69512 2011-10-06 03:43:39 -0700 [WK2] plugins/destroy-during-npp-new.html segfaults WebKitWebProcess 2015-05-07 18:10:51 -0700 1 1 1 Unclassified WebKit WebKitGTK 528+ (Nightly build) Unspecified Linux RESOLVED FIXED P2 Normal --- 69523 1 alex svillar andersca bdakin mitz mrobinson sam svillar oldest_to_newest 479045 0 alex 2011-10-06 03:43:39 -0700 This is the backtrace: Program received signal SIGSEGV, Segmentation fault. 0x00007f888920a027 in WebCore::RenderPart::setWidget (this=0x1ed17f8, widget=...) at ../../../Source/WebCore/rendering/RenderPart.cpp:59 59 viewCleared(); (gdb) bt #0 0x00007f888920a027 in WebCore::RenderPart::setWidget (this=0x1ed17f8, widget=...) at ../../../Source/WebCore/rendering/RenderPart.cpp:59 #1 0x00007f8888f25db5 in WebCore::SubframeLoader::loadPlugin (this=0x1eb2b08, pluginElement=0x1f988f0, url=..., mimeType="application/x-webkit-test-netscape", paramNames=WTF::Vector of length 5, capacity 16 = {...}, paramValues=WTF::Vector of length 5, capacity 16 = {...}, useFallback=false) at ../../../Source/WebCore/loader/SubframeLoader.cpp:370 #2 0x00007f8888f24c12 in WebCore::SubframeLoader::requestPlugin (this=0x1eb2b08, ownerElement=0x1f988f0, url=..., mimeType="application/x-webkit-test-netscape", paramNames=WTF::Vector of length 5, capacity 16 = {...}, paramValues=WTF::Vector of length 5, capacity 16 = {...}, useFallback=false) at ../../../Source/WebCore/loader/SubframeLoader.cpp:122 #3 0x00007f8888f24de6 in WebCore::SubframeLoader::requestObject (this=0x1eb2b08, ownerElement=0x1f988f0, url="(null)", frameName="(null)", mimeType="application/x-webkit-test-netscape", paramNames=WTF::Vector of length 5, capacity 16 = {...}, paramValues=WTF::Vector of length 5, capacity 16 = {...}) at ../../../Source/WebCore/loader/SubframeLoader.cpp:142 #4 0x00007f8888d3a94a in WebCore::HTMLEmbedElement::updateWidget (this=0x1f988f0, pluginCreationOption=WebCore::CreateOnlyNonNetscapePlugins) at ../../../Source/WebCore/html/HTMLEmbedElement.cpp:184 #5 0x00007f8888d7297b in WebCore::HTMLPlugInImageElement::updateWidgetIfNecessary (this=0x1f988f0) at ../../../Source/WebCore/html/HTMLPlugInImageElement.cpp:170 #6 0x00007f8888d72a5d in WebCore::HTMLPlugInImageElement::updateWidgetCallback (n=0x1f988f0) at ../../../Source/WebCore/html/HTMLPlugInImageElement.cpp:193 #7 0x00007f8888b69fcb in WebCore::ContainerNode::dispatchPostAttachCallbacks () at ../../../Source/WebCore/dom/ContainerNode.cpp:746 #8 0x00007f8888b69e26 