Summary: | [GTK] Crash in WebCore::CoordinatedGraphicsLayer::notifyFlushRequired | ||||||||
---|---|---|---|---|---|---|---|---|---|
Product: | WebKit | Reporter: | Michael Catanzaro <mcatanzaro> | ||||||
Component: | WebKitGTK | Assignee: | Nobody <webkit-unassigned> | ||||||
Status: | RESOLVED FIXED | ||||||||
Severity: | Normal | CC: | bugs-noreply, cgarcia, cmarcelo, commit-queue, kondapallykalyan, luiz, mcatanzaro, mcrha, noam, tpopela, zan | ||||||
Priority: | P2 | ||||||||
Version: | WebKit Nightly Build | ||||||||
Hardware: | PC | ||||||||
OