50173 2010-11-29 12:59:23 -0800 corrupted pointer in webkit_web_view_get_resource 2015-05-07 17:18:51 -0700 1 1 1 Unclassified WebKit WebKitGTK 528+ (Nightly build) Other Linux RESOLVED INVALID P2 Normal --- 0 kevin-webkit webkit-unassigned kwm mrobinson tuxator oldest_to_newest 314577 0 kevin-webkit 2010-11-29 12:59:23 -0800 We are seeing a crash here in webkit_web_view_get resource. This is webkitgtk-1.3.6. The downstream report is: https://bugzilla.redhat.com/show_bug.cgi?id=657683 The stack trace is available at: https://bugzilla.redhat.com/attachment.cgi?id=463209 419286 1 96876 tuxator 2011-06-12 04:10:38 -0700 Created attachment 96876 proposed fix 419292 2 96876 xan.lopez 2011-06-12 07:07:55 -0700 Comment on attachment 96876 proposed fix When we remove the main resource we set its identifier to the empty string "", so unless there's a good reason not to I'd rather set it to "" initially too. That would make this method just fail gracefully and return NULL without the need for a g_return_val_if_fail. 419346 3 96876 mrobinson 2011-06-12 15:48:52 -0700 Comment on attachment 96876 proposed fix View in context: https://bugs.webkit.org/attachment.cgi?id=96876&action=review > Source/WebKit/gtk/webkit/webkitwebview.cpp:4882 > + g_return_val_if_fail(priv->mainResourceIdentifier.data(), 0); > + Won't this also print a critical warning? 419496 4 96944 naiem.shaik 2011-06-13 04:35:45 -0700 Created attachment 96944 Incorporating review comments 419565 5 96955 tuxator 2011-06-13 08:04:26 -0700 Created attachment 96955 update ref counts Patch as suggested by Martin Robinson on irc. Works nice. Does not crash anymore. 419588 6 96960 tuxator 2011-06-13 09:12:20 -0700 Created attachment 96960 correct version of previous patch Sorry. I edited previous patch wrongly by mistake. This one is a proper version. 