Bug 136909

Summary: Occasional unreproducible crashes in MessageReceiverMap::dispatchMessage
Product: WebKit Reporter: Tim Horton <thorton>
Component: WebKit2Assignee: Tim Horton <thorton>
Status: RESOLVED FIXED    
Severity: Normal CC: andersca, darin, mitz, sam, simon.fraser
Priority: P2 Keywords: InRadar
Version: 528+ (Nightly build)   
Hardware: Unspecified   
OS: Unspecified   
Attachments:
Description Flags
Patch andersca: review+

Description Tim Horton 2014-09-18 00:04:49 PDT
Occasional unreproducible crashes in MessageReceiverMap::dispatchMessage
Comment 1 Tim Horton 2014-09-18 00:05:16 PDT
Created attachment 238291 [details]
Patch
Comment 2 Tim Horton 2014-09-18 00:08:15 PDT
Step 2: Make a API test, if possible. Prerequisites include getting TestWebKitAPI a Modern API bundle and ... causing the issue to reproduce at all. Going to try this now, but I want to keep it separate from the fix for mergability's sake (most likely going to change bundle loading code).

Step 3: Fix a few less obviously bad but still confusing cases of message receivers not being removed before the object is destroyed.

Step 4: Add some assertions that catch this and the other cases; Anders and I wrote some nice assertions today that catch all of these things.
Comment 3 Darin Adler 2014-09-18 08:40:06 PDT
<rdar://problem/17758325>
Comment 4 Tim Horton 2014-09-18 09:26:49 PDT
http://trac.webkit.org/changeset/173722