in WebCore::ContainerNode::resumePostAttachCallbacks (this=0x1f12bb0) at ../../../Source/WebCore/dom/ContainerNode.cpp:713 #9 0x00007f8888b7fdb6 in WebCore::Document::recalcStyle (this=0x1f12bb0, change=WebCore::Node::NoChange) at ../../../Source/WebCore/dom/Document.cpp:1605 #10 0x00007f8888b7ff5a in WebCore::Document::updateStyleIfNeeded (this=0x1f12bb0) at ../../../Source/WebCore/dom/Document.cpp:1627 #11 0x00007f8888f9d636 in WebCore::FrameView::updateLayoutAndStyleIfNeededRecursive (this=0x1f12260) at ../../../Source/WebCore/page/FrameView.cpp:2809 #12 0x00007f88888f0604 in WebKit::WebPage::layoutIfNeeded (this=0x1ea4fd0) at ../../../Source/WebKit2/WebProcess/WebPage/WebPage.cpp:659 #13 0x00007f88888dddea in WebKit::DrawingAreaImpl::display (this=0x1eb5140, updateInfo=...) at ../../../Source/WebKit2/WebProcess/WebPage/DrawingAreaImpl.cpp:619 #14 0x00007f88888dda5d in WebKit::DrawingAreaImpl::display (this=0x1eb5140) at ../../../Source/WebKit2/WebProcess/WebPage/DrawingAreaImpl.cpp:566 #15 0x00007f88888dd8f4 in WebKit::DrawingAreaImpl::displayTimerFired (this=0x1eb5140) at ../../../Source/WebKit2/WebProcess/WebPage/DrawingAreaImpl.cpp:545 #16 0x00007f88888df0b2 in Timer<WebKit::DrawingAreaImpl>::fired (this=0x1eb51d0) at ../../../Source/WebKit2/Platform/RunLoop.h:127 #17 0x00007f8888757339 in RunLoop::TimerBase::timerFiredCallback (timer=0x1eb51d0) at ../../../Source/WebKit2/Platform/gtk/RunLoopGtk.cpp:106 #18 0x00007f8883d4ac09 in g_timeout_dispatch (source=0x1ee59d0, callback=0x7f88887572ee <RunLoop::TimerBase::timerFiredCallback(RunLoop::TimerBase*)>, user_data=0x1eb51d0) at gmain.c:3904 #19 0x00007f8883d4760c in g_main_dispatch (context=0x1e600f0) at gmain.c:2439 #20 0x00007f8883d48b52 in g_main_context_dispatch (context=0x1e600f0) at gmain.c:3008 #21 0x00007f8883d49008 in g_main_context_iterate (context=0x1e600f0, block=1, dispatch=1, self=0x1e238b0) at gmain.c:3086 #22 0x00007f8883d49766 in g_main_loop_run (loop=0x1e603a0) at gmain.c:3294 #23 0x00007f888875710d in RunLoop::run () at ../../../Source/WebKit2/Platform/gtk/RunLoopGtk.cpp:56 #24 0x00007f888885e5b1 in WebKit::WebProcessMainGtk (argc=2, argv=0x7fffe1226e58) at ../../../Source/WebKit2/WebProcess/gtk/WebProcessMainGtk.cpp:64 #25 0x0000000000400984 in main (argc=2, argv=0x7fffe1226e58) at ../../../Source/WebKit2/gtk/MainGtk.cpp:31 489327 1 svillar 2011-10-24 07:45:59 -0700 Working on this... 490073 2 112347 svillar 2011-10-25 09:47:29 -0700 Created attachment 112347 Patch 490080 3 mrobinson 2011-10-25 09:55:57 -0700 Removing the GTK tag since this bug is platform-independent. 