Summary: | Crash on undo after editing text and closing tab | ||||||||
---|---|---|---|---|---|---|---|---|---|
Product: | WebKit | Reporter: | Jeff Johnson <opendarwin> | ||||||
Component: | HTML Editing | Assignee: | Nobody <webkit-unassigned> | ||||||
Status: | REOPENED --- | ||||||||
Severity: | Normal | CC: | justin.garcia, mrowe | ||||||
Priority: | P1 | Keywords: | InRadar | ||||||
Version: | 528+ (Nightly build) | ||||||||
Hardware: | Mac | ||||||||
OS: | OS X 10.4 | ||||||||
Attachments: |
|
Description
Jeff Johnson
2007-12-10 20:41:23 PST
Created attachment 17834 [details]
Sample Xcode project demonstrating crash
Related bugs: <http://bugs.webkit.org/show_bug.cgi?id=14152>, <http://bugs.webkit.org/show_bug.cgi?id=8095>, <http://bugs.webkit.org/show_bug.cgi?id=8109>. Created attachment 17835 [details]
Crash log
(gdb) set env NSZombieEnabled=YES (gdb) set env NSDeallocateZombies=YES (gdb) r Starting program: /Volumes/Data/Home/Downloads/UndoCrash/build/Debug/UndoCrash.app/Contents/MacOS/UndoCrash 2007-12-11 15:57:14.632 UndoCrash[4627:813] *** -[WebFramePrivate undoEditing:]: message sent to deallocated instance 0x127690 Program received signal SIGTRAP, Trace/breakpoint trap. 0x92769a27 in ___forwarding___ () (gdb) bt #0 0x92769a27 in ___forwarding___ () #1 0x92769b32 in __forwarding_prep_0___ () #2 0x90e666c2 in -[_NSUndoLightInvocation invoke] () #3 0x90e54204 in -[_NSUndoStack popAndInvoke] () #4 0x90e54007 in -[NSUndoManager undoNestedGroup] () #5 0x91f5df94 in -[NSApplication sendAction:to:from:] () #6 0x9200c868 in -[NSMenu performActionForItemAtIndex:] () #7 0x9200c56d in -[NSCarbonMenuImpl performActionWithHighlightingForItemAtIndex:] () #8 0x91fe9482 in AppKitMenuEventHandler () #9 0x903c4863 in DispatchEventToHandlers () #10 0x903c3c9d in SendEventToEventTargetInternal () #11 0x903e008e in SendEventToEventTarget () #12 0x90414c9d in SendHICommandEvent () #13 0x9043b377 in SendMenuCommandWithContextAndModifiers () #14 0x9043b334 in SendMenuItemSelectedEvent () #15 0x9043b242 in FinishMenuSelection () #16 0x90417f32 in MenuSelectCore () #17 0x9041791d in _HandleMenuSelection2 () #18 0x90417791 in _HandleMenuSelection () #19 0x91f2639b in _NSHandleCarbonMenuEvent () #20 0x91e8d1f4 in _DPSNextEvent () #21 0x91e8c6a0 in -[NSApplication nextEventMatchingMask:untilDate:inMode:dequeue:] () #22 0x91e856d1 in -[NSApplication run] () #23 0x91e529ba in NSApplicationMain () #24 0x00001eec in main (argc=1, argv=0xbffff780) at /Volumes/Data/Home/Downloads/UndoCrash/main.m:13 (gdb) Definitely looks like the WebView isn't cleaning up after itself. Reproducible crash -> P1. Still crashes with r35406 under Mac OS X 10.5.4. It seems that the WebView just needs to call [NSUndoManager removeAllActionsWithTarget:self] before it dies. http://developer.apple.com/documentation/Cocoa/Reference/Foundation/Classes/NSUndoManager_Class/Reference/Reference.html#//apple_ref/occ/instm/NSUndoManager/removeAllActionsWithTarget: Hum... probably not actually quite that simple. See: void WebEditorClient::clearUndoRedoOperations() WebEditorClient.mm:388 I expect what should happen to fix this, is that we should abstract this workaround into a category method on NSUndoManager (Something like _webkit_removeAllActionsWithTarget:) and then call that method instead from WebEditor client... or find some way for WebView to grab at the WebEditorClient (where would that even be?) during its dealloc. Should be relatively simple to trace through, but I'm going to look at other p1s for the moment. Cannot reproduce on 10.5.6 w/ WebKit r40304. This does not seem to be fixed. I just reproduced the crash on 10.5.6 with r40468. |