142905 2015-03-20 04:50:59 -0700 [WinCairo] Crash when plugin window is destroyed. 2015-03-25 10:56:15 -0700 1 1 1 Unclassified WebKit WebKit Misc. 528+ (Nightly build) Unspecified Unspecified RESOLVED FIXED P2 Normal --- 1 peavo webkit-unassigned achristensen bfulgham commit-queue oldest_to_newest 1078834 0 peavo 2015-03-20 04:50:59 -0700 I'm getting a reproducible crash when leaving a page with a windowed plugin. Leaving the page causes the plugin window to be destroyed with the Win32 api function DestroyWindow. This will send a syncrounous WM_PARENTNOTIFY message to the parent, in this case the WebView, see https://msdn.microsoft.com/en-us/library/windows/desktop/ms632682(v=vs.85).aspx. The WebView window procedure will, when processing the WM_PARENTNOTIFY message, call UpdateWindow to paint synchronously. This will cause reentrancy problems, since we're already called from WebCore code, and then reenter WebCore painting code. In this particular case, we crash because we try to paint a deleted RenderLayer. 1078838 1 249108 peavo 2015-03-20 05:01:47 -0700 Created attachment 249108 Patch 1078880 2 peavo 2015-03-20 10:21:01 -0700 An alternative would be to stop UpdateWindow only for the WM_PARENTNOTIFY message, I'm a little worried about drawing performance in that case, though. 1078889 3 249108 achristensen 2015-03-20 10:47:36 -0700 Comment on attachment 249108 Patch View in context: https://bugs.webkit.org/attachment.cgi?id=249108&action=review > Source/WebKit/win/WebView.cpp:2526 > + case WM_MOUSEWHEEL: > + case WM_MOUSEMOVE: > + case WM_KEYDOWN: > + case WM_GESTURE: Where did this set of event types come from? Why not more, or fewer? 1078899 4 peavo 2015-03-20 11:07:35 -0700 (In reply to comment #3) > Comment on attachment 249108 [details] > Patch > > View in context: > https://bugs.webkit.org/attachment.cgi?id=249108&action=review > > > Source/WebKit/win/WebView.cpp:2526 > > + case WM_MOUSEWHEEL: > > + case WM_MOUSEMOVE: > > + case WM_KEYDOWN: > > + case WM_GESTURE: > > Where did this set of event types come from? Why not more, or fewer? I had some repaint artifacts when scrolling, that's why I added these. Maybe more are needed, and maybe it would be safest to only avoid UpdateWindow when receiving the WM_PARENTNOTIFY message. In some cases that might lead to unneeded painting, I think. 