419611 7 96960 mrobinson 2011-06-13 09:56:03 -0700 Comment on attachment 96960 correct version of previous patch View in context: https://bugs.webkit.org/attachment.cgi?id=96960&action=review > Source/WebKit/gtk/webkit/webkitwebview.cpp:4837 > + g_object_ref(webView); Please leave a comment here explaining that we want to keep the WebKitWebView alive until we have finished loading the main resource. You should also mention that the same approach is taken in the Mac port. > Source/WebKit/gtk/webkit/webkitwebview.cpp:4855 > priv->mainResource = 0; > } else > g_hash_table_remove(priv->subResources.get(), identifier); > + > + g_object_unref(webView); Here you should only unref the WebView if the main resource is done loading. 1092882 8 mrobinson 2015-05-07 17:18:51 -0700 WebKit1 is no longer around, so I'm going to close this one. Sorry that we weren't able to incorporate it. 96876 2011-06-12 04:10:38 -0700 2011-06-13 08:04:26 -0700 proposed fix fix.patch text/plain 760 tuxator ZGlmZiAtLWdpdCBhL1NvdXJjZS9XZWJLaXQvZ3RrL3dlYmtpdC93ZWJraXR3ZWJ2aWV3LmNwcCBi L1NvdXJjZS9XZWJLaXQvZ3RrL3dlYmtpdC93ZWJraXR3ZWJ2aWV3LmNwcAppbmRleCBlYTY5YjAy Li42NGQxZjg3IDEwMDY0NAotLS0gYS9Tb3VyY2UvV2ViS2l0L2d0ay93ZWJraXQvd2Via2l0d2Vi dmlldy5jcHAKKysrIGIvU291cmNlL1dlYktpdC9ndGsvd2Via2l0L3dlYmtpdHdlYnZpZXcuY3Bw CkBAIC00ODc4LDYgKzQ4NzgsOCBAQCBXZWJLaXRXZWJSZXNvdXJjZSogd2Via2l0X3dlYl92aWV3 X2dldF9yZXNvdXJjZShXZWJLaXRXZWJWaWV3KiB3ZWJWaWV3LCBjaGFyKiBpZAogICAgIGdwb2lu dGVyIHdlYlJlc291cmNlID0gMDsKICAgICBnYm9vbGVhbiByZXNvdXJjZUZvdW5kID0gZ19oYXNo X3RhYmxlX2xvb2t1cF9leHRlbmRlZChwcml2LT5zdWJSZXNvdXJjZXMuZ2V0KCksIGlkZW50aWZp ZXIsIE5VTEwsICZ3ZWJSZXNvdXJjZSk7CiAKKyAgICBnX3JldHVybl92YWxfaWZfZmFpbChwcml2 LT5tYWluUmVzb3VyY2VJZGVudGlmaWVyLmRhdGEoKSwgMCk7CisKICAgICAvLyBUaGUgb25seSBy ZXNvdXJjZSB3ZSBkbyBub3Qgc3RvcmUgaW4gdGhpcyBoYXNoIHRhYmxlIGlzIHRoZQogICAgIC8v IG1haW4hICBJZiB3ZSBkaWQgbm90IGZpbmQgYSByZXF1ZXN0LCBpdCBwcm9iYWJseSBtZWFucyB0 aGUgbG9hZAogICAgIC8vIGhhcyBiZWVuIGludGVycnVwdGVkIHdoaWxlIHdoaWxlIGEgcmVzb3Vy Y2Ugd2FzIHN0aWxsIGJlaW5nCg== 96944 2011-06-13 04:35:45 -0700 2011-06-13 05:34:04 -0700 Incorporating review comments uninitialized.patch text/plain 1689 naiem.shaik SW5kZXg6IFNvdXJjZS9XZWJLaXQvZ3RrL0NoYW5nZUxvZwo9PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09Ci0tLSBTb3VyY2Uv V2ViS2l0L2d0ay9DaGFuZ2VMb2cJKHJldmlzaW9uIDg4NjM0KQorKysgU291cmNlL1dlYktpdC9n