77686 2012-02-02 14:55:09 -0800 [Chromium] WebCore::toV8Context crashes if DomWindow::frame() returns null 2012-02-03 17:45:35 -0800 1 1 1 Unclassified WebKit WebCore Misc. 528+ (Nightly build) Unspecified Unspecified RESOLVED FIXED P2 Normal --- 1 dslomov dslomov abarth dglazkov japhet webkit.review.bot oldest_to_newest 548180 0 dslomov 2012-02-02 14:55:09 -0800 http://crbug.com/112110 548181 1 dslomov 2012-02-02 14:58:36 -0800 The break is introduced in http://trac.webkit.org/changeset/99311 548186 2 125195 dslomov 2012-02-02 15:09:28 -0800 Created attachment 125195 Fix 548187 3 japhet 2012-02-02 15:10:56 -0800 Interesting. In what case is this happening? 548195 4 125195 abarth 2012-02-02 15:27:35 -0800 Comment on attachment 125195 Fix DOMWindow::frame() is null after the Frame has been destroyed. 548196 5 125195 webkit.review.bot 2012-02-02 15:28:09 -0800 Comment on attachment 125195 Fix Attachment 125195 did not pass chromium-ews (chromium-xvfb): Output: http://queues.webkit.org/results/11394945 548211 6 125203 dslomov 2012-02-02 15:44:29 -0800 Created attachment 125203 Typo fixed. 549090 7 125203 abarth 2012-02-03 14:33:46 -0800 Comment on attachment 125203 Typo fixed. Can we write a test using the test plugin? 549092 8 125203 japhet 2012-02-03 14:34:48 -0800 Comment on attachment 125203 Typo fixed. View in context: https://bugs.webkit.org/attachment.cgi?id=125203&action=review > Source/WebCore/bindings/v8/V8Helpers.cpp:45 > + if (!domWindow || !domWindow->frame() || domWindow != domWindow->frame()->domWindow()) Do we have any idea when this happens? In theory, we shouldn't find ourselves in this state. Is there any hope of a test? 549094 9 dslomov 2012-02-03 14:36:30 -0800 (In reply to comment #8) > (From update of attachment 125203 [details]) > View in context: https://bugs.webkit.org/attachment.cgi?id=125203&action=review > > > Source/WebCore/bindings/v8/V8Helpers.cpp:45 > > + if (!domWindow || !domWindow->frame() || domWindow != domWindow->frame()->domWindow()) > > Do we have any idea when this happens? In theory, we shouldn't find ourselves in this state. Why? What guarantees it? > > Is there any hope of a test? 549095 10 dslomov 2012-02-03 14:36:57 -0800 (In reply to comment #7) > (From update of attachment 125203 [details]) > Can we write a test using the test plugin? Maybe - do we have any examples? Thanks 549096 11 abarth 2012-02-03 14:37:02 -0800 The DOMWindow's frame pointer is null after the Frame associated with the DOMWindow has been destroyed (typically by being removed from its document). I'm not sure how this function can get called if the frame no longer exists. 