490082 4 svillar 2011-10-25 10:01:08 -0700 So this is the story of the bug as far as I understood it. This test loads a plugin that auto-removes itself from the document during plugin initialization. Thing is that the RenderWidget was autodestroying itself during that process because the plugin was triggering a ::destroy call over the RenderWidget when it was still running its setWidget() code needed to load the plugin. What I did in the patch above was to use RenderWidget's ref counting system to prevent the render from being destroyed while executing its own code. (maybe the other option is to use WebCore::RenderWidget::suspendWidgetHierarchyUpdates but not sure if we want to do that in this specific case) I don't have a clear explanation about why this was failing only in WebKit2 but maybe it's because they're just following different execution paths. I was tempted also to remove this test from the Skipped file for other ports but I'm still not sure how to proceed in this case. Should I first ask somebody else to try it before landing? (assuming the patch is correct of course). PS: adding to the Cc some people that looks familiar to this code 506987 5 112347 andersca 2011-11-21 08:22:09 -0800 Comment on attachment 112347 Patch I don't think this is the right fix - if this only happens in WebKit2 then we should try to fix it there. 961611 6 ap 2013-12-19 16:17:09 -0800 Is this still the case on any platforms? I just ran the test on Mac locally, and it passed. 1092934 7 mrobinson 2015-05-07 18:10:51 -0700 Seems to be marked as flaky on Mac, works on GTK+, and skipped on Windows since 2009. I'm just going to close this bug. 112347 2011-10-25 09:47:29 -0700 2011-11-21 08:22:08 -0800 Patch bug-69512-20111025184727.patch text/plain 4053 svillar U3VidmVyc2lvbiBSZXZpc2lvbjogOTc3MzkKZGlmZiAtLWdpdCBhL1NvdXJjZS9XZWJDb3JlL0No YW5nZUxvZyBiL1NvdXJjZS9XZWJDb3JlL0NoYW5nZUxvZwppbmRleCA2N2IwOWUzZDIwNzIwM2Ix ZmQwNmY1NzRmNTRmMjViNTI0NTNjOWI4Li43NTBmZWM2OGQ1NmM2ZGQzNTU0MWQzNjA2MzA1NjM5 NWNiZjNhMzMzIDEwMDY0NAotLS0gYS9Tb3VyY2UvV2ViQ29yZS9DaGFuZ2VMb2cKKysrIGIvU291 cmNlL1dlYkNvcmUvQ2hhbmdlTG9nCkBAIC0xLDMgKzEsMTkgQEAKKzIwMTEtMTAtMjUgIFNlcmdp byBWaWxsYXIgU2VuaW4gIDxzdmlsbGFyQGlnYWxpYS5jb20+CisKKyAgICAgICAgW1dLMl0gW0dU S10gcGx1Z2lucy9kZXN0cm95LWR1cmluZy1ucHAtbmV3Lmh0bWwgc2VnZmF1bHRzIFdlYktpdFdl