49314 2010-11-10 03:23:52 -0800 [gtk] The revision r71528 causes crashes in GObjectEventListener 2010-11-10 10:05:40 -0800 1 1 1 Unclassified WebKit WebKitGTK 528+ (Nightly build) PC Linux RESOLVED FIXED P2 Normal --- 1 alex webkit-unassigned mrobinson xan.lopez oldest_to_newest 307284 0 alex 2010-11-10 03:23:52 -0800 The patch fixing bug 49136 is causing crashes, you can check it in the bots cores log or it can also be reproduced with epiphany opening the browser and loading a webpage: Program received signal SIGSEGV, Segmentation fault. 0x00007ffff56658fb in WTF::RefCountedBase::ref (this=0x171c408) at ../../../JavaScriptCore/wtf/RefCounted.h:37 37 ASSERT(!m_adoptionIsRequired); Missing separate debuginfos, use: debuginfo-install nss-3.12.8-2.fc13.x86_64 nss-util-3.12.8-1.fc13.x86_64 (gdb) bt #0 0x00007ffff56658fb in WTF::RefCountedBase::ref (this=0x171c408) at ../../../JavaScriptCore/wtf/RefCounted.h:37 #1 0x00007ffff569b4f7 in WTF::refIfNotNull<WebCore::EventListener> (ptr=0x171c400) at ../../../JavaScriptCore/wtf/PassRefPtr.h:53 #2 0x00007ffff569b49b in WTF::PassRefPtr<WebCore::EventListener>::PassRefPtr (this=0x7fffffffb640, ptr=0x171c400) at ../../../JavaScriptCore/wtf/PassRefPtr.h:67 #3 0x00007ffff569af3c in WebCore::GObjectEventListener::GObjectEventListener (this=0x171c400, object=0x1807200, window=0x0, node=0x173cbd0, domEventName=0x7ffff74620f8 "focus", signalName=0x7ffff74620ec "focus-event") at ../../../WebCore/bindings/gobject/GObjectEventListener.cpp:46 #4 0x00007ffff639736e in WebCore::GObjectEventListener::addEventListener (object=0x1807200, node=0x173cbd0, domEventName=0x7ffff74620f8 "focus", signalName=0x7ffff74620ec "focus-event") at ../../../WebCore/bindings/gobject/GObjectEventListener.h:44 #5 0x00007ffff6394dd2 in webkit_dom_node_constructed (object=0x1807200) at DerivedSources/webkit/WebKitDOMNode.cpp:775 #6 0x00007ffff632d2cc in webkit_dom_document_constructed (object=0x1807200) at DerivedSources/webkit/WebKitDOMDocument.cpp:1461 #7 0x00007ffff131ee56 in g_object_newv (object_type=25016448, n_parameters=1, parameters=0x18b7270) at gobject.c:1495 #8 0x00007ffff131f4a4 in g_object_new_valist (object_type=25016448, first_property_name=0x7ffff739a900 "core-object", var_args=0x7fffffffb910) at gobject.c:1583 #9 