Bug 151653 – [GTK] UI process crash when the screensaver DBus proxy is being created while the web view is destroyed

• Component: WebKitGTK
• Status: RESOLVED FIXED

[Carlos Garcia Campos]

We correctly cancel the proxy creation, but when the async ready callback is called, the view could be destroyed already. In that case g_dbus_proxy_new_for_bus_finish() will return nullptr and fail with cancelled error, but we are using the passed web view without checking first if the creation failed or not.

[Carlos Garcia Campos]

Forgot the bt. This crash is what makes /webkit2/WebKitWebView/submit-form fail sometimes, because when /webkit2/WebKitWebView/fullscreen runs, the proxy creation starts, and in /webkit2/WebKitWebView/submit-form the callback is called, but the web view of that previous test has been destroyed.

Program received signal SIGSEGV, Segmentation fault.
0x00007ffff32c502b in screenSaverProxyCreatedCallback(_GObject*, _GAsyncResult*, _WebKitWebViewBase*) ()
   from /home/cgarcia/src/git/gnome/WebKit/WebKitBuild/Release/lib/libwebkit2gtk-4.0.so.37
(gdb) bt
#0  0x00007ffff32c502b in screenSaverProxyCreatedCallback(_GObject*, _GAsyncResult*, _WebKitWebViewBase*) ()
   from /home/cgarcia/src/git/gnome/WebKit/WebKitBuild/Release/lib/libwebkit2gtk-4.0.so.37
#1  0x00007ffff59861a3 in g_task_return_now (task=0x7cf8f0) at gtask.c:1104
#2  0x00007ffff598680e in g_task_return (task=0x7cf8f0, type=<optimized out>) at gtask.c:1162
#3  0x00007ffff59dbfac in init_second_async_cb (source_object=<optimized out>, res=<optimized out>, user_data=0x7cf8f0) at gdbusproxy.c:1807
#4  0x00007ffff59861a3 in g_task_return_now (task=0x7cfa90) at gtask.c:1104
#5  0x00007ffff598680e in g_task_return (task=0x7cfa90, type=<optimized out>) at gtask.c:1162
#6  0x00007ffff59dba1e in async_init_start_service_by_name_cb (connection=<optimized out>, res=0x7cfb60, user_data=0x7cfa90) at gdbusproxy.c:1645
#7  0x00007ffff59861a3 in g_task_return_now (task=0x7cfb60) at gtask.c:1104
#8  0x00007ffff598680e in g_task_return (task=0x7cfb60, type=<optimized out>) at gtask.c:1162
#9  0x00007ffff59d0d00 in g_dbus_connection_call_done (source=<optimized out>, result=0x87e850, user_data=0x7cfb60) at gdbusconnection.c:5702
#10 0x00007ffff59861a3 in g_task_return_now (task=0x87e850) at gtask.c:1104
#11 0x00007ffff59861d9 in complete_in_idle_cb (task=0x87e850) at gtask.c:1118
#12 0x00007ffff766fb4a in g_main_dispatch (context=0x656e30) at gmain.c:3154
#13 g_main_context_dispatch (context=context@entry=0x656e30) at gmain.c:3769
#14 0x00007ffff766fec8 in g_main_context_iterate (context=0x656e30, block=block@entry=1, dispatch=dispatch@entry=1, self=<optimized out>) at gmain.c:3840
#15 0x00007ffff76701e2 in g_main_loop_run (loop=0x740380) at gmain.c:4034
#16 0x0000000000408757 in testWebViewSubmitForm(FormClientTest*, void const*) ()
#17 0x00007ffff76943db in test_case_run (tc=0x6c8ca0) at gtestutils.c:2158
#18 g_test_run_suite_internal (suite=suite@entry=0x7a5060, path=path@entry=0x0) at gtestutils.c:2241
#19 0x00007ffff76945a3 in g_test_run_suite_internal (suite=suite@entry=0x7a5080, path=path@entry=0x0) at gtestutils.c:2253
#20 0x00007ffff76945a3 in g_test_run_suite_internal (suite=suite@entry=0x7a50a0, path=path@entry=0x0) at gtestutils.c:2253
#21 0x00007ffff769479e in g_test_run_suite (suite=0x7a50a0) at gtestutils.c:2328
#22 0x00007ffff76947c1 in g_test_run () at gtestutils.c:1596
#23 0x0000000000407a85 in main ()

[Carlos Garcia Campos]

Created attachment 266242 [details]
Patch

[WebKit Commit Bot]

Thanks for the patch. If this patch contains new public API please make sure it follows the guidelines for new WebKit2 GTK+ API. See http://trac.webkit.org/wiki/WebKitGTK/AddingNewWebKit2API

[Martin Robinson]

Comment on attachment 266242 [details]
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=266242&action=review

> Source/WebKit2/UIProcess/API/gtk/WebKitWebViewBase.cpp:1175
> +    if (!proxy)
>          return;

It might be a good idea to leave a comment here explaining the situation as well. I think that could be quite useful for people reading the code.

[Carlos Garcia Campos]

Committed r192792: <http://trac.webkit.org/changeset/192792>