIH5QYWdlT3ZlcmxheSgpCisgICAgICAgIGh0dHBzOi8vYnVncy53ZWJraXQub3Jn L3Nob3dfYnVnLmNnaT9pZD0xMDA5MzAKKworICAgICAgICBSZXZpZXdlZCBieSBOT0JPRFkgKE9P UFMhKS4KKworICAgICAgICBDaGFuZ2VkIG1lbWJlcnMgb3JkZXIgaW4gUGFnZU92ZXJsYXkgc28g dGhhdCBHcmFwaGljc0xheWVyIGlzIGRlc3Ryb3llZCBiZWZvcmUgR3JhcGhpY3NMYXllckNsaWVu dC4KKworICAgICAgICAqIHNyYy9QYWdlT3ZlcmxheS5oOgorICAgICAgICAoUGFnZU92ZXJsYXkp OgorCiAyMDEyLTExLTAxICBKYW1lcyBSb2JpbnNvbiAgPGphbWVzckBjaHJvbWl1bS5vcmc+CiAK ICAgICAgICAgW2Nocm9taXVtXSBBdm9pZCBhdHRlbXB0aW5nIHRvIGRlZmVyIGNvbW1pdHMgd2hl biB0aGV5IGFyZSBhbHJlYWR5IGRlZmVycmVkCmRpZmYgLS1naXQgYS9Tb3VyY2UvV2ViS2l0L2No cm9taXVtL3NyYy9QYWdlT3ZlcmxheS5oIGIvU291cmNlL1dlYktpdC9jaHJvbWl1bS9zcmMvUGFn ZU92ZXJsYXkuaAppbmRleCBiZjg1MjZmY2M2Mjk5NGU5MDMwZTk2ZjJiNGMyMWRmMWVhZDI2ODRl Li4yMTAxY2JmNWJiNWMxZGU2NWQ4ZWE4NzE3ZjI0NWU3N2E3ZWZiNTlmIDEwMDY0NAotLS0gYS9T b3VyY2UvV2ViS2l0L2Nocm9taXVtL3NyYy9QYWdlT3ZlcmxheS5oCisrKyBiL1NvdXJjZS9XZWJL aXQvY2hyb21pdW0vc3JjL1BhZ2VPdmVybGF5LmgKQEAgLTY1LDggKzY1LDggQEAgcHJpdmF0ZToK IAogICAgIFdlYlZpZXdJbXBsKiBtX3ZpZXdJbXBsOwogICAgIFdlYlBhZ2VPdmVybGF5KiBtX292 ZXJsYXk7Ci0gICAgT3duUHRyPFdlYkNvcmU6OkdyYXBoaWNzTGF5ZXI+IG1fbGF5ZXI7CiAgICAg T3duUHRyPFdlYkNvcmU6OkdyYXBoaWNzTGF5ZXJDbGllbnQ+IG1fbGF5ZXJDbGllbnQ7CisgICAg T3duUHRyPFdlYkNvcmU6OkdyYXBoaWNzTGF5ZXI+IG1fbGF5ZXI7CiAgICAgaW50IG1fek9yZGVy OwogfTsKIAo=