0x00007ffff131e670 in g_object_new (object_type=25016448, first_property_name=0x7ffff739a900 "core-object") at gobject.c:1301 #10 0x00007ffff632da98 in WebKit::wrapDocument (coreObject=0x173cbd0) at DerivedSources/webkit/WebKitDOMDocument.cpp:1701 #11 0x00007ffff632737a in WebKit::kit (obj=0x173cbd0) at DerivedSources/webkit/WebKitDOMDocument.cpp:122 #12 0x00007ffff60831f1 in webkit_web_view_get_dom_document (webView=0x1648160) at ../../../WebKit/gtk/webkit/webkitwebview.cpp:4791 #13 0x00000000004876c5 in _ephy_web_view_hook_into_forms (web_view=0x1648160) at ephy-web-view.c:935 #14 0x0000000000489578 in load_status_cb (web_view=0x1648160, pspec=0x8046a0, user_data=0x0) at ephy-web-view.c:1969 #15 0x00007ffff1336380 in g_cclosure_marshal_VOID__PARAM (closure=0x16b1190, return_value=0x0, n_param_values=2, param_values=0x1788e30, invocation_hint=0x7fffffffbd50, marshal_data=0x0) at gmarshal.c:533 #16 0x00007ffff131a61f in g_closure_invoke (closure=0x16b1190, return_value=0x0, n_param_values=2, param_values=0x1788e30, invocation_hint=0x7fffffffbd50) at gclosure.c:766 #17 0x00007ffff133504c in signal_emit_unlocked_R (node=0x711650, detail=2153, instance=0x1648160, emission_return=0x0, instance_and_params=0x1788e30) at gsignal.c:3252 #18 0x00007ffff1333ee1 in g_signal_emit_valist (instance=0x1648160, signal_id=1, detail=2153, var_args=0x7fffffffbfd0) at gsignal.c:2983 #19 0x00007ffff133445f in g_signal_emit (instance=0x1648160, signal_id=1, detail=2153) at gsignal.c:3040 #20 0x00007ffff131d977 in g_object_dispatch_properties_changed (object=0x1648160, n_pspecs=1, pspecs=0x7fffffffc160) at gobject.c:919 #21 0x00007ffff131c4d4 in g_object_notify_dispatcher (object=0x1648160, n_pspecs=1, pspecs=0x7fffffffc160) at gobject.c:327 #22 0x00007ffff131bf7d in g_object_notify_queue_thaw (object=0x1648160, nqueue=0x1723f00) at gobjectnotifyqueue.c:132 #23 0x00007ffff131db8a in g_object_notify_by_spec_internal (object=0x1648160, pspec=0x8046a0) at gobject.c:977 #24 0x00007ffff131dced in g_object_notify (object=0x1648160, property_name=0x7ffff6db8361 "load-status") at gobject.c:1018 #25 0x00007ffff6055715 in WebKit::notifyStatus (frame=0x164a060, loadStatus=WEBKIT_LOAD_FINISHED) at ../../../WebKit/gtk/WebCoreSupport/FrameLoaderClientGtk.cpp:218 #26 