YlByb2Nlc3MKKyAgICAgICAgaHR0cHM6Ly9idWdzLndlYmtpdC5vcmcvc2hvd19idWcuY2dpP2lk PTY5NTEyCisKKyAgICAgICAgUmV2aWV3ZWQgYnkgTk9CT0RZIChPT1BTISkuCisKKyAgICAgICAg VXNlIFJlbmRlcldpZGdldCdzIHJlZiBjb3VudGluZyB0byBwcmV2ZW50IHNlbGYgZGVzdHJ1Y3Rp b24gd2hlbgorICAgICAgICByZXBhcmVudGluZyB3aWRnZXRzLCBhbmQgdGh1cywgZml4aW5nIGEg Y3Jhc2guIFRoaXMgd2FzIGhhcHBlbmluZworICAgICAgICBmb3IgZXhhbXBsZSB3aGVuIGEgcGx1 Z2luIHJlbW92ZXMgaXRzZWxmIGZyb20gdGhlIGRvY3VtZW50IGR1cmluZworICAgICAgICBpbml0 YWxpemF0aW9uLgorCisgICAgICAgICogcmVuZGVyaW5nL1JlbmRlcldpZGdldC5jcHA6CisgICAg ICAgIChXZWJDb3JlOjpSZW5kZXJXaWRnZXQ6Om1vdmVXaWRnZXRUb1BhcmVudFNvb24pOiBhZGRl ZCByZWZjb3VudGluZworICAgICAgICAqIHJlbmRlcmluZy9SZW5kZXJXaWRnZXQuaDogbW92ZVdp ZGdldFRvUGFyZW50U29vbiBiZWNhbWUgcHJpdmF0ZQorCiAyMDExLTEwLTE4ICBNaWhuZWEgT3Zp ZGVuaWUgIDxtaWhuZWFAYWRvYmUuY29tPgogCiAgICAgICAgIFtDU1MgUmVnaW9uc11QYXJzZSBA LXdlYmtpdC1yZWdpb24gcnVsZQpkaWZmIC0tZ2l0IGEvU291cmNlL1dlYkNvcmUvcmVuZGVyaW5n L1JlbmRlcldpZGdldC5jcHAgYi9Tb3VyY2UvV2ViQ29yZS9yZW5kZXJpbmcvUmVuZGVyV2lkZ2V0 LmNwcAppbmRleCBmZGUzZjhkZDdiNWI3ZjQ5OTA5Yzg5MjhkMjE2NGI0ZWNjMDdlNDNkLi5iNmI5 MmQyNWVkMjMzMzdiN2JkMzc4OGQwNzc4YzdiNDE2NTZkMTYwIDEwMDY0NAotLS0gYS9Tb3VyY2Uv V2ViQ29yZS9yZW5kZXJpbmcvUmVuZGVyV2lkZ2V0LmNwcAorKysgYi9Tb3VyY2UvV2ViQ29yZS9y ZW5kZXJpbmcvUmVuZGVyV2lkZ2V0LmNwcApAQCAtODQsMTMgKzg0LDE4IEBAIHZvaWQgUmVuZGVy V2lkZ2V0OjpyZXN1bWVXaWRnZXRIaWVyYXJjaHlVcGRhdGVzKCkKICAgICB3aWRnZXRIaWVyYXJj aHlVcGRhdGVTdXNwZW5kQ291bnQtLTsKIH0KIAotc3RhdGljIHZvaWQgbW92ZVdpZGdldFRvUGFy ZW50U29vbihXaWRnZXQqIGNoaWxkLCBGcmFtZVZpZXcqIHBhcmVudCkKK3ZvaWQgUmVuZGVyV2lk Z2V0Ojptb3ZlV2lkZ2V0VG9QYXJlbnRTb29uKFdpZGdldCogY2hpbGQsIEZyYW1lVmlldyogcGFy ZW50KQogewogICAgIGlmICghd2lkZ2V0SGllcmFyY2h5VXBkYXRlU3VzcGVuZENvdW50KSB7Cisg ICAgICAgIC8vIFdlIG5lZWQgdG8gYWRkIGEgcmVmZXJlbmNlIGhlcmUgdG8gcHJldmVudCB0aGUg d2lkZ2V0IGZyb20KKyAgICAgICAgLy8gYmVpbmcgc2VsZiBkZXN0cm95ZWQgd2hpbGUgbW9kaWZ5 aW5nIHRoZSB0cmVlIGFzIGl0IGhhcHBlbnMKKyAgICAgICAgLy8gaW4gaHR0cHM6Ly9idWdzLndl YmtpdC5vcmcvc2hvd19idWcuY2dpP2lkPTY5NTEyLgorICAgICAgICArK21fcmVmQ291bnQ7CiAg ICAgICAgIGlmIChwYXJlbnQpCiAgICAgICAgICAgICBwYXJlbnQtPmFkZENoaWxkKGNoaWxkKTsK ICAgICAgICAgZWxzZQogICAgICAgICAgICAgY2hpbGQtPnJlbW92ZUZyb21QYXJlbnQoKTsKKyAg ICAgICAgLS1tX3JlZkNvdW50OwogICAgICAgICByZXR1cm47CiAgICAgfQogICAgIHdpZGdldE5l d1BhcmVudE1hcCgpLnNldChjaGlsZCwgcGFyZW50KTsKZGlmZiAtLWdpdCBhL1NvdXJjZS9XZWJD b3JlL3JlbmRlcmluZy9SZW5kZXJXaWRnZXQuaCBiL1NvdXJjZS9XZWJDb3JlL3JlbmRlcmluZy9S ZW5kZXJXaWRnZXQuaAppbmRleCA3MDUxMDM5MjE2ZDkxZDQ0YTA3MWY4Njg0ZTBlY2VkZmZiOWE2 