87744 2012-05-29 07:05:14 -0700 [GTK] [WK2] Reproducible crash in performDragControllerAction 2012-05-29 09:49:13 -0700 1 1 1 Unclassified WebKit WebKitGTK 528+ (Nightly build) Unspecified Unspecified RESOLVED FIXED P2 Normal --- 1 naginenis naginenis gustavo mrobinson pnormand webkit.review.bot oldest_to_newest 635987 0 naginenis 2012-05-29 07:05:14 -0700 Steps to reproduce: 1. Open ./MiniBrowser http://www.google.com 2. Drag and drop the image on the page. #0 0x00007f5ebea95d71 in WTF::RefCountedBase::~RefCountedBase (this=0x2eaafb0, __in_chrg=<optimized out>) at ../../Source/WTF/wtf/RefCounted.h:122 122 ASSERT(m_deletionHasBegun); (gdb) bt #0 0x00007f5ebea95d71 in WTF::RefCountedBase::~RefCountedBase (this=0x2eaafb0, __in_chrg=<optimized out>) at ../../Source/WTF/wtf/RefCounted.h:122 #1 0x00007f5ebeac7834 in WTF::RefCounted<WebCore::DataObjectGtk>::~RefCounted (this=0x2eaafb0, __in_chrg=<optimized out>) at ../../Source/WTF/wtf/RefCounted.h:197 #2 0x00007f5ebeac8464 in WebCore::DataObjectGtk::~DataObjectGtk (this=0x2eaafb0, __in_chrg=<optimized out>) at ../../Source/WebCore/platform/gtk/DataObjectGtk.h:32 #3 0x00007f5ebecb0c8a in WebKit::WebPage::performDragControllerAction (this=0x23e9da0, action=0, dragData=...) at ../../Source/WebKit2/WebProcess/WebPage/WebPage.cpp:2183 #4 0x00007f5ebeceedaf in CoreIPC::callMemberFunction<WebKit::WebPage, void (WebKit::WebPage::*)(unsigned long, WebCore::DragData), unsigned long, WebCore::DragData> (args=..., object=0x23e9da0, function= (void (WebKit::WebPage::*)(WebKit::WebPage * const, unsigned long, WebCore::DragData)) 0x7f5ebecb0a26 <WebKit::WebPage::performDragControllerAction(unsigned long, WebCore::DragData)>) at ../../Source/WebKit2/Platform/CoreIPC/HandleMessage.h:25 #5 0x00007f5ebeced447 in CoreIPC::handleMessage<Messages::WebPage::PerformDragControllerAction, WebKit::WebPage, void (WebKit::WebPage::*)(unsigned long, WebCore::DragData)> (argumentDecoder= 0x7f5ea4001e90, object=0x23e9da0, function= (void (WebKit::WebPage::*)(WebKit::WebPage * const, unsigned long, WebCore::DragData)) 0x7f5ebecb0a26 <WebKit::WebPage::performDragControllerAction(unsigned long, WebCore::DragData)>) at ../../Source/WebKit2/Platform/CoreIPC/HandleMessage.h:302 #6 0x00007f5ebeceb210 in WebKit::WebPage::didReceiveWebPageMessage (this=0x23e9da0, messageID=..., arguments=0x7f5ea4001e90) at DerivedSources/WebKit2/WebPageMessageReceiver.cpp:324 #7 0x00007f5ebecb1b88 in WebKit::WebPage::didReceiveMessage (this=0x23e9da0, connection=0x20fc550, messageID=..., arguments=0x7f5ea4001e90) at ../../Source/WebKit2/WebProcess/WebPage/WebPage.cpp:2581 #8 0x00007f5ebecc1a92 in WebKit::WebProcess::didReceiveMessage (this=0x20fc030, connection=0x20fc550, messageID=..., arguments=0x7f5ea4001e90) at ../../Source/WebKit2/WebProcess/WebProcess.cpp:683 #9 0x00007f5ebecbfb56 in