549099 12 abarth 2012-02-03 14:37:55 -0800 Take a look in LayoutTests/plugins for a bunch of tests that use the test plugin. 549111 13 dslomov 2012-02-03 14:44:42 -0800 (In reply to comment #11) > The DOMWindow's frame pointer is null after the Frame associated with the DOMWindow has been destroyed (typically by being removed from its document). I'm not sure how this function can get called if the frame no longer exists. Looks like NPObject is still alive and receives messages: Here is the call stack: 0012f26c 0207b583 chrome_1c30000!WebCore::Frame::domWindow+0x3 0012f278 0207b7f4 chrome_1c30000!WebCore::toV8Context+0x15 0012f2c4 02ccdfc2 chrome_1c30000!_NPN_GetProperty+0x3a 0012f2f0 02ccf1cd chrome_1c30000!NPObjectStub::OnGetProperty+0x6c 0012f3f4 02ccf73b chrome_1c30000!IPC::SyncMessageSchema<Tuple1<NPIdentifier_Param>,Tuple2<NPVariant_Param &,bool &> >::DispatchWithSendParams<NPObjectStub,NPObjectStub,void (__thiscall NPObjectStub::*)(NPIdentifier_Param const &,NPVariant_Param *,bool *)>+0x87 0012f42c 02ccfb87 chrome_1c30000!NPObjectMsg_GetProperty::Dispatch<NPObjectStub,NPObjectStub,void (__thiscall NPObjectStub::*)(NPIdentifier_Param const &,NPVariant_Param *,bool *)>+0x45 0012f5ac 01f2c969 chrome_1c30000!NPObjectStub::OnMessageReceived+0x1f1 0012f5bc 02cc8ddb chrome_1c30000!MessageRouter::RouteMessage+0x30 0012f5d4 01c75c80 chrome_1c30000!NPChannelBase::OnMessageReceived+0xd2 0012f5e0 01c6eae6 chrome_1c30000!base::internal::Invoker<2,base::internal::BindState<base::internal::RunnableAdapter<void (__thiscall media::FFmpegAudioDecoder::*)(base::Callback<void __cdecl(scoped_refptr<media::Buffer>)> const &)>,void __cdecl(media::FFmpegAudioDecoder *,base::Callback<void __cdecl(scoped_refptr<media::Buffer>)> const &),void __cdecl(media::FFmpegAudioDecoder *,base::Callback<void __cdecl(scoped_refptr<media::Buffer>)>)>,void __cdecl(media::FFmpegAudioDecoder *,base::Callback<void __cdecl(scoped_refptr<media::Buffer>)> const &)>::Run+0x16 0012f6b8 01c6e7a1 chrome_1c30000!MessageLoop::RunTask+0x203 0012f708 01c75b70 chrome_1c30000!MessageLoop::DoWork+0x22c 0012f7cc 01c6e47c chrome_1c30000!base::MessagePumpDefault::Run+0x122 