dGsvQ2hhbmdlTG9nCSh3b3JraW5nIGNvcHkpCkBAIC0xLDMgKzEsMTYgQEAKKzIwMTEtMDYtMTMg IE5haWVtIFNoYWlrICA8bmFpZW0uc2hhaWtAZ21haWwuY29tPiA8dHV4YXRvckBvMi5wbD4KKwor ICAgICAgICBSZXZpZXdlZCBieSBOT0JPRFkgKE9PUFMhKS4KKworICAgICAgICBVbmluaXRpYWxp emVkIHN0cmluZyB2YXJpYWJsZQorICAgICAgICBodHRwczovL2J1Z3Mud2Via2l0Lm9yZy9zaG93 X2J1Zy5jZ2k/aWQ9NTAxNzMKKworICAgICAgICBTdHJpbmcgbWFpblJlc291cmNlSWRlbnRpZmll ciBpcyBpbml0aWFsaXplZCB0byBOVUxMIGJ1dCB0aGlzIGlzIGNhdXNpbmcgYSBjcmFzaCAKKyAg ICAgICAgd2hlbiBzYW1lIGlzIHNlbmQgdG8gc3RyY21wIHNvIGluc3RlYWQgaXQgaXMgYmVpbmcg aW5pdGlhbGl6ZWQgdG8gZW1wdHJ5IHN0cmluZyAiIgorCisgICAgICAgICogd2Via2l0L3dlYmtp dHdlYnZpZXcuY3BwOgorICAgICAgICAod2Via2l0X3dlYl92aWV3X2luaXQpOgorCiAyMDExLTA2 LTEzICBDYXJsb3MgR2FyY2lhIENhbXBvcyAgPGNnYXJjaWFAaWdhbGlhLmNvbT4KIAogICAgICAg ICBSZXZpZXdlZCBieSBNYXJ0aW4gUm9iaW5zb24uCkluZGV4OiBTb3VyY2UvV2ViS2l0L2d0ay93 ZWJraXQvd2Via2l0d2Vidmlldy5jcHAKPT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PQotLS0gU291cmNlL1dlYktpdC9ndGsv d2Via2l0L3dlYmtpdHdlYnZpZXcuY3BwCShyZXZpc2lvbiA4ODYzMCkKKysrIFNvdXJjZS9XZWJL aXQvZ3RrL3dlYmtpdC93ZWJraXR3ZWJ2aWV3LmNwcAkod29ya2luZyBjb3B5KQpAQCAtMzQ4OSw3 ICszNDg5LDEwIEBAIHN0YXRpYyB2b2lkIHdlYmtpdF93ZWJfdmlld19pbml0KFdlYktpdFcKIAog ICAgIHByaXYtPndlYldpbmRvd0ZlYXR1cmVzID0gYWRvcHRHUmVmKHdlYmtpdF93ZWJfd2luZG93 X2ZlYXR1cmVzX25ldygpKTsKIAorICAgIHByaXYtPm1haW5SZXNvdXJjZSA9IDA7CisgICAgcHJp di0+bWFpblJlc291cmNlSWRlbnRpZmllciA9ICIiOwogICAgIHByaXYtPnN1YlJlc291cmNlcyA9 IGFkb3B0R1JlZihnX2hhc2hfdGFibGVfbmV3X2Z1bGwoZ19zdHJfaGFzaCwgZ19zdHJfZXF1YWws IGdfZnJlZSwgZ19vYmplY3RfdW5yZWYpKTsKKyAgICBwcml2LT50b29sdGlwVGV4dCA9ICIiOwog CiAgICAgZ3RrX2RyYWdfZGVzdF9zZXQoR1RLX1dJREdFVCh3ZWJWaWV3KSwgc3RhdGljX2Nhc3Q8 R3RrRGVzdERlZmF1bHRzPigwKSwgMCwgMCwgc3RhdGljX2Nhc3Q8R2RrRHJhZ0FjdGlvbj4oR0RL X0FDVElPTl9DT1BZIHwgR0RLX0FDVElPTl9DT1BZIHwgR0RLX0FDVElPTl9NT1ZFIHwgR0RLX0FD VElPTl9MSU5LIHwgR0RLX0FDVElPTl9QUklWQVRFKSk7CiAgICAgZ3RrX2RyYWdfZGVzdF9zZXRf dGFyZ2V0X2xpc3QoR1RLX1dJREdFVCh3ZWJWaWV3KSwgUGFzdGVib2FyZEhlbHBlcjo6ZGVmYXVs dFBhc3RlYm9hcmRIZWxwZXIoKS0+dGFyZ2V0TGlzdCgpKTsK 96955 2011-06-13 08:04:26 -0700 