WebKit::WebConnectionToUIProcess::didReceiveMessage (this=0x20fc500, connection=0x20fc550, messageID=..., arguments=0x7f5ea4001e90) at ../../Source/WebKit2/WebProcess/WebConnectionToUIProcess.cpp:87 #10 0x00007f5ebea9bdcb in CoreIPC::Connection::dispatchMessage (this=0x20fc550, message=...) at ../../Source/WebKit2/Platform/CoreIPC/Connection.cpp:691 #11 0x00007f5ebea9bf69 in CoreIPC::Connection::dispatchOneMessage (this=0x20fc550) at ../../Source/WebKit2/Platform/CoreIPC/Connection.cpp:717 #12 0x00007f5ebeaa6106 in WTF::FunctionWrapper<void (CoreIPC::Connection::*)()>::operator() (this=0x7f5ea40011d0, c=0x20fc550) at ../../Source/WTF/wtf/Functional.h:173 #13 0x00007f5ebeaa5f0c in WTF::BoundFunctionImpl<WTF::FunctionWrapper<void (CoreIPC::Connection::*)()>, void (CoreIPC::Connection*)>::operator()() (this=0x7f5ea40011c0) at ../../Source/WTF/wtf/Functional.h:405 #14 0x00007f5ebeaaaf4e in WTF::Function<void ()>::operator()() const (this=0x7f5ea4001ef0) at ../../Source/WTF/wtf/Functional.h:613 #15 0x00007f5ebf591ec5 in WebCore::RunLoop::performWork (this=0x20fbef0) at ../../Source/WebCore/platform/RunLoop.cpp:67 #16 0x00007f5ebff943b6 in WebCore::RunLoop::queueWork (runLoop=0x20fbef0) at ../../Source/WebCore/platform/gtk/RunLoopGtk.cpp:102 #17 0x00007f5eb818ac9a in g_main_dispatch (context=0x1fed470) at /build/buildd/glib2.0-2.32.1/./glib/gmain.c:2515 #18 g_main_context_dispatch (context=0x1fed470) at /build/buildd/glib2.0-2.32.1/./glib/gmain.c:3052 #19 0x00007f5eb818b060 in g_main_context_iterate (dispatch=1, block=<optimized out>, context=0x1fed470, self=<optimized out>) at /build/buildd/glib2.0-2.32.1/./glib/gmain.c:3123 #20 g_main_context_iterate (context=0x1fed470, block=<optimized out>, dispatch=1, self=<optimized out>) at /build/buildd/glib2.0-2.32.1/./glib/gmain.c:3060 #21 0x00007f5eb818b45a in g_main_loop_run (loop=0x20fbf80) at /build/buildd/glib2.0-2.32.1/./glib/gmain.c:3317 #22 0x00007f5ebff94120 in WebCore::RunLoop::run () at ../../Source/WebCore/platform/gtk/RunLoopGtk.cpp:59 #23 0x00007f5ebec0487e in WebKit::WebProcessMainGtk (argc=2, argv=0x7fff5b919088) at ../../Source/WebKit2/WebProcess/gtk/WebProcessMainGtk.cpp:73 #24 0x0000000000400784 in main (argc=2, argv=0x7fff5b919088) at ../../Source/WebKit2/gtk/MainGtk.cpp:31 (gdb) 636026 1 naginenis 2012-05-29 08:02:04 -0700 I think we should use deref() instead of delete to destroy the platformData since the DataObjectGtk is inherited from RefCounted. http://trac.webkit.org/browser/trunk/Source/WebKit2/WebProcess/WebPage/WebPage.cpp#L2183 636084 2 144569 naginenis 2012-05-29 09:02:13 -0700 Created attachment 144569 patch Use deref() instead of delete to release refcounted DataObjectGtk. 