549234 14 abarth 2012-02-03 16:44:52 -0800 That looks like a message from the plugin to the page. Maybe this is a shutdown race whereby the plugin is getting torn down but it doesn't know it yet. 549236 15 abarth 2012-02-03 16:46:17 -0800 That seems consistent with this crash being caused by <http://trac.webkit.org/changeset/99311>. That might make it hard to test in DRT, which is single process. 549237 16 125203 abarth 2012-02-03 16:49:33 -0800 Comment on attachment 125203 Typo fixed. Ok. I don't think this is testable in DumpRenderTree. We likely need a separate plug-in process around to test this shutdown race. Jochen is working on getting the layout tests running in content_shell, which will provide a nice framework for testing these kinds of bugs. 549284 17 125203 webkit.review.bot 2012-02-03 17:45:30 -0800 Comment on attachment 125203 Typo fixed. Clearing flags on attachment: 125203 Committed r106722: <http://trac.webkit.org/changeset/106722> 549285 18 webkit.review.bot 2012-02-03 17:45:35 -0800 All reviewed patches have been landed. Closing bug. 125195 2012-02-02 15:09:28 -0800 2012-02-02 15:44:29 -0800 Fix 77686.patch text/plain 1288 dslomov ZGlmZiAtLWdpdCBhL1NvdXJjZS9XZWJDb3JlL0NoYW5nZUxvZyBiL1NvdXJjZS9XZWJDb3JlL0No YW5nZUxvZwppbmRleCBhNzI3ZmE3Li41MjQzMTlkIDEwMDY0NAotLS0gYS9Tb3VyY2UvV2ViQ29y ZS9DaGFuZ2VMb2cKKysrIGIvU291cmNlL1dlYkNvcmUvQ2hhbmdlTG9nCkBAIC0xLDMgKzEsMTMg QEAKKzIwMTItMDItMDIgIERtaXRyeSBMb21vdiAgPGRzbG9tb3ZAZ29vZ2xlLmNvbT4KKworICAg ICAgICBbQ2hyb21pdW1dIFdlYkNvcmU6OnRvVjhDb250ZXh0IGNyYXNoZXMgaWYgRG9tV2luZG93 OjpmcmFtZSgpIHJldHVybnMgbnVsbC4KKyAgICAgICAgaHR0cHM6Ly9idWdzLndlYmtpdC5vcmcv c2hvd19idWcuY2dpP2lkPTc3Njg2LgorCisgICAgICAgIFJldmlld2VkIGJ5IE5PQk9EWSAoT09Q UyEpLgorCisgICAgICAgICogYmluZGluZ3MvdjgvVjhIZWxwZXJzLmNwcDoKKyAgICAgICAgKFdl YkNvcmU6OnRvVjhDb250ZXh0KToKKwogMjAxMi0wMi0wMiAgSm9uIExlZSAgPGpvbmxlZUBhcHBs ZS5jb20+CiAKICAgICAgICAgQ2xlYXIgc2hvd24gbm90aWZpY2F0aW9ucyB3aGVuIGNvbnRleHQg aXMgbm8gbG9uZ2VyIGFjdGl2ZQpkaWZmIC0tZ2l0IGEvU291cmNlL1dlYkNvcmUvYmluZGluZ3Mv djgvVjhIZWxwZXJzLmNwcCBiL1NvdXJjZS9XZWJDb3JlL2JpbmRpbmdzL3Y4L1Y4SGVscGVycy5j cHAKaW5kZXggYzg0Zjc5NC4uMDFmMTJhOSAxMDA2NDQKLS0tIGEvU291cmNlL1dlYkNvcmUvYmlu ZGluZ3MvdjgvVjhIZWxwZXJzLmNwcAorKysgYi9Tb3VyY2UvV2ViQ29yZS9iaW5kaW5ncy92OC9W OEhlbHBlcnMuY3BwCkBAIC00Miw3ICs0Miw3IEBAIHY4OjpMb2NhbDx2ODo6Q29udGV4dD4gdG9W OENvbnRleHQoTlBQIG5wcCwgTlBPYmplY3QqIG5wT2JqZWN0KQogewogICAgIFY4TlBPYmplY3Qq