0x00007ffff6055755 in WebKit::loadDone (frame=0x164a060, didSucceed=true) at ../../../WebKit/gtk/WebCoreSupport/FrameLoaderClientGtk.cpp:226 #27 0x00007ffff6057b87 in WebKit::FrameLoaderClient::dispatchDidFinishLoad (this=0x16872f0) at ../../../WebKit/gtk/WebCoreSupport/FrameLoaderClientGtk.cpp:716 #28 0x00007ffff5b64562 in WebCore::FrameLoader::checkLoadCompleteForThisFrame (this=0x1687498) at ../../../WebCore/loader/FrameLoader.cpp:2427 #29 0x00007ffff5b64c30 in WebCore::FrameLoader::recursiveCheckLoadComplete (this=0x1687498) at ../../../WebCore/loader/FrameLoader.cpp:2538 #30 0x00007ffff5b64ce2 in WebCore::FrameLoader::checkLoadComplete (this=0x1687498) at ../../../WebCore/loader/FrameLoader.cpp:2551 #31 0x00007ffff5b4f061 in WebCore::DocumentLoader::removeSubresourceLoader (this=0x16f4e00, loader=0x172b400) at ../../../WebCore/loader/DocumentLoader.cpp:720 #32 0x00007ffff5baa9c6 in WebCore::SubresourceLoader::didFinishLoading (this=0x172b400, finishTime=0) at ../../../WebCore/loader/SubresourceLoader.cpp:187 #33 0x00007ffff5ba1a09 in WebCore::ResourceLoader::didFinishLoading (this=0x172b400, finishTime=0) at ../../../WebCore/loader/ResourceLoader.cpp:437 #34 0x00007ffff602c8bb in WebCore::closeCallback (source=0x735cf0, res=0x17fd400) at ../../../WebCore/platform/network/soup/ResourceHandleSoup.cpp:779 #35 0x00007ffff15bd792 in async_ready_close_callback_wrapper (source_object=0x735cf0, res=0x17fd400, user_data=0x0) at ginputstream.c:484 #36 0x00007ffff15d3366 in g_simple_async_result_complete (simple=0x17fd400) at gsimpleasyncresult.c:692 #37 0x00007ffff15d33a2 in complete_in_idle_cb (data=0x17fd400) at gsimpleasyncresult.c:702 #38 0x00007ffff0c262ed in g_idle_dispatch (source=0x1881a90, callback=0x7ffff15d336f <complete_in_idle_cb>, user_data=0x17fd400) at gmain.c:4254 #39 0x00007ffff0c224b0 in g_main_dispatch (context=0x735490) at gmain.c:2149 #40 0x00007ffff0c239ba in g_main_context_dispatch (context=0x735490) at gmain.c:2702 #41 0x00007ffff0c23e80 in g_main_context_iterate (context=0x735490, block=1, dispatch=1, self=0x6f3890) at gmain.c:2780 #42 0x00007ffff0c24617 in g_main_loop_run (loop=0x763e90) at gmain.c:2988 #43 0x00007ffff430a380 in gtk_main () at gtkmain.c:1321 #44 0x000000000042fd59 in main (argc=1, argv=0x7fffffffda08) at