38574 2010-05-05 02:35:57 -0700 [Qt] Crash in QGraphicsWebViewPrivate::~QGraphicsWebViewPrivate when animation were used 2010-05-11 02:22:51 -0700 1 1 1 Unclassified WebKit Layout and Rendering 528+ (Nightly build) PC OS X 10.5 CLOSED FIXED Qt, QtTriaged P1 Major --- 35784 1 benjamin webkit-unassigned benjamin commit-queue hausmann kenneth noam oldest_to_newest 221033 0 benjamin 2010-05-05 02:35:57 -0700 On Mac, WebKit sometime crashes when closing a window on which an animation has been running. Step to reproduce: -open a new window -run the animation of http://www.optimum7.com/css3-man/animation.html -close the window -enjoy Here is the backtrace: 0 QtGui 0x000000010206bd63 QGraphicsItem::setParentItem(QGraphicsItem*) + 35 1 QtWebKit 0x000000010098bc31 QGraphicsWebViewPrivate::~QGraphicsWebViewPrivate() + 49 2 QtWebKit 0x000000010098a8ae QGraphicsWebView::~QGraphicsWebView() + 158 3 com.yourcompany.light 0x000000010001265b GraphicWebView::~GraphicWebView() + 65 (graphicwebview.h:28) 4 QtGui 0x0000000102090105 QGraphicsScene::clear() + 85 5 QtGui 0x00000001020901a8 QGraphicsScene::~QGraphicsScene() + 72 6 QtCore 0x00000001028a51cf QObjectPrivate::deleteChildren() + 95 7 QtGui 0x0000000101b1d4ca QWidget::~QWidget() + 522 8 QtGui 0x00000001020ba3bf QGraphicsView::~QGraphicsView() + 111 9 com.yourcompany.light 0x0000000100012272 BrowserWindow::~BrowserWindow() + 72 (browserwindow.h:32) 10 QtCore 0x0000000102988659 QObject::event(QEvent*) + 1113 11 QtGui 0x0000000101b1f55e QWidget::event(QEvent*) + 78 12 QtGui 0x0000000101e919fc QFrame::event(QEvent*) + 44 13 QtGui 0x0000000101f1dc1b QAbstractScrollArea::event(QEvent*) + 155 14 QtGui 0x00000001020c32ec QGraphicsView::event(QEvent*) + 60 15 com.yourcompany.light 0x00000001000042fc BrowserWindow::event(QEvent*) + 202 (browserwindow.cpp:120) 16 QtGui 0x0000000101aca4fd QApplicationPrivate::notify_helper(QObject*, QEvent*) + 189 17 QtGui 0x0000000101ad192d QApplication::notify(QObject*, QEvent*) + 349 18 com.yourcompany.light 0x000000010000a63c WebApplication::notify(QObject*, QEvent*) + 188 (webapplication.cpp:72) 19 QtCore 0x000000010289ffec QCoreApplication::notifyInternal(QObject*, QEvent*) + 124 20 QtCore 0x000000010297b64d QCoreApplicationPrivate::sendPostedEvents(QObject*, int, QThreadData*) + 701 21 com.apple.CoreFoundation 