1079963 5 249409 peavo 2015-03-25 09:34:11 -0700 Created attachment 249409 Patch 1079987 6 249409 commit-queue 2015-03-25 10:56:10 -0700 Comment on attachment 249409 Patch Clearing flags on attachment: 249409 Committed r181966: <http://trac.webkit.org/changeset/181966> 1079988 7 commit-queue 2015-03-25 10:56:15 -0700 All reviewed patches have been landed. Closing bug. 249108 2015-03-20 05:01:47 -0700 2015-03-25 09:34:03 -0700 Patch bug-142905-20150320130057.patch text/plain 3170 peavo SW5kZXg6IFNvdXJjZS9XZWJLaXQvd2luL0NoYW5nZUxvZwo9PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09Ci0tLSBTb3VyY2Uv V2ViS2l0L3dpbi9DaGFuZ2VMb2cJKHJldmlzaW9uIDE4MTgwMCkKKysrIFNvdXJjZS9XZWJLaXQv d2luL0NoYW5nZUxvZwkod29ya2luZyBjb3B5KQpAQCAtMSwzICsxLDIyIEBACisyMDE1LTAzLTIw ICBQZXIgQXJuZSBWb2xsYW4gIDxwZWF2b0BvdXRsb29rLmNvbT4KKworICAgICAgICBbV2luQ2Fp cm9dIENyYXNoIHdoZW4gcGx1Z2luIHdpbmRvdyBpcyBkZXN0cm95ZWQuCisgICAgICAgIGh0dHBz Oi8vYnVncy53ZWJraXQub3JnL3Nob3dfYnVnLmNnaT9pZD0xNDI5MDUKKworICAgICAgICBSZXZp ZXdlZCBieSBOT0JPRFkgKE9PUFMhKS4KKworICAgICAgICBXaGVuIGEgcGx1Z2luIHdpbmRvdyBp cyBkZXN0cm95ZWQgd2l0aCB0aGUgV2luMzIgYXBpIGZ1bmN0aW9uIERlc3Ryb3lXaW5kb3csCisg ICAgICAgIHRoZSBzeXN0ZW0gd2lsbCBzZW5kIGEgc3luY2hyb25vdXMgV01fUEFSRU5UTk9USUZZ IG1lc3NhZ2UgdG8gdGhlIFdlYlZpZXcuCisgICAgICAgIFRoZSBXZWJWaWV3IHdpbmRvdyBwcm9j ZWR1cmUgd2lsbCwgd2hlbiBwcm9jZXNzaW5nIHRoZSBXTV9QQVJFTlROT1RJRlkgbWVzc2FnZSwK KyAgICAgICAgY2FsbCBVcGRhdGVXaW5kb3cgdG8gcGFpbnQgc3luY2hyb25vdXNseS4gVGhpcyB3 aWxsIGNhdXNlIHJlZW50cmFuY3kgcHJvYmxlbXMsCisgICAgICAgIHNpbmNlIHdlJ3JlIGFscmVh ZHkgY2FsbGVkIGZyb20gV2ViQ29yZSBjb2RlLCBhbmQgdGhlbiByZWVudGVyIFdlYkNvcmUgcGFp bnRpbmcgY29kZS4KKyAgICAgICAgV2Ugc2hvdWxkIGF2b2lkIGNhbGxpbmcgVXBkYXRlV2luZG93 IHdoZW4gaGFuZGxpbmcgdGhlIFdNX1BBUkVOVE5PVElGWSBtZXNzYWdlLgorCisgICAgICAgICog V2ViVmlldy5jcHA6CisgICAgICAgIChXZWJWaWV3OjpXZWJWaWV3V25kUHJvYyk6CisgICAgICAg IChXZWJWaWV3Ojp1cGRhdGVXaW5kb3dJZk5lZWRlZCk6CisgICAgICAgICogV2ViVmlldy5oOgor CiAyMDE1LTAzLTE5ICBDaHJpcyBEdW1leiAgPGNkdW1lekBhcHBsZS5jb20+CiAKICAgICAgICAg Q2xlYW4gdXAgRE9NVGltZXIgcmVsYXRlZCBzZXR0aW5ncwpJbmRleDogU291cmNlL1dlYktpdC93 aW4vV2ViVmlldy5jcHAKPT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PQotLS0gU291cmNlL1dlYktpdC93aW4vV2ViVmlldy5j