2011-06-13 09:12:20 -0700 update ref counts 0001-GTK-Update-reference-count-to-WebView-when-adding.patch text/plain 2153 tuxator RnJvbSAxZjkwOThkN2JjZTU0Mzg5NmMzNWZlNGJlZDE1ZTExNDEwNjVjZWZkIE1vbiBTZXAgMTcg MDA6MDA6MDAgMjAwMQpGcm9tOiA9P1VURi04P3E/UGF3ZT1DNT04Mj0yMEZvcnlzaXVrPz0gPHR1 eGF0b3JAbzIucGw+CkRhdGU6IE1vbiwgMTMgSnVuIDIwMTEgMTY6NTE6MzkgKzAyMDAKU3ViamVj dDogW1BBVENIXSBbR1RLXSBVcGRhdGUgcmVmZXJlbmNlIGNvdW50IHRvIFdlYlZpZXcgd2hlbiBh ZGRpbmcgb3IKIHJlbW92aW5nIHJlc291cmNlcwoKLS0tCiBTb3VyY2UvV2ViS2l0L2d0ay9DaGFu Z2VMb2cgICAgICAgICAgICAgICAgfCAgIDE0ICsrKysrKysrKysrKysrCiBTb3VyY2UvV2ViS2l0 L2d0ay93ZWJraXQvd2Via2l0d2Vidmlldy5jcHAgfCAgICA0ICsrKysKIDIgZmlsZXMgY2hhbmdl ZCwgMTggaW5zZXJ0aW9ucygrKSwgMCBkZWxldGlvbnMoLSkKCmRpZmYgLS1naXQgYS9Tb3VyY2Uv V2ViS2l0L2d0ay9DaGFuZ2VMb2cgYi9Tb3VyY2UvV2ViS2l0L2d0ay9DaGFuZ2VMb2cKaW5kZXgg NTc0MzMyZi4uNmRiNWIwMyAxMDA2NDQKLS0tIGEvU291cmNlL1dlYktpdC9ndGsvQ2hhbmdlTG9n CisrKyBiL1NvdXJjZS9XZWJLaXQvZ3RrL0NoYW5nZUxvZwpAQCAtMSwzICsxLDE3IEBACisyMDEx LTA2LTEzICBQYXdlxYIgRm9yeXNpdWsgIDx0dXhhdG9yQG8yLnBsPgorCisgICAgICAgIFJldmll d2VkIGJ5IE5PQk9EWSAoT09QUyEpLgorCisgICAgICAgIFtHVEtdIFVwZGF0ZSByZWZlcmVuY2Ug Y291bnQgdG8gV2ViVmlldyB3aGVuIGFkZGluZyBvciByZW1vdmluZyByZXNvdXJjZXMKKyAgICAg ICAgaHR0cHM6Ly9idWdzLndlYmtpdC5vcmcvc2hvd19idWcuY2dpP2lkPTUwMTczCisKKyAgICAg ICAgU3VnZ2VzdGVkIGJ5IE1hcnRpbiBSb2JpbnNvbi4KKyAgICAgICAgUHJldmVudHMgYSBjcmFz aCB0aWdnZXJlZCBieSB0cnlpbmcgdG8gZ2V0IHJlc291cmNlcyBmcm9tIGFscmVhZHkgZGlzcG9z ZWQgV2ViVmlldy4KKworICAgICAgICAqIHdlYmtpdC93ZWJraXR3ZWJ2aWV3LmNwcDoKKyAgICAg ICAgKHdlYmtpdF93ZWJfdmlld19hZGRfbWFpbl9yZXNvdXJjZSk6IEluY3JlbWVudCByZWYgY291 bnQgd2hlbiByZXNvdXJjZSBpcyBhZGRlZAorICAgICAgICAod2Via2l0X3dlYl92aWV3X3JlbW92 ZV9yZXNvdXJjZSk6IERlY3JlbWVudCByZWYgY291bnQgd2hlbiByZW1vdmluZyByZXNvdXJjZQor CiAyMDExLTA2LTEzICBDYXJsb3MgR2FyY2lhIENhbXBvcyAgPGNnYXJjaWFAaWdhbGlhLmNvbT4K IAogICAgICAgICBSZXZpZXdlZCBieSBNYXJ0aW4gUm9iaW5zb24uCmRpZmYgLS1naXQgYS9Tb3Vy Y2UvV2ViS2l0L2d0ay93ZWJraXQvd2Via2l0d2Vidmlldy5jcHAgYi9Tb3VyY2UvV2ViS2l0L2d0 ay93ZWJraXQvd2Via2l0d2Vidmlldy5jcHAKaW5kZXggY2QyYjcyZC4uYjc5MjhlOCAxMDA2NDQK