0x00007fff84958f21 __CFRunLoopDoSources0 + 1361 22 com.apple.CoreFoundation 0x00007fff84957119 __CFRunLoopRun + 873 23 com.apple.CoreFoundation 0x00007fff849568df CFRunLoopRunSpecific + 575 24 com.apple.HIToolbox 0x00007fff83bfdada RunCurrentEventLoopInMode + 333 25 com.apple.HIToolbox 0x00007fff83bfd83d ReceiveNextEventCommon + 148 26 com.apple.HIToolbox 0x00007fff83bfd798 BlockUntilNextEventMatchingListInMode + 59 27 com.apple.AppKit 0x00007fff863b1a2a _DPSNextEvent + 708 28 com.apple.AppKit 0x00007fff863b1379 -[NSApplication nextEventMatchingMask:untilDate:inMode:dequeue:] + 155 29 com.apple.AppKit 0x00007fff8637705b -[NSApplication run] + 395 30 QtGui 0x0000000101a874c4 QEventDispatcherMac::processEvents(QFlags<QEventLoop::ProcessEventsFlag>) + 1588 31 QtCore 0x0000000102979ff4 QEventLoop::processEvents(QFlags<QEventLoop::ProcessEventsFlag>) + 68 32 QtCore 0x000000010297a304 QEventLoop::exec(QFlags<QEventLoop::ProcessEventsFlag>) + 180 33 QtCore 0x000000010297b94c QCoreApplication::exec() + 188 34 com.yourcompany.light 0x0000000100005b40 main + 433 (main.cpp:36) 35 com.yourcompany.light 0x0000000100003120 start + 52 223033 1 55499 noam 2010-05-09 03:50:32 -0700 Created attachment 55499 Fix the crash This bug is very hard to reproduce on Linux because it's a race condition. But I'm pretty sure this consistently fixes it. 223042 2 benjamin 2010-05-09 07:17:42 -0700 Out of curiosity, in which cases the root layer is deleted before the view? 223043 3 55499 kenneth 2010-05-09 09:12:30 -0700 Comment on attachment 55499 Fix the crash Looks fine with me. Benjamin, can you verify that this fixes it for you? 223046 4 55499 commit-queue 2010-05-09 09:37:35 -0700 Comment on attachment 55499 Fix the crash Clearing flags on attachment: 55499 Committed r59057: <http://trac.webkit.org/changeset/59057> 223047 5 commit-queue 2010-05-09 09:37:41 -0700 All reviewed patches have been landed. Closing bug. 223210 6 benjamin 2010-05-10 02:38:59 -0700 (In reply to comment #3) > (From update of attachment 55499 [details]) > Benjamin, can you verify that this fixes it for you? Yep, no crash anymore. 