cHAJKHJldmlzaW9uIDE4MTc0NikKKysrIFNvdXJjZS9XZWJLaXQvd2luL1dlYlZpZXcuY3BwCSh3 b3JraW5nIGNvcHkpCkBAIC0yNTAxLDggKzI1MDEsNyBAQCBMUkVTVUxUIENBTExCQUNLIFdlYlZp ZXc6OldlYlZpZXdXbmRQcm9jCiAgICAgICAgICAgICBicmVhazsKICAgICB9CiAKLSAgICBpZiAo d2ViVmlldy0+bmVlZHNEaXNwbGF5KCkgJiYgbWVzc2FnZSAhPSBXTV9QQUlOVCkKLSAgICAgICAg OjpVcGRhdGVXaW5kb3coaFduZCk7CisgICAgd2ViVmlldy0+dXBkYXRlV2luZG93SWZOZWVkZWQo aFduZCwgbWVzc2FnZSk7CiAKICAgICBpZiAoIWhhbmRsZWQpCiAgICAgICAgIGxSZXN1bHQgPSBE ZWZXaW5kb3dQcm9jKGhXbmQsIG1lc3NhZ2UsIHdQYXJhbSwgbFBhcmFtKTsKQEAgLTI1MTEsNiAr MjUxMCwyNSBAQCBMUkVTVUxUIENBTExCQUNLIFdlYlZpZXc6OldlYlZpZXdXbmRQcm9jCiAgICAg cmV0dXJuIChtZXNzYWdlID09IFdNX0tFWURPV04gfHwgbWVzc2FnZSA9PSBXTV9TWVNLRVlET1dO IHx8IG1lc3NhZ2UgPT0gV01fS0VZVVAgfHwgbWVzc2FnZSA9PSBXTV9TWVNLRVlVUCkgPyAhaGFu ZGxlZCA6IGxSZXN1bHQ7CiB9CiAKK3ZvaWQgV2ViVmlldzo6dXBkYXRlV2luZG93SWZOZWVkZWQo SFdORCBoV25kLCBVSU5UIG1lc3NhZ2UpCit7CisgICAgaWYgKCFuZWVkc0Rpc3BsYXkoKSkKKyAg ICAgICAgcmV0dXJuOworCisgICAgLy8gQ2FyZSBzaG91bGQgYmUgdGFrZW4gd2hlbiB1cGRhdGlu ZyB0aGUgd2luZG93IGZyb20gdGhlIHdpbmRvdyBwcm9jZWR1cmUuCisgICAgLy8gVXBkYXRpbmcg dGhlIHdpbmRvdyBpbiByZXNwb25zZSB0byBlLmcuIFdNX1BBUkVOVE5PVElGWSBtYXkgY2F1c2Ug cmVlbnRyYW5jeSBwcm9ibGVtcywKKyAgICAvLyBiZWNhdXNlIFdNX1BBUkVOVE5PVElGWSBpcyBz ZW50IHN5bmNocm9ub3VzbHkgdG8gdGhlIHBhcmVudCB3aW5kb3cgd2hlbiBlLmcuIERlc3Ryb3lX aW5kb3coKSBpcyBjYWxsZWQuCisKKyAgICBzd2l0Y2ggKG1lc3NhZ2UpIHsKKyAgICBjYXNlIFdN X01PVVNFV0hFRUw6CisgICAgY2FzZSBXTV9NT1VTRU1PVkU6CisgICAgY2FzZSBXTV9LRVlET1dO OgorICAgIGNhc2UgV01fR0VTVFVSRToKKyAgICAgICAgOjpVcGRhdGVXaW5kb3coaFduZCk7Cisg ICAgICAgIGJyZWFrOworICAgIH0KK30KKwogYm9vbCBXZWJWaWV3OjpkZXZlbG9wZXJFeHRyYXNF bmFibGVkKCkgY29uc3QKIHsKICAgICBpZiAobV9wcmVmZXJlbmNlcy0+ZGV2ZWxvcGVyRXh0cmFz RGlzYWJsZWRCeU92ZXJyaWRlKCkpCkluZGV4OiBTb3VyY2UvV2ViS2l0L3dpbi9XZWJWaWV3LmgK PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PQotLS0gU291cmNlL1dlYktpdC93aW4vV2ViVmlldy5oCShyZXZpc2lvbiAxODE3 NDYpCisrKyBTb3VyY2UvV2ViS2l0L3dpbi9XZWJWaWV3LmgJKHdvcmtpbmcgY29weSkKQEAgLTEw MjYsNiArMTAyNiw4IEBAIHByb3RlY3RlZDoKICAgICBzdGF0aWMgYm9vbCByZWdpc3RlcldlYlZp ZXdXaW5kb3dDbGFzcygpOwogICAgIHN0YXRpYyBMUkVTVUxUIENBTExCQUNLIFdlYlZpZXdXbmRQ cm9jKEhXTkQgaFduZCwgVUlOVCBtZXNzYWdlLCBXUEFSQU0gd1BhcmFtLCBMUEFSQU0gbFBhcmFt