ephy-main.c:732 307291 1 alex 2010-11-10 04:00:42 -0800 (In reply to comment #0) > The patch fixing bug 49136 is causing crashes, you can check it in the bots cores log or it can also be reproduced with epiphany opening the browser and loading a webpage: > > Program received signal SIGSEGV, Segmentation fault. > 0x00007ffff56658fb in WTF::RefCountedBase::ref (this=0x171c408) at ../../../JavaScriptCore/wtf/RefCounted.h:37 > 37 ASSERT(!m_adoptionIsRequired); It seems we are using the listener pointer in the constructor as a PassRefPtr before even adopting the reference, I guess the best option would be to move that code to the addEventListener in the .h. Trying the solution. 307295 2 73486 alex 2010-11-10 04:52:07 -0800 Created attachment 73486 Proposed patch 307364 3 73486 mrobinson 2010-11-10 08:40:37 -0800 Comment on attachment 73486 Proposed patch Thanks! 307398 4 alex 2010-11-10 10:05:40 -0800 Landed http://trac.webkit.org/changeset/71748 73486 2010-11-10 04:52:07 -0800 2010-11-10 08:40:37 -0800 Proposed patch fix_gobject_event_listener.patch text/plain 4244 alex Y29tbWl0IDVjNzY4OThmZTU1ODg1ZDIwMDk5ZmEwZjZjYjExYTNiMjM3MmNmZDcKQXV0aG9yOiBB bGVqYW5kcm8gRy4gQ2FzdHJvIDxhbGV4QGlnYWxpYS5jb20+CkRhdGU6ICAgV2VkIE5vdiAxMCAx Mzo0NzoyNSAyMDEwICswMTAwCgogICAgMjAxMC0xMS0xMCAgQWxlamFuZHJvIEcuIENhc3RybyAg PGFsZXhAaWdhbGlhLmNvbT4KICAgIAogICAgICAgICAgICBSZXZpZXdlZCBieSBOT0JPRFkgKE9P UFMhKS4KICAgIAogICAgICAgICAgICBbZ3RrXSBUaGUgcmV2aXNpb24gcjcxNTI4IGNhdXNlcyBj cmFzaGVzIGluIEdPYmplY3RFdmVudExpc3RlbmVyCiAgICAgICAgICAgIGh0dHBzOi8vYnVncy53 ZWJraXQub3JnL3Nob3dfYnVnLmNnaT9pZD00OTMxNAogICAgCiAgICAgICAgICAgIE1vdmVkIHRo ZSBhZGRpdGlvbiBvZiB0aGUgZXZlbnQgbGlzdGVuZXIgdG8gdGhlIG5vZGUgYWZ0ZXIgY2FsbGlu ZwogICAgICAgICAgICB0aGUgY29uc3RydWN0b3Igb2YgdGhlIGV2ZW50IGxpc3RlbmVyLiBUaGlz IGlzIHJlcXVpcmVkIGJlYWN1c2UKICAgICAgICAgICAgdGhlIGFkZEV2ZW50TGlzdGVuZXIgQVBJ IHJlY2VpdmVzIHRoZSBFdmVudExpc3RlbmVyIGluc2lkZSBhCiAgICAgICAgICAgIFBhc3NSZWZQ dHIuCiAgICAKICAgICAgICAgICAgKiBiaW5kaW5ncy9nb2JqZWN0L0dPYmplY3RFdmVudExpc3Rl bmVyLmNwcDoKICAgICAgICAgICAgKFdlYkNvcmU6OkdPYmplY3RFdmVudExpc3RlbmVyOjpHT2Jq ZWN0RXZlbnRMaXN0ZW5lcik6CiAgICAgICAgICAgICogYmluZGluZ3MvZ29iamVjdC9HT2JqZWN0 RXZlbnRMaXN0ZW5lci5oOgogICAgICAgICAgICAoV2ViQ29yZTo6R09iamVjdEV2ZW50TGlzdGVu