MTljLi44ZmQwNTg4NGE5MmRjMWU2MWExYmNiNWRmMGM5YjBiOTNmZWQ2Zjg3IDEwMDY0NAotLS0g YS9Tb3VyY2UvV2ViQ29yZS9yZW5kZXJpbmcvUmVuZGVyV2lkZ2V0LmgKKysrIGIvU291cmNlL1dl YkNvcmUvcmVuZGVyaW5nL1JlbmRlcldpZGdldC5oCkBAIC03MSw2ICs3MSw3IEBAIHByaXZhdGU6 CiAgICAgdmlydHVhbCB2b2lkIHNldE92ZXJsYXBUZXN0UmVzdWx0KGJvb2wpOwogCiAgICAgYm9v bCBzZXRXaWRnZXRHZW9tZXRyeShjb25zdCBJbnRSZWN0Jik7CisgICAgdm9pZCBtb3ZlV2lkZ2V0 VG9QYXJlbnRTb29uKFdpZGdldCogY2hpbGQsIEZyYW1lVmlldyogcGFyZW50KTsKIAogICAgIFJl ZlB0cjxXaWRnZXQ+IG1fd2lkZ2V0OwogICAgIEZyYW1lVmlldyogbV9mcmFtZVZpZXc7CmRpZmYg LS1naXQgYS9MYXlvdXRUZXN0cy9DaGFuZ2VMb2cgYi9MYXlvdXRUZXN0cy9DaGFuZ2VMb2cKaW5k ZXggNDk5ZjUzY2M5ZjAzMjkxOWYwOGI0MGY2MTE3MmExNjJmNDcxNzQ0Yy4uMmIyNTcxYzQ3MGEx MmE1NzI0YzM1MWJkMWY2ZDA2ZDg2YTcxM2VmOSAxMDA2NDQKLS0tIGEvTGF5b3V0VGVzdHMvQ2hh bmdlTG9nCisrKyBiL0xheW91dFRlc3RzL0NoYW5nZUxvZwpAQCAtMSwzICsxLDE0IEBACisyMDEx LTEwLTI1ICBTZXJnaW8gVmlsbGFyIFNlbmluICA8c3ZpbGxhckBpZ2FsaWEuY29tPgorCisgICAg ICAgIFtXSzJdIFtHVEtdIHBsdWdpbnMvZGVzdHJveS1kdXJpbmctbnBwLW5ldy5odG1sIHNlZ2Zh dWx0cyBXZWJLaXRXZWJQcm9jZXNzCisgICAgICAgIGh0dHBzOi8vYnVncy53ZWJraXQub3JnL3No b3dfYnVnLmNnaT9pZD02OTUxMgorCisgICAgICAgIFJldmlld2VkIGJ5IE5PQk9EWSAoT09QUyEp LgorCisgICAgICAgIFVuc2tpcHBlZCBhIHRlc3QgY2FzZSB0aGF0IGlzIHdvcmtpbmcgbm93Lgor CisgICAgICAgICogcGxhdGZvcm0vZ3RrLXdrMi9Ta2lwcGVkOiByZW1vdmVkIHBsdWdpbnMvZGVz dHJveS1kdXJpbmctbnBwLW5ldy5odG1sCisKIDIwMTEtMTAtMTggIE1paG5lYSBPdmlkZW5pZSAg PG1paG5lYUBhZG9iZS5jb20+CiAKICAgICAgICAgW0NTUyBSZWdpb25zXVBhcnNlIEAtd2Via2l0 LXJlZ2lvbiBydWxlCmRpZmYgLS1naXQgYS9MYXlvdXRUZXN0cy9wbGF0Zm9ybS9ndGstd2syL1Nr aXBwZWQgYi9MYXlvdXRUZXN0cy9wbGF0Zm9ybS9ndGstd2syL1NraXBwZWQKaW5kZXggMWQ3ZGQz ZmQ0ODM3MGQ4OTM3ZTljZTBmNDJmYTk3ZGMyZGI2OGMyMS4uYTFlMTQ2ZDQ2YzA4YmRjMmE4NTFh Njk4NTcxYTVjOGM5MWQwMDMyMSAxMDA2NDQKLS0tIGEvTGF5b3V0VGVzdHMvcGxhdGZvcm0vZ3Rr LXdrMi9Ta2lwcGVkCisrKyBiL0xheW91dFRlc3RzL3BsYXRmb3JtL2d0ay13azIvU2tpcHBlZApA QCAtNDcsMTAgKzQ3LDYgQEAKICMgaHR0cHM6Ly9idWdzLndlYmtpdC5vcmcvc2hvd19idWcuY2dp P2lkPTY5NTEwCiBmYXN0L2Nzcy93ZWJraXQtbWFzay1jcmFzaC1maWVsZHNldC1sZWdlbmQuaHRt bAogCi0jIFtXSzJdIFtHVEtdIHBsdWdpbnMvZGVzdHJveS1kdXJpbmctbnBwLW5ldy5odG1sIHNl Z2ZhdWx0cyBXZWJLaXRXZWJQcm9jZXNzCi0jIGh0dHBzOi8vYnVncy53ZWJraXQub3JnL3Nob3df YnVnLmNnaT9pZD02OTUxMgotcGx1Z2lucy9kZXN0cm95LWR1cmluZy1ucHAtbmV3Lmh0bWwKLQog IyBbV0syXSBbR1RLXSBXZWJLaXRXZWJQcm9jZXNzIGFzc2VydHMgaW4gQVNTRVJUKG1fc3RhdGUg IT0gQ0xPU0VEKQogIyBodHRwczovL2J1Z3Mud2Via2l0Lm9yZy9zaG93X2J1Zy5jZ2k/aWQ9Njk1 MTMKIGh0dHAvdGVzdHMvZXZlbnRzb3VyY2UvZXZlbnRzb3VyY2UtcGFyc2UtZXZlbnQtc3RyZWFt Lmh0bWwK