KTsKIAorICAgIHZvaWQgdXBkYXRlV2luZG93SWZOZWVkZWQoSFdORCBoV25kLCBVSU5UIG1lc3Nh Z2UpOworCiAgICAgSElNQyBnZXRJTU1Db250ZXh0KCk7CiAgICAgdm9pZCByZWxlYXNlSU1NQ29u dGV4dChISU1DKTsKICAgICBzdGF0aWMgYm9vbCBhbGxvd1NpdGVTcGVjaWZpY0hhY2tzKCkgeyBy ZXR1cm4gc19hbGxvd1NpdGVTcGVjaWZpY0hhY2tzOyB9IAo= 249409 2015-03-25 09:34:11 -0700 2015-03-25 10:56:10 -0700 Patch bug-142905-20150325173331.patch text/plain 3123 peavo SW5kZXg6IFNvdXJjZS9XZWJLaXQvd2luL0NoYW5nZUxvZwo9PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09Ci0tLSBTb3VyY2Uv V2ViS2l0L3dpbi9DaGFuZ2VMb2cJKHJldmlzaW9uIDE4MTk1OSkKKysrIFNvdXJjZS9XZWJLaXQv d2luL0NoYW5nZUxvZwkod29ya2luZyBjb3B5KQpAQCAtMSwzICsxLDIyIEBACisyMDE1LTAzLTIw ICBQZXIgQXJuZSBWb2xsYW4gIDxwZWF2b0BvdXRsb29rLmNvbT4KKworICAgICAgICBbV2luQ2Fp cm9dIENyYXNoIHdoZW4gcGx1Z2luIHdpbmRvdyBpcyBkZXN0cm95ZWQuCisgICAgICAgIGh0dHBz Oi8vYnVncy53ZWJraXQub3JnL3Nob3dfYnVnLmNnaT9pZD0xNDI5MDUKKworICAgICAgICBSZXZp ZXdlZCBieSBOT0JPRFkgKE9PUFMhKS4KKworICAgICAgICBXaGVuIGEgcGx1Z2luIHdpbmRvdyBp cyBkZXN0cm95ZWQgd2l0aCB0aGUgV2luMzIgYXBpIGZ1bmN0aW9uIERlc3Ryb3lXaW5kb3csCisg ICAgICAgIHRoZSBzeXN0ZW0gd2lsbCBzZW5kIGEgc3luY2hyb25vdXMgV01fUEFSRU5UTk9USUZZ IG1lc3NhZ2UgdG8gdGhlIFdlYlZpZXcuCisgICAgICAgIFRoZSBXZWJWaWV3IHdpbmRvdyBwcm9j ZWR1cmUgd2lsbCwgd2hlbiBwcm9jZXNzaW5nIHRoZSBXTV9QQVJFTlROT1RJRlkgbWVzc2FnZSwK KyAgICAgICAgY2FsbCBVcGRhdGVXaW5kb3cgdG8gcGFpbnQgc3luY2hyb25vdXNseS4gVGhpcyB3 aWxsIGNhdXNlIHJlZW50cmFuY3kgcHJvYmxlbXMsCisgICAgICAgIHNpbmNlIHdlJ3JlIGFscmVh ZHkgY2FsbGVkIGZyb20gV2ViQ29yZSBjb2RlLCBhbmQgdGhlbiByZWVudGVyIFdlYkNvcmUgcGFp bnRpbmcgY29kZS4KKyAgICAgICAgV2Ugc2hvdWxkIGF2b2lkIGNhbGxpbmcgVXBkYXRlV2luZG93 IHdoZW4gaGFuZGxpbmcgdGhlIFdNX1BBUkVOVE5PVElGWSBtZXNzYWdlLgorCisgICAgICAgICog V2ViVmlldy5jcHA6CisgICAgICAgIChXZWJWaWV3OjpXZWJWaWV3V25kUHJvYyk6CisgICAgICAg IChXZWJWaWV3Ojp1cGRhdGVXaW5kb3dJZk5lZWRlZCk6CisgICAgICAgICogV2ViVmlldy5oOgor CiAyMDE1LTAzLTE5ICBDaHJpcyBEdW1leiAgPGNkdW1lekBhcHBsZS5jb20+CiAKICAgICAgICAg Q2xlYW4gdXAgRE9NVGltZXIgcmVsYXRlZCBzZXR0aW5ncwpJbmRleDogU291cmNlL1dlYktpdC93 aW4vV2ViVmlldy5jcHAKPT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PQotLS0gU291cmNlL1dlYktpdC93aW4vV2ViVmlldy5j cHAJKHJldmlzaW9uIDE4MTk1OCkKKysrIFNvdXJjZS9XZWJLaXQvd2luL1dlYlZpZXcuY3BwCSh3 b3JraW5nIGNvcHkpCkBAIC0yNTAxLDggKzI1MDEsNyBAQCBMUkVTVUxUIENBTExCQUNLIFdlYlZp