ZXI6OmFkZEV2ZW50TGlzdGVuZXIpOgoKZGlmZiAtLWdpdCBhL1dlYkNvcmUvQ2hhbmdlTG9nIGIv V2ViQ29yZS9DaGFuZ2VMb2cKaW5kZXggY2YyN2E5Yy4uMDEwYmViNCAxMDA2NDQKLS0tIGEvV2Vi Q29yZS9DaGFuZ2VMb2cKKysrIGIvV2ViQ29yZS9DaGFuZ2VMb2cKQEAgLTEsMyArMSwyMCBAQAor MjAxMC0xMS0xMCAgQWxlamFuZHJvIEcuIENhc3RybyAgPGFsZXhAaWdhbGlhLmNvbT4KKworICAg ICAgICBSZXZpZXdlZCBieSBOT0JPRFkgKE9PUFMhKS4KKworICAgICAgICBbZ3RrXSBUaGUgcmV2 aXNpb24gcjcxNTI4IGNhdXNlcyBjcmFzaGVzIGluIEdPYmplY3RFdmVudExpc3RlbmVyCisgICAg ICAgIGh0dHBzOi8vYnVncy53ZWJraXQub3JnL3Nob3dfYnVnLmNnaT9pZD00OTMxNAorCisgICAg ICAgIE1vdmVkIHRoZSBhZGRpdGlvbiBvZiB0aGUgZXZlbnQgbGlzdGVuZXIgdG8gdGhlIG5vZGUg YWZ0ZXIgY2FsbGluZworICAgICAgICB0aGUgY29uc3RydWN0b3Igb2YgdGhlIGV2ZW50IGxpc3Rl bmVyLiBUaGlzIGlzIHJlcXVpcmVkIGJlYWN1c2UKKyAgICAgICAgdGhlIGFkZEV2ZW50TGlzdGVu ZXIgQVBJIHJlY2VpdmVzIHRoZSBFdmVudExpc3RlbmVyIGluc2lkZSBhCisgICAgICAgIFBhc3NS ZWZQdHIuCisKKyAgICAgICAgKiBiaW5kaW5ncy9nb2JqZWN0L0dPYmplY3RFdmVudExpc3RlbmVy LmNwcDoKKyAgICAgICAgKFdlYkNvcmU6OkdPYmplY3RFdmVudExpc3RlbmVyOjpHT2JqZWN0RXZl bnRMaXN0ZW5lcik6CisgICAgICAgICogYmluZGluZ3MvZ29iamVjdC9HT2JqZWN0RXZlbnRMaXN0 ZW5lci5oOgorICAgICAgICAoV2ViQ29yZTo6R09iamVjdEV2ZW50TGlzdGVuZXI6OmFkZEV2ZW50 TGlzdGVuZXIpOgorCiAyMDEwLTExLTEwICBTaGluaWNoaXJvIEhhbWFqaSAgPGhhbWFqaUBjaHJv bWl1bS5vcmc+CiAKICAgICAgICAgQWRkaW5nIGEgbWFudWFsIHRlc3Qgd2hpY2ggSSBmb3Jnb3Qg dG8gYWRkIGluIHI3MTYxOC4KZGlmZiAtLWdpdCBhL1dlYkNvcmUvYmluZGluZ3MvZ29iamVjdC9H T2JqZWN0RXZlbnRMaXN0ZW5lci5jcHAgYi9XZWJDb3JlL2JpbmRpbmdzL2dvYmplY3QvR09iamVj dEV2ZW50TGlzdGVuZXIuY3BwCmluZGV4IDU1M2Q3MTcuLjNlMGFhMmEgMTAwNjQ0Ci0tLSBhL1dl YkNvcmUvYmluZGluZ3MvZ29iamVjdC9HT2JqZWN0RXZlbnRMaXN0ZW5lci5jcHAKKysrIGIvV2Vi Q29yZS9iaW5kaW5ncy9nb2JqZWN0L0dPYmplY3RFdmVudExpc3RlbmVyLmNwcApAQCAtMTksMTAg KzE5LDggQEAKICNpbmNsdWRlICJjb25maWcuaCIKICNpbmNsdWRlICJHT2JqZWN0RXZlbnRMaXN0 ZW5lci5oIgogCi0jaW5jbHVkZSAiRE9NV2luZG93LmgiCiAjaW5jbHVkZSAiRXZlbnQuaCIKICNp bmNsdWRlICJFdmVudExpc3RlbmVyLmgiCi0jaW5jbHVkZSAiTm9kZS5oIgogI2luY2x1ZGUgIndl YmtpdC9XZWJLaXRET01FdmVudC5oIgogI2luY2x1ZGUgIndlYmtpdC9XZWJLaXRET01FdmVudFBy aXZhdGUuaCIKICNpbmNsdWRlIDxnbGliLW9iamVjdC5oPgpAQCAtNDAsMTAgKzM4LDcgQEAgR09i amVjdEV2ZW50TGlzdGVuZXI6OkdPYmplY3RFdmVudExpc3RlbmVyKEdPYmplY3QqIG9iamVjdCwg RE9NV2luZG93KiB3aW5kb3csIE4KICAgICAsIG1fc2lnbmFsTmFtZShzaWduYWxOYW1lKQogewog ICAgIEFTU0VSVCghbV9jb3JlV2luZG93IHx8ICFtX2NvcmVOb2RlKTsKLSAgICBpZiAobV9jb3Jl