174753 2017-07-22 02:18:13 -0700 [Mac WK2] Potential null deref in WKView if WebPageProxy callbacks are invalidated in -[WKView dealloc] 2017-08-05 15:21:33 -0700 1 1 1 Unclassified WebKit WebKit2 WebKit Nightly Build Unspecified Unspecified NEW P2 Normal --- 1 wenson_hsieh webkit-unassigned oldest_to_newest 1331329 0 wenson_hsieh 2017-07-22 02:18:13 -0700 This code in WKView: - (void)dealloc { _data->_impl->page().setIconLoadingClient(nullptr); _data->_impl = nullptr; [_data release]; _data = nil; [super dealloc]; } ...seems like it would be susceptible to the same problem described in https://bugs.webkit.org/show_bug.cgi?id=174751. If ~WebViewImpl is called after setting _data->_impl to nullptr and one of the pending callbacks that get invoked when invalidating the callback map calls on WKView to do some work involving the _data's _impl, we'll probably end up with a null deref. 1335742 1 wenson_hsieh 2017-08-05 15:21:33 -0700 Interestingly, this isn't normally an issue when closing the page because Safari actually tells the WebPageProxy to close() very early in the teardown process. That's not to say there shouldn't be a mechanism at the WebKit layer, though, to ensure that we don't crash if the WKView is released through some other codepath in Safari that doesn't explicitly close() the page before continuing with teardown.