ZXc6OldlYlZpZXdXbmRQcm9jCiAgICAgICAgICAgICBicmVhazsKICAgICB9CiAKLSAgICBpZiAo d2ViVmlldy0+bmVlZHNEaXNwbGF5KCkgJiYgbWVzc2FnZSAhPSBXTV9QQUlOVCkKLSAgICAgICAg OjpVcGRhdGVXaW5kb3coaFduZCk7CisgICAgd2ViVmlldy0+dXBkYXRlV2luZG93SWZOZWVkZWQo aFduZCwgbWVzc2FnZSk7CiAKICAgICBpZiAoIWhhbmRsZWQpCiAgICAgICAgIGxSZXN1bHQgPSBE ZWZXaW5kb3dQcm9jKGhXbmQsIG1lc3NhZ2UsIHdQYXJhbSwgbFBhcmFtKTsKQEAgLTI1MTEsNiAr MjUxMCwyNCBAQCBMUkVTVUxUIENBTExCQUNLIFdlYlZpZXc6OldlYlZpZXdXbmRQcm9jCiAgICAg cmV0dXJuIChtZXNzYWdlID09IFdNX0tFWURPV04gfHwgbWVzc2FnZSA9PSBXTV9TWVNLRVlET1dO IHx8IG1lc3NhZ2UgPT0gV01fS0VZVVAgfHwgbWVzc2FnZSA9PSBXTV9TWVNLRVlVUCkgPyAhaGFu ZGxlZCA6IGxSZXN1bHQ7CiB9CiAKK3ZvaWQgV2ViVmlldzo6dXBkYXRlV2luZG93SWZOZWVkZWQo SFdORCBoV25kLCBVSU5UIG1lc3NhZ2UpCit7CisgICAgaWYgKCFuZWVkc0Rpc3BsYXkoKSkKKyAg ICAgICAgcmV0dXJuOworCisgICAgLy8gQ2FyZSBzaG91bGQgYmUgdGFrZW4gd2hlbiB1cGRhdGlu ZyB0aGUgd2luZG93IGZyb20gdGhlIHdpbmRvdyBwcm9jZWR1cmUuCisgICAgLy8gVXBkYXRpbmcg dGhlIHdpbmRvdyBpbiByZXNwb25zZSB0byBlLmcuIFdNX1BBUkVOVE5PVElGWSBtYXkgY2F1c2Ug cmVlbnRyYW5jeSBwcm9ibGVtcywKKyAgICAvLyBiZWNhdXNlIFdNX1BBUkVOVE5PVElGWSBpcyBz ZW50IHN5bmNocm9ub3VzbHkgdG8gdGhlIHBhcmVudCB3aW5kb3cgd2hlbiBlLmcuIERlc3Ryb3lX aW5kb3coKSBpcyBjYWxsZWQuCisKKyAgICBzd2l0Y2ggKG1lc3NhZ2UpIHsKKyAgICBjYXNlIFdN X1BBSU5UOgorICAgIGNhc2UgV01fUEFSRU5UTk9USUZZOgorICAgICAgICByZXR1cm47CisgICAg fQorCisgICAgOjpVcGRhdGVXaW5kb3coaFduZCk7Cit9CisKIGJvb2wgV2ViVmlldzo6ZGV2ZWxv cGVyRXh0cmFzRW5hYmxlZCgpIGNvbnN0CiB7CiAgICAgaWYgKG1fcHJlZmVyZW5jZXMtPmRldmVs b3BlckV4dHJhc0Rpc2FibGVkQnlPdmVycmlkZSgpKQpJbmRleDogU291cmNlL1dlYktpdC93aW4v V2ViVmlldy5oCj09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT0KLS0tIFNvdXJjZS9XZWJLaXQvd2luL1dlYlZpZXcuaAkocmV2 aXNpb24gMTgxOTU4KQorKysgU291cmNlL1dlYktpdC93aW4vV2ViVmlldy5oCSh3b3JraW5nIGNv cHkpCkBAIC0xMDI2LDYgKzEwMjYsOCBAQCBwcm90ZWN0ZWQ6CiAgICAgc3RhdGljIGJvb2wgcmVn aXN0ZXJXZWJWaWV3V2luZG93Q2xhc3MoKTsKICAgICBzdGF0aWMgTFJFU1VMVCBDQUxMQkFDSyBX ZWJWaWV3V25kUHJvYyhIV05EIGhXbmQsIFVJTlQgbWVzc2FnZSwgV1BBUkFNIHdQYXJhbSwgTFBB UkFNIGxQYXJhbSk7CiAKKyAgICB2b2lkIHVwZGF0ZVdpbmRvd0lmTmVlZGVkKEhXTkQgaFduZCwg VUlOVCBtZXNzYWdlKTsKKwogICAgIEhJTUMgZ2V0SU1NQ29udGV4dCgpOwogICAgIHZvaWQgcmVs ZWFzZUlNTUNvbnRleHQoSElNQyk7CiAgICAgc3RhdGljIGJvb2wgYWxsb3dTaXRlU3BlY2lmaWNI YWNrcygpIHsgcmV0dXJuIHNfYWxsb3dTaXRlU3BlY2lmaWNIYWNrczsgfSAK