223827 7 hausmann 2010-05-11 02:22:05 -0700 Revision r59057 cherry-picked into qtwebkit-2.0 with commit 1a6db1adc3724ac3b85296a94e515a34bcdcb2a4 55499 2010-05-09 03:50:32 -0700 2010-05-09 09:37:35 -0700 Fix the crash patch-38571-1.diff text/plain 3403 noam ZGlmZiAtLWdpdCBhL1dlYktpdC9xdC9BcGkvcWdyYXBoaWNzd2Vidmlldy5jcHAgYi9XZWJLaXQv cXQvQXBpL3FncmFwaGljc3dlYnZpZXcuY3BwCmluZGV4IDBjMTNlNDMuLjc1YTIzZDkgMTAwNjQ0 Ci0tLSBhL1dlYktpdC9xdC9BcGkvcWdyYXBoaWNzd2Vidmlldy5jcHAKKysrIGIvV2ViS2l0L3F0 L0FwaS9xZ3JhcGhpY3N3ZWJ2aWV3LmNwcApAQCAtODIsNyArODIsNiBAQCBwdWJsaWM6CiAgICAg ICAgICwgcGFnZSgwKQogICAgICAgICAsIHJlc2l6ZXNUb0NvbnRlbnRzKGZhbHNlKQogI2lmIFVT RShBQ0NFTEVSQVRFRF9DT01QT1NJVElORykKLSAgICAgICAgLCByb290R3JhcGhpY3NMYXllcigw KQogICAgICAgICAsIHNob3VsZFN5bmMoZmFsc2UpCiAjZW5kaWYKICAgICB7CkBAIC0xNTgsNyAr MTU3LDcgQEAgcHVibGljOgogICAgIGVudW0geyBSb290R3JhcGhpY3NMYXllclpWYWx1ZSwgT3Zl cmxheVpWYWx1ZSB9OwogCiAjaWYgVVNFKEFDQ0VMRVJBVEVEX0NPTVBPU0lUSU5HKQotICAgIFFH cmFwaGljc0l0ZW0qIHJvb3RHcmFwaGljc0xheWVyOworICAgIFFXZWFrUG9pbnRlcjxRR3JhcGhp Y3NPYmplY3Q+IHJvb3RHcmFwaGljc0xheWVyOwogICAgIC8vIHdlIG5lZWQgdG8gc3luYyB0aGUg bGF5ZXJzIGlmIHdlIGdldCBhIHNwZWNpYWwgY2FsbCBmcm9tIHRoZSBXZWJDb3JlCiAgICAgLy8g Y29tcG9zaXRvciB0ZWxsaW5nIHVzIHRvIGRvIHNvLiBXZSdsbCBnZXQgdGhhdCBjYWxsIGZyb20g Q2hyb21lQ2xpZW50UXQKICAgICBib29sIHNob3VsZFN5bmM7CkBAIC0xNzEsMTIgKzE3MCwxMSBA QCBwdWJsaWM6CiBRR3JhcGhpY3NXZWJWaWV3UHJpdmF0ZTo6flFHcmFwaGljc1dlYlZpZXdQcml2 YXRlKCkKIHsKICNpZiBVU0UoQUNDRUxFUkFURURfQ09NUE9TSVRJTkcpCi0gICAgaWYgKHJvb3RH cmFwaGljc0xheWVyKSB7Ci0gICAgICAgIC8vIHdlIGRvbid0IG5lZWQgdG8gZGVsZXRlIHRoZSBy b290IGdyYXBoaWNzIGxheWVyCi0gICAgICAgIC8vIFRoZSBsaWZlY3ljbGUgaXMgbWFuYWdlZCBp biBHcmFwaGljc0xheWVyUXQuY3BwCi0gICAgICAgIHJvb3RHcmFwaGljc0xheWVyLT5zZXRQYXJl bnRJdGVtKDApOwotICAgICAgICBxLT5zY2VuZSgpLT5yZW1vdmVJdGVtKHJvb3RHcmFwaGljc0xh eWVyKTsKLSAgICB9CisgICAgaWYgKCFyb290R3JhcGhpY3NMYXllcikKKyAgICAgICAgcmV0dXJu OworICAgIC8vIHdlIGRvbid0IG5lZWQgdG8gZGVsZXRlIHRoZSByb290IGdyYXBoaWNzIGxheWVy LiBUaGUgbGlmZWN5Y2xlIGlzIG1hbmFnZWQgaW4gR3JhcGhpY3NMYXllclF0LmNwcC4KKyAgICBy b290R3JhcGhpY3NMYXllci5kYXRhKCktPnNldFBhcmVudEl0ZW0oMCk7CisgICAgcS0+c2NlbmUo KS0+cmVtb3ZlSXRlbShyb290R3JhcGhpY3NMYXllci5kYXRhKCkpOwogI2VuZGlmCiB9CiAKQEAg LTIwNCwxMiArMjAyLDEyIEBAIHZvaWQgUUdyYXBoaWNzV2ViVmlld1ByaXZhdGU6OmNyZWF0ZU9y RGVsZXRlT3ZlcmxheSgpCiB2b2lkIFFHcmFwaGljc1dlYlZpZXdQcml2YXRlOjpzZXRSb290R3Jh cGhpY3NMYXllcihRR3JhcGhpY3NJdGVtKiBsYXllcikKIHsKICAgICBpZiAocm9vdEdyYXBoaWNz TGF5ZXIpIHsKLSAgICAgICAgcm9vdEdyYXBoaWNzTGF5ZXItPnNldFBhcmVudEl0ZW0oMCk7Ci0g ICAgICAgIHEtPnNjZW5lKCktPnJlbW92ZUl0ZW0ocm9vdEdyYXBoaWNzTGF5ZXIpOworICAgICAg