LS0tIGEvU291cmNlL1dlYktpdC9ndGsvd2Via2l0L3dlYmtpdHdlYnZpZXcuY3BwCisrKyBiL1Nv dXJjZS9XZWJLaXQvZ3RrL3dlYmtpdC93ZWJraXR3ZWJ2aWV3LmNwcApAQCAtNDgzMywxMiArNDgz MywxNiBAQCB2b2lkIHdlYmtpdF93ZWJfdmlld19hZGRfbWFpbl9yZXNvdXJjZShXZWJLaXRXZWJW aWV3KiB3ZWJWaWV3LCBjb25zdCBjaGFyKiBpZGVudAogCiAgICAgcHJpdi0+bWFpblJlc291cmNl ID0gYWRvcHRHUmVmKHdlYlJlc291cmNlKTsKICAgICBwcml2LT5tYWluUmVzb3VyY2VJZGVudGlm aWVyID0gaWRlbnRpZmllcjsKKworICAgIGdfb2JqZWN0X3JlZih3ZWJWaWV3KTsKIH0KIAogdm9p ZCB3ZWJraXRfd2ViX3ZpZXdfYWRkX3Jlc291cmNlKFdlYktpdFdlYlZpZXcqIHdlYlZpZXcsIGNv bnN0IGNoYXIqIGlkZW50aWZpZXIsIFdlYktpdFdlYlJlc291cmNlKiB3ZWJSZXNvdXJjZSkKIHsK ICAgICBXZWJLaXRXZWJWaWV3UHJpdmF0ZSogcHJpdiA9IHdlYlZpZXctPnByaXY7CiAgICAgZ19o YXNoX3RhYmxlX2luc2VydChwcml2LT5zdWJSZXNvdXJjZXMuZ2V0KCksIGdfc3RyZHVwKGlkZW50 aWZpZXIpLCB3ZWJSZXNvdXJjZSk7CisKKyAgICBnX29iamVjdF91bnJlZih3ZWJWaWV3KTsKIH0K IAogdm9pZCB3ZWJraXRfd2ViX3ZpZXdfcmVtb3ZlX3Jlc291cmNlKFdlYktpdFdlYlZpZXcqIHdl YlZpZXcsIGNvbnN0IGNoYXIqIGlkZW50aWZpZXIpCi0tIAoxLjcuNS4yCgo= 96960 2011-06-13 09:12:20 -0700 2011-06-13 09:56:03 -0700 correct version of previous patch 0001-GTK-Update-reference-count-to-WebView-when-adding-or.patch text/plain 2231 tuxator RnJvbSA3ODkzMWRlNGIzZmNlZTVhMDhmNDliZDI1ZDE1ZjM2MGIzOGQyZDI3IE1vbiBTZXAgMTcg MDA6MDA6MDAgMjAwMQpGcm9tOiA9P1VURi04P3E/UGF3ZT1DNT04Mj0yMEZvcnlzaXVrPz0gPHR1 eGF0b3JAbzIucGw+CkRhdGU6IE1vbiwgMTMgSnVuIDIwMTEgMTc6MDc6NTUgKzAyMDAKU3ViamVj dDogW1BBVENIXSBbR1RLXSBVcGRhdGUgcmVmZXJlbmNlIGNvdW50IHRvIFdlYlZpZXcgd2hlbiBh ZGRpbmcgb3IKIHJlbW92aW5nIHJlc291cmNlcwoKLS0tCiBTb3VyY2UvV2ViS2l0L2d0ay9DaGFu Z2VMb2cgICAgICAgICAgICAgICAgfCAgIDE0ICsrKysrKysrKysrKysrCiBTb3VyY2UvV2ViS2l0 L2d0ay93ZWJraXQvd2Via2l0d2Vidmlldy5jcHAgfCAgICA0ICsrKysKIDIgZmlsZXMgY2hhbmdl ZCwgMTggaW5zZXJ0aW9ucygrKSwgMCBkZWxldGlvbnMoLSkKCmRpZmYgLS1naXQgYS9Tb3VyY2Uv V2ViS2l0L2d0ay9DaGFuZ2VMb2cgYi9Tb3VyY2UvV2ViS2l0L2d0ay9DaGFuZ2VMb2cKaW5kZXgg NTc0MzMyZi4uNmRiNWIwMyAxMDA2NDQKLS0tIGEvU291cmNlL1dlYktpdC9ndGsvQ2hhbmdlTG9n CisrKyBiL1NvdXJjZS9XZWJLaXQvZ3RrL0NoYW5nZUxvZwpAQCAtMSwzICsxLDE3IEBACisyMDEx LTA2LTEzICBQYXdlxYIgRm9yeXNpdWsgIDx0dXhhdG9yQG8yLnBsPgorCisgICAgICAgIFJldmll