106663 2013-01-11 06:59:27 -0800 IconLoader destructor called without calling removeClient(). 2013-10-03 11:51:13 -0700 1 1 1 Unclassified WebKit WebCore Misc. 528+ (Nightly build) Unspecified Unspecified RESOLVED DUPLICATE 120541 P2 Normal --- 0 mark.toller webkit-unassigned ap beidson buildbot dglazkov gtk-ews japhet peter+ews rniwa webkit.review.bot xan.lopez oldest_to_newest 805238 0 mark.toller 2013-01-11 06:59:27 -0800 IconLoader uses a CachedRawResource, this class sets a timer and calls back into the IconLoader when the timer fires. However, the IconLoader can be destroyed (on web view destruction) without removing itself from the CachedRawResource, so the timer firing calls into a deleted object causing a crash. Adding a check into the destructor fixes this problem on our platform (webkit2, gtk based). 805239 1 182337 mark.toller 2013-01-11 07:00:39 -0800 Created attachment 182337 Call removeClient in the destructor. 805245 2 182337 webkit-ews 2013-01-11 07:06:38 -0800 Comment on attachment 182337 Call removeClient in the destructor. Attachment 182337 did not pass qt-ews (qt): Output: http://queues.webkit.org/results/15795669 805246 3 182337 webkit-ews 2013-01-11 07:08:10 -0800 Comment on attachment 182337 Call removeClient in the destructor. Attachment 182337 did not pass qt-wk2-ews (qt): Output: http://queues.webkit.org/results/15815184 805247 4 182337 eflews.bot 2013-01-11 07:08:39 -0800 Comment on attachment 182337 Call removeClient in the destructor. Attachment 182337 did not pass efl-ews (efl): Output: http://queues.webkit.org/results/15809335 805249 5 182337 gtk-ews 2013-01-11 07:12:20 -0800 Comment on attachment 182337 Call removeClient in the destructor. Attachment 182337 did not pass gtk-ews (gtk): Output: http://queues.webkit.org/results/15810338 805250 6 182337 buildbot 2013-01-11 07:12:49 -0800 Comment on attachment 182337 Call removeClient in the destructor. Attachment 182337 did not pass mac-ews (mac): Output: http://queues.webkit.org/results/15806380 805253 7 182337 peter+ews 2013-01-11 07:17:40 -0800 Comment on attachment 182337 Call removeClient in the destructor. Attachment 182337 did not pass cr-android-ews (chromium-android): Output: http://queues.webkit.org/results/15806381 805254 8 182337 buildbot 2013-01-11 07:20:34 -0800 Comment on attachment 182337 Call removeClient in the destructor. Attachment 182337 did not pass win-ews (win): Output: http://queues.webkit.org/results/15803439 805255 9 182342 mark.toller 2013-01-11 07:22:07 -0800 Created attachment 182342 removed the spurious { from the patch. 805326 10 ap 2013-01-11 09:31:49 -0800 Can you make a regression test for this? 805346 11 mark.toller 2013-01-11 10:02:01 -0800 (In reply to comment #10) > Can you make a regression test for this? I've only seen this on our device, and it's timing related - you have to destroy the webview (which destroys the IconLoader) after the CachedRawResource has been created and the IconLoader added to it, but before the timer (set for 0ms) fires... 935895 12 ap 2013-10-03 11:51:03 -0700 This got fixed in bug 120541. *** This bug has been marked as a duplicate of bug 120541 *** 182337 2013-01-11 07:00:39 -0800 2013-01-11 07:22:07 -0800 Call removeClient in the destructor. iconloader.txt text/plain 454 mark.toller SW5kZXg6IFNvdXJjZS9XZWJDb3JlL2xvYWRlci9pY29uL0ljb25Mb2FkZXIuY3BwDQo9PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09DQotLS0gU291cmNlL1dlYkNvcmUvbG9hZGVyL2ljb24vSWNvbkxvYWRlci5jcHAgICAocmV2 aXNpb24gMTM5NDM5KQ0KKysrIFNvdXJjZS9XZWJDb3JlL2xvYWRlci9pY29uL0ljb25Mb2FkZXIu Y3BwICAgKHdvcmtpbmcgY29weSkNCkBAIC01NCw2ICs1NCw4IEBAIFBhc3NPd25QdHI8SWNvbkxv YWRlcj4gSWNvbkxvYWRlcjo6Y3JlYXQNCiANCiBJY29uTG9hZGVyOjp+SWNvbkxvYWRlcigpDQog ew0KKyAgICBpZiAobV9yZXNvdXJjZSkgew0KKyAgICAgICAgbV9yZXNvdXJjZS0+cmVtb3ZlQ2xp ZW50KHRoaXMpOw0KIH0NCiANCiB2b2lkIEljb25Mb2FkZXI6OnN0YXJ0TG9hZGluZygpDQoNCg== 182342 2013-01-11 07:22:07 -0800 2013-10-03 11:51:13 -0700 removed the spurious { from the patch. iconloader.txt text/plain 453 mark.toller SW5kZXg6IFNvdXJjZS9XZWJDb3JlL2xvYWRlci9pY29uL0ljb25Mb2FkZXIuY3BwDQo9PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09DQotLS0gU291cmNlL1dlYkNvcmUvbG9hZGVyL2ljb24vSWNvbkxvYWRlci5jcHAgICAocmV2 aXNpb24gMTM5NDM5KQ0KKysrIFNvdXJjZS9XZWJDb3JlL2xvYWRlci9pY29uL0ljb25Mb2FkZXIu Y3BwICAgKHdvcmtpbmcgY29weSkNCkBAIC01NCw2ICs1NCw4IEBAIFBhc3NPd25QdHI8SWNvbkxv YWRlcj4gSWNvbkxvYWRlcjo6Y3JlYXQNCiANCiBJY29uTG9hZGVyOjp+SWNvbkxvYWRlcigpDQog ew0KKyAgICBpZiAobV9yZXNvdXJjZSkgDQorICAgICAgICBtX3Jlc291cmNlLT5yZW1vdmVDbGll bnQodGhpcyk7DQogfQ0KIA0KIHZvaWQgSWNvbkxvYWRlcjo6c3RhcnRMb2FkaW5nKCkNCg0K