ICByb290R3JhcGhpY3NMYXllci5kYXRhKCktPnNldFBhcmVudEl0ZW0oMCk7CisgICAgICAgIHEt PnNjZW5lKCktPnJlbW92ZUl0ZW0ocm9vdEdyYXBoaWNzTGF5ZXIuZGF0YSgpKTsKICAgICAgICAg UVdlYkZyYW1lUHJpdmF0ZTo6Y29yZShxLT5wYWdlKCktPm1haW5GcmFtZSgpKS0+dmlldygpLT5z eW5jQ29tcG9zaXRpbmdTdGF0ZVJlY3Vyc2l2ZSgpOwogICAgIH0KIAotICAgIHJvb3RHcmFwaGlj c0xheWVyID0gbGF5ZXI7CisgICAgcm9vdEdyYXBoaWNzTGF5ZXIgPSBsYXllciA/IGxheWVyLT50 b0dyYXBoaWNzT2JqZWN0KCkgOiAwOwogCiAgICAgaWYgKGxheWVyKSB7CiAgICAgICAgIGxheWVy LT5zZXRGbGFnKFFHcmFwaGljc0l0ZW06Okl0ZW1DbGlwc0NoaWxkcmVuVG9TaGFwZSwgdHJ1ZSk7 CkBAIC0yMzEsNyArMjI5LDcgQEAgdm9pZCBRR3JhcGhpY3NXZWJWaWV3UHJpdmF0ZTo6dXBkYXRl Q29tcG9zaXRpbmdTY3JvbGxQb3NpdGlvbigpCiB7CiAgICAgaWYgKHJvb3RHcmFwaGljc0xheWVy ICYmIHEtPnBhZ2UoKSAmJiBxLT5wYWdlKCktPm1haW5GcmFtZSgpKSB7CiAgICAgICAgIGNvbnN0 IFFQb2ludCBzY3JvbGxQb3NpdGlvbiA9IHEtPnBhZ2UoKS0+bWFpbkZyYW1lKCktPnNjcm9sbFBv c2l0aW9uKCk7Ci0gICAgICAgIHJvb3RHcmFwaGljc0xheWVyLT5zZXRQb3MoLXNjcm9sbFBvc2l0 aW9uKTsKKyAgICAgICAgcm9vdEdyYXBoaWNzTGF5ZXIuZGF0YSgpLT5zZXRQb3MoLXNjcm9sbFBv c2l0aW9uKTsKICAgICB9CiB9CiAjZW5kaWYKZGlmZiAtLWdpdCBhL1dlYktpdC9xdC9DaGFuZ2VM b2cgYi9XZWJLaXQvcXQvQ2hhbmdlTG9nCmluZGV4IDZmNDllNDEuLmNhMGNkMjcgMTAwNjQ0Ci0t LSBhL1dlYktpdC9xdC9DaGFuZ2VMb2cKKysrIGIvV2ViS2l0L3F0L0NoYW5nZUxvZwpAQCAtMSwz ICsxLDE4IEBACisyMDEwLTA1LTA5ICBOb2FtIFJvc2VudGhhbCAgPG5vYW0ucm9zZW50aGFsQG5v a2lhLmNvbT4KKworICAgICAgICBSZXZpZXdlZCBieSBOT0JPRFkgKE9PUFMhKS4KKworICAgICAg ICBbUXRdIENyYXNoIGluIFFHcmFwaGljc1dlYlZpZXdQcml2YXRlOjp+UUdyYXBoaWNzV2ViVmll d1ByaXZhdGUgd2hlbiBhbmltYXRpb24gd2VyZSB1c2VkCisgICAgICAgIGh0dHBzOi8vYnVncy53 ZWJraXQub3JnL3Nob3dfYnVnLmNnaT9pZD0zODU3NAorCisgICAgICAgIFRoZSBmaXggdXNlcyBh IFFXZWFrUG9pbnRlciBmb3Igcm9vdEdyYXBoaWNzTGF5ZXIsIHByb3RlY3RpbmcgZnJvbSBhIGNy YXNoIGluIGNhc2UgdGhlIGxheWVyIGlzIGRlbGV0ZWQgYmVmb3JlIHRoZSBRR3JhcGhpY3NXZWJW aWV3LgorCisgICAgICAgICogQXBpL3FncmFwaGljc3dlYnZpZXcuY3BwOgorICAgICAgICAoUUdy YXBoaWNzV2ViVmlld1ByaXZhdGU6OlFHcmFwaGljc1dlYlZpZXdQcml2YXRlKToKKyAgICAgICAg KFFHcmFwaGljc1dlYlZpZXdQcml2YXRlOjp+UUdyYXBoaWNzV2ViVmlld1ByaXZhdGUpOgorICAg ICAgICAoUUdyYXBoaWNzV2ViVmlld1ByaXZhdGU6OnNldFJvb3RHcmFwaGljc0xheWVyKToKKyAg ICAgICAgKFFHcmFwaGljc1dlYlZpZXdQcml2YXRlOjp1cGRhdGVDb21wb3NpdGluZ1Njcm9sbFBv c2l0aW9uKToKKwogMjAxMC0wNS0wMyAgQWJoaXNoZWsgQXJ5YSAgPGluZmVybm9AY2hyb21pdW0u b3JnPgogCiAgICAgICAgIFJldmlld2VkIGJ5IEFkYW0gQmFydGguCg==