636139 3 144569 webkit.review.bot 2012-05-29 09:49:09 -0700 Comment on attachment 144569 patch Clearing flags on attachment: 144569 Committed r118796: <http://trac.webkit.org/changeset/118796> 636140 4 webkit.review.bot 2012-05-29 09:49:13 -0700 All reviewed patches have been landed. Closing bug. 144569 2012-05-29 09:02:13 -0700 2012-05-29 09:49:09 -0700 patch 87744.patch text/plain 1948 naginenis ZGlmZiAtLWdpdCBhL1NvdXJjZS9XZWJLaXQyL0NoYW5nZUxvZyBiL1NvdXJjZS9XZWJLaXQyL0No YW5nZUxvZwppbmRleCA5YzhlZmE4Li5kZTA5OTNkIDEwMDY0NAotLS0gYS9Tb3VyY2UvV2ViS2l0 Mi9DaGFuZ2VMb2cKKysrIGIvU291cmNlL1dlYktpdDIvQ2hhbmdlTG9nCkBAIC0xLDMgKzEsMTYg QEAKKzIwMTItMDUtMjkgIFN1ZGFyc2FuYSBOYWdpbmVuaSAgPHN1ZGFyc2FuYS5uYWdpbmVuaUBs aW51eC5pbnRlbC5jb20+CisKKyAgICAgICAgW0dUS10gW1dLMl0gUmVwcm9kdWNpYmxlIGNyYXNo IGluIHBlcmZvcm1EcmFnQ29udHJvbGxlckFjdGlvbgorICAgICAgICBodHRwczovL2J1Z3Mud2Vi a2l0Lm9yZy9zaG93X2J1Zy5jZ2k/aWQ9ODc3NDQKKworICAgICAgICBSZXZpZXdlZCBieSBOT0JP RFkgKE9PUFMhKS4KKworICAgICAgICBGaXggYSBjcmFzaCBieSB1c2luZyBkZXJlZigpIGluc3Rl YWQgb2YgZGVsZXRlIHRvIGRlcmVmZXJlbmNlIGFuZAorICAgICAgICByZWxlYXNlIHRoZSBwbGF0 Zm9ybURhdGEgb2YgRHJhZ0RhdGEuCisKKyAgICAgICAgKiBXZWJQcm9jZXNzL1dlYlBhZ2UvV2Vi UGFnZS5jcHA6CisgICAgICAgIChXZWJLaXQ6OldlYlBhZ2U6OnBlcmZvcm1EcmFnQ29udHJvbGxl ckFjdGlvbik6CisKIDIwMTItMDUtMjYgIEdlb2ZmcmV5IEdhcmVuICA8Z2dhcmVuQGFwcGxlLmNv bT4KIAogICAgICAgICBXZWJLaXQgc2hvdWxkIGJlIGxhenktZmluYWxpemF0aW9uLXNhZmUgKGVz cC4gdGhlIERPTSkgdjIKZGlmZiAtLWdpdCBhL1NvdXJjZS9XZWJLaXQyL1dlYlByb2Nlc3MvV2Vi UGFnZS9XZWJQYWdlLmNwcCBiL1NvdXJjZS9XZWJLaXQyL1dlYlByb2Nlc3MvV2ViUGFnZS9XZWJQ YWdlLmNwcAppbmRleCBhMDdiNjc1Li42ZjE4MjdjIDEwMDY0NAotLS0gYS9Tb3VyY2UvV2ViS2l0 Mi9XZWJQcm9jZXNzL1dlYlBhZ2UvV2ViUGFnZS5jcHAKKysrIGIvU291cmNlL1dlYktpdDIvV2Vi UHJvY2Vzcy9XZWJQYWdlL1dlYlBhZ2UuY3BwCkBAIC0yMTQ2LDEwICsyMTQ2LDExIEBAIHZvaWQg V2ViUGFnZTo6cGVyZm9ybURyYWdDb250cm9sbGVyQWN0aW9uKHVpbnQ2NF90IGFjdGlvbiwgV2Vi Q29yZTo6RHJhZ0RhdGEgZHJhCiAgICAgICAgIHNlbmQoTWVzc2FnZXM6OldlYlBhZ2VQcm94eTo6 RGlkUGVyZm9ybURyYWdDb250cm9sbGVyQWN0aW9uKFdlYkNvcmU6OkRyYWdTZXNzaW9uKCkpKTsK ICNpZiBQTEFURk9STShRVCkKICAgICAgICAgUU1pbWVEYXRhKiBkYXRhID0gY29uc3RfY2FzdDxR TWltZURhdGEqPihkcmFnRGF0YS5wbGF0Zm9ybURhdGEoKSk7CisgICAgICAgIGRlbGV0ZSBkYXRh OwogI2VsaWYgUExBVEZPUk0oR1RLKQogICAgICAgICBEYXRhT2JqZWN0R3RrKiBkYXRhID0gY29u c3RfY2FzdDxEYXRhT2JqZWN0R3RrKj4oZHJhZ0RhdGEucGxhdGZvcm1EYXRhKCkpOworICAgICAg ICBkYXRhLT5kZXJlZigpOwogI2VuZGlmCi0gICAgICAgIGRlbGV0ZSBkYXRhOwogICAgICAgICBy ZXR1cm47CiAgICAgfQogCkBAIC0yMTc3LDEwICsyMTc4LDExIEBAIHZvaWQgV2ViUGFnZTo6cGVy Zm9ybURyYWdDb250cm9sbGVyQWN0aW9uKHVpbnQ2NF90IGFjdGlvbiwgV2ViQ29yZTo6RHJhZ0Rh dGEgZHJhCiAgICAgLy8gRHJhZ0RhdGEgZG9lcyBub3QgZGVsZXRlIGl0cyBwbGF0Zm9ybURhdGEg c28gd2UgbmVlZCB0byBkbyB0aGF0IGhlcmUuCiAjaWYgUExBVEZPUk0oUVQpCiAgICAgUU1pbWVE YXRhKiBkYXRhID0gY29uc3RfY2FzdDxRTWltZURhdGEqPihkcmFnRGF0YS5wbGF0Zm9ybURhdGEo KSk7CisgICAgZGVsZXRlIGRhdGE7CiAjZWxpZiBQTEFURk9STShHVEspCiAgICAgRGF0YU9iamVj dEd0ayogZGF0YSA9IGNvbnN0X2Nhc3Q8RGF0YU9iamVjdEd0ayo+KGRyYWdEYXRhLnBsYXRmb3Jt RGF0YSgpKTsKKyAgICBkYXRhLT5kZXJlZigpOwogI2VuZGlmCi0gICAgZGVsZXRlIGRhdGE7CiB9 CiAKICNlbHNlCg==