d2VkIGJ5IE5PQk9EWSAoT09QUyEpLgorCisgICAgICAgIFtHVEtdIFVwZGF0ZSByZWZlcmVuY2Ug Y291bnQgdG8gV2ViVmlldyB3aGVuIGFkZGluZyBvciByZW1vdmluZyByZXNvdXJjZXMKKyAgICAg ICAgaHR0cHM6Ly9idWdzLndlYmtpdC5vcmcvc2hvd19idWcuY2dpP2lkPTUwMTczCisKKyAgICAg ICAgU3VnZ2VzdGVkIGJ5IE1hcnRpbiBSb2JpbnNvbi4KKyAgICAgICAgUHJldmVudHMgYSBjcmFz aCB0aWdnZXJlZCBieSB0cnlpbmcgdG8gZ2V0IHJlc291cmNlcyBmcm9tIGFscmVhZHkgZGlzcG9z ZWQgV2ViVmlldy4KKworICAgICAgICAqIHdlYmtpdC93ZWJraXR3ZWJ2aWV3LmNwcDoKKyAgICAg ICAgKHdlYmtpdF93ZWJfdmlld19hZGRfbWFpbl9yZXNvdXJjZSk6IEluY3JlbWVudCByZWYgY291 bnQgd2hlbiByZXNvdXJjZSBpcyBhZGRlZAorICAgICAgICAod2Via2l0X3dlYl92aWV3X3JlbW92 ZV9yZXNvdXJjZSk6IERlY3JlbWVudCByZWYgY291bnQgd2hlbiByZW1vdmluZyByZXNvdXJjZQor CiAyMDExLTA2LTEzICBDYXJsb3MgR2FyY2lhIENhbXBvcyAgPGNnYXJjaWFAaWdhbGlhLmNvbT4K IAogICAgICAgICBSZXZpZXdlZCBieSBNYXJ0aW4gUm9iaW5zb24uCmRpZmYgLS1naXQgYS9Tb3Vy Y2UvV2ViS2l0L2d0ay93ZWJraXQvd2Via2l0d2Vidmlldy5jcHAgYi9Tb3VyY2UvV2ViS2l0L2d0 ay93ZWJraXQvd2Via2l0d2Vidmlldy5jcHAKaW5kZXggY2QyYjcyZC4uNzM2NWI2ZSAxMDA2NDQK LS0tIGEvU291cmNlL1dlYktpdC9ndGsvd2Via2l0L3dlYmtpdHdlYnZpZXcuY3BwCisrKyBiL1Nv dXJjZS9XZWJLaXQvZ3RrL3dlYmtpdC93ZWJraXR3ZWJ2aWV3LmNwcApAQCAtNDgzMyw2ICs0ODMz LDggQEAgdm9pZCB3ZWJraXRfd2ViX3ZpZXdfYWRkX21haW5fcmVzb3VyY2UoV2ViS2l0V2ViVmll dyogd2ViVmlldywgY29uc3QgY2hhciogaWRlbnQKIAogICAgIHByaXYtPm1haW5SZXNvdXJjZSA9 IGFkb3B0R1JlZih3ZWJSZXNvdXJjZSk7CiAgICAgcHJpdi0+bWFpblJlc291cmNlSWRlbnRpZmll ciA9IGlkZW50aWZpZXI7CisKKyAgICBnX29iamVjdF9yZWYod2ViVmlldyk7CiB9CiAKIHZvaWQg d2Via2l0X3dlYl92aWV3X2FkZF9yZXNvdXJjZShXZWJLaXRXZWJWaWV3KiB3ZWJWaWV3LCBjb25z dCBjaGFyKiBpZGVudGlmaWVyLCBXZWJLaXRXZWJSZXNvdXJjZSogd2ViUmVzb3VyY2UpCkBAIC00 ODQ5LDYgKzQ4NTEsOCBAQCB2b2lkIHdlYmtpdF93ZWJfdmlld19yZW1vdmVfcmVzb3VyY2UoV2Vi S2l0V2ViVmlldyogd2ViVmlldywgY29uc3QgY2hhciogaWRlbnRpZgogICAgICAgICBwcml2LT5t YWluUmVzb3VyY2UgPSAwOwogICAgIH0gZWxzZQogICAgICAgZ19oYXNoX3RhYmxlX3JlbW92ZShw cml2LT5zdWJSZXNvdXJjZXMuZ2V0KCksIGlkZW50aWZpZXIpOworCisgICAgZ19vYmplY3RfdW5y ZWYod2ViVmlldyk7CiB9CiAKIFdlYktpdFdlYlJlc291cmNlKiB3ZWJraXRfd2ViX3ZpZXdfZ2V0 X3Jlc291cmNlKFdlYktpdFdlYlZpZXcqIHdlYlZpZXcsIGNoYXIqIGlkZW50aWZpZXIpCi0tIAox LjcuNS4yCgo=