IG9iamVjdCA9IHJlaW50ZXJwcmV0X2Nhc3Q8VjhOUE9iamVjdCo+KG5wT2JqZWN0KTsKICAgICBE T01XaW5kb3cqIGRvbVdpbmRvdyA9IG9iamVjdC0+cm9vdE9iamVjdDsKLSAgICBpZiAoIWRvbVdp bmRvdyB8fCBkb21XaW5kb3cgIT0gZG9tV2luZG93LT5mcmFtZSgpLT5kb21XaW5kb3coKSkKKyAg ICBpZiAoIWRvbVdpbmRvdyB8fCB8fCAhZG9tV2luZG93LT5mcmFtZSgpIHx8IGRvbVdpbmRvdyAh PSBkb21XaW5kb3ctPmZyYW1lKCktPmRvbVdpbmRvdygpKQogICAgICAgICByZXR1cm4gdjg6Okxv Y2FsPHY4OjpDb250ZXh0PigpOwogICAgIHJldHVybiBWOFByb3h5OjptYWluV29ybGRDb250ZXh0 KG9iamVjdC0+cm9vdE9iamVjdC0+ZnJhbWUoKSk7CiB9Cg== 125203 2012-02-02 15:44:29 -0800 2012-02-03 17:45:30 -0800 Typo fixed. 77686.patch text/plain 1285 dslomov ZGlmZiAtLWdpdCBhL1NvdXJjZS9XZWJDb3JlL0NoYW5nZUxvZyBiL1NvdXJjZS9XZWJDb3JlL0No YW5nZUxvZwppbmRleCBhNzI3ZmE3Li41MjQzMTlkIDEwMDY0NAotLS0gYS9Tb3VyY2UvV2ViQ29y ZS9DaGFuZ2VMb2cKKysrIGIvU291cmNlL1dlYkNvcmUvQ2hhbmdlTG9nCkBAIC0xLDMgKzEsMTMg QEAKKzIwMTItMDItMDIgIERtaXRyeSBMb21vdiAgPGRzbG9tb3ZAZ29vZ2xlLmNvbT4KKworICAg ICAgICBbQ2hyb21pdW1dIFdlYkNvcmU6OnRvVjhDb250ZXh0IGNyYXNoZXMgaWYgRG9tV2luZG93 OjpmcmFtZSgpIHJldHVybnMgbnVsbC4KKyAgICAgICAgaHR0cHM6Ly9idWdzLndlYmtpdC5vcmcv c2hvd19idWcuY2dpP2lkPTc3Njg2LgorCisgICAgICAgIFJldmlld2VkIGJ5IE5PQk9EWSAoT09Q UyEpLgorCisgICAgICAgICogYmluZGluZ3MvdjgvVjhIZWxwZXJzLmNwcDoKKyAgICAgICAgKFdl YkNvcmU6OnRvVjhDb250ZXh0KToKKwogMjAxMi0wMi0wMiAgSm9uIExlZSAgPGpvbmxlZUBhcHBs ZS5jb20+CiAKICAgICAgICAgQ2xlYXIgc2hvd24gbm90aWZpY2F0aW9ucyB3aGVuIGNvbnRleHQg aXMgbm8gbG9uZ2VyIGFjdGl2ZQpkaWZmIC0tZ2l0IGEvU291cmNlL1dlYkNvcmUvYmluZGluZ3Mv djgvVjhIZWxwZXJzLmNwcCBiL1NvdXJjZS9XZWJDb3JlL2JpbmRpbmdzL3Y4L1Y4SGVscGVycy5j cHAKaW5kZXggYzg0Zjc5NC4uNzU1YjBiNCAxMDA2NDQKLS0tIGEvU291cmNlL1dlYkNvcmUvYmlu ZGluZ3MvdjgvVjhIZWxwZXJzLmNwcAorKysgYi9Tb3VyY2UvV2ViQ29yZS9iaW5kaW5ncy92OC9W OEhlbHBlcnMuY3BwCkBAIC00Miw3ICs0Miw3IEBAIHY4OjpMb2NhbDx2ODo6Q29udGV4dD4gdG9W OENvbnRleHQoTlBQIG5wcCwgTlBPYmplY3QqIG5wT2JqZWN0KQogewogICAgIFY4TlBPYmplY3Qq IG9iamVjdCA9IHJlaW50ZXJwcmV0X2Nhc3Q8VjhOUE9iamVjdCo+KG5wT2JqZWN0KTsKICAgICBE T01XaW5kb3cqIGRvbVdpbmRvdyA9IG9iamVjdC0+cm9vdE9iamVjdDsKLSAgICBpZiAoIWRvbVdp bmRvdyB8fCBkb21XaW5kb3cgIT0gZG9tV2luZG93LT5mcmFtZSgpLT5kb21XaW5kb3coKSkKKyAg ICBpZiAoIWRvbVdpbmRvdyB8fCAhZG9tV2luZG93LT5mcmFtZSgpIHx8IGRvbVdpbmRvdyAhPSBk b21XaW5kb3ctPmZyYW1lKCktPmRvbVdpbmRvdygpKQogICAgICAgICByZXR1cm4gdjg6OkxvY2Fs PHY4OjpDb250ZXh0PigpOwogICAgIHJldHVybiBWOFByb3h5OjptYWluV29ybGRDb250ZXh0KG9i amVjdC0+cm9vdE9iamVjdC0+ZnJhbWUoKSk7CiB9Cg==