V2luZG93KQotICAgICAgICBtX2NvcmVXaW5kb3ctPmFkZEV2ZW50TGlzdGVuZXIoZG9tRXZlbnRO YW1lLCB0aGlzLCBmYWxzZSk7Ci0gICAgaWYgKG1fY29yZU5vZGUpCi0gICAgICAgIG1fY29yZU5v ZGUtPmFkZEV2ZW50TGlzdGVuZXIoZG9tRXZlbnROYW1lLCB0aGlzLCBmYWxzZSk7CisKICAgICBn X29iamVjdF93ZWFrX3JlZihvYmplY3QsIHJlaW50ZXJwcmV0X2Nhc3Q8R1dlYWtOb3RpZnk+KEdP YmplY3RFdmVudExpc3RlbmVyOjpnb2JqZWN0RGVzdHJveWVkQ2FsbGJhY2spLCB0aGlzKTsKIH0K IApkaWZmIC0tZ2l0IGEvV2ViQ29yZS9iaW5kaW5ncy9nb2JqZWN0L0dPYmplY3RFdmVudExpc3Rl bmVyLmggYi9XZWJDb3JlL2JpbmRpbmdzL2dvYmplY3QvR09iamVjdEV2ZW50TGlzdGVuZXIuaApp bmRleCBlNWFkMmU1Li5lZjE2MzdhIDEwMDY0NAotLS0gYS9XZWJDb3JlL2JpbmRpbmdzL2dvYmpl Y3QvR09iamVjdEV2ZW50TGlzdGVuZXIuaAorKysgYi9XZWJDb3JlL2JpbmRpbmdzL2dvYmplY3Qv R09iamVjdEV2ZW50TGlzdGVuZXIuaApAQCAtMTksNyArMTksOSBAQAogI2lmbmRlZiBHT2JqZWN0 RXZlbnRMaXN0ZW5lcl9oCiAjZGVmaW5lIEdPYmplY3RFdmVudExpc3RlbmVyX2gKIAorI2luY2x1 ZGUgIkRPTVdpbmRvdy5oIgogI2luY2x1ZGUgIkV2ZW50TGlzdGVuZXIuaCIKKyNpbmNsdWRlICJO b2RlLmgiCiAKICNpbmNsdWRlIDx3dGYvUmVmUHRyLmg+CiAjaW5jbHVkZSA8d3RmL3RleHQvQ1N0 cmluZy5oPgpAQCAtMjgsMjAgKzMwLDE5IEBAIHR5cGVkZWYgc3RydWN0IF9HT2JqZWN0IEdPYmpl Y3Q7CiAKIG5hbWVzcGFjZSBXZWJDb3JlIHsKIAotY2xhc3MgRE9NV2luZG93OwotY2xhc3MgTm9k ZTsKLQogY2xhc3MgR09iamVjdEV2ZW50TGlzdGVuZXIgOiBwdWJsaWMgRXZlbnRMaXN0ZW5lciB7 CiBwdWJsaWM6CiAKICAgICBzdGF0aWMgdm9pZCBhZGRFdmVudExpc3RlbmVyKEdPYmplY3QqIG9i amVjdCwgRE9NV2luZG93KiB3aW5kb3csIGNvbnN0IGNoYXIqIGRvbUV2ZW50TmFtZSwgY29uc3Qg Y2hhciogc2lnbmFsTmFtZSkKICAgICB7CiAgICAgICAgIFJlZlB0cjxHT2JqZWN0RXZlbnRMaXN0 ZW5lcj4gbGlzdGVuZXIoYWRvcHRSZWYobmV3IEdPYmplY3RFdmVudExpc3RlbmVyKG9iamVjdCwg d2luZG93LCAwLCBkb21FdmVudE5hbWUsIHNpZ25hbE5hbWUpKSk7CisgICAgICAgIHdpbmRvdy0+ YWRkRXZlbnRMaXN0ZW5lcihkb21FdmVudE5hbWUsIGxpc3RlbmVyLnJlbGVhc2UoKSwgZmFsc2Up OwogICAgIH0KIAogICAgIHN0YXRpYyB2b2lkIGFkZEV2ZW50TGlzdGVuZXIoR09iamVjdCogb2Jq ZWN0LCBOb2RlKiBub2RlLCBjb25zdCBjaGFyKiBkb21FdmVudE5hbWUsIGNvbnN0IGNoYXIqIHNp Z25hbE5hbWUpCiAgICAgewogICAgICAgICBSZWZQdHI8R09iamVjdEV2ZW50TGlzdGVuZXI+IGxp c3RlbmVyKGFkb3B0UmVmKG5ldyBHT2JqZWN0RXZlbnRMaXN0ZW5lcihvYmplY3QsIDAsIG5vZGUs IGRvbUV2ZW50TmFtZSwgc2lnbmFsTmFtZSkpKTsKKyAgICAgICAgbm9kZS0+YWRkRXZlbnRMaXN0 ZW5lcihkb21FdmVudE5hbWUsIGxpc3RlbmVyLnJlbGVhc2UoKSwgZmFsc2UpOwogICAgIH0KIAog ICAgIHN0YXRpYyB2b2lkIGdvYmplY3REZXN0cm95ZWRDYWxsYmFjayhHT2JqZWN0RXZlbnRMaXN0 ZW5lciogbGlzdGVuZXIsIEdPYmplY3QqKQo=