Summary: | [GTK] Crash in debug builds when closing web page after r180214 | ||
---|---|---|---|
Product: | WebKit | Reporter: | Michael Catanzaro <mcatanzaro> |
Component: | WebKitGTK | Assignee: | Nobody <webkit-unassigned> |
Status: | RESOLVED DUPLICATE | ||
Severity: | Normal | CC: | cgarcia, mcatanzaro, svillar |
Priority: | P2 | ||
Version: | 528+ (Nightly build) | ||
Hardware: | PC | ||
OS: | Linux |
Description
Michael Catanzaro
2015-02-17 18:59:49 PST
(In reply to comment #0) > r180214 seems to have introduced a crash when closing epiphany. I need to > debug this further but my guess at this point is that in > DOMObjectCacheFrameObserver::frameDestroyed, the call to > domObjectCacheFrameObservers().remove(frame) causes the destruction of the > DOMObjectCacheFrameObserver, which is bad because > WebCore::FrameDestructionObserver's destructor calls > m_frame->removeDestructionObserver, resulting in > WebCore::Frame::m_destructionObservers changing size while it is being > iterated through in WebCore::Frame's destructor. That's probably illegal. > The crash happens when Frame::willDetachPage() iterates the observers, so at that point frameDestroyed() hasn't been called at all, it's called in ~Frame. When the frame is destroyed we call the parent FrameDestructionObserver::frameDestroyed() that sets m_frame to nullptr, so when the DOMObjectCacheFrameObserver is deleted, the destructor doesn't call m_frame->removeDestructionObserver() because m_frame is already nullptr. That's why things happen in that order, and the reason why we save the m_frame pointer before calling FrameDestructionObserver::frameDestroyed(). So, unless something really weird is happening, it must be something else. You are right. I think I somehow switched from looking at the iteration over the observer list in Frame::willDetatchPage() to the one in the destructor and never looked back. Silly... I am not seeing this crash anymore, and it used to happen 100%, so I think it's obsolete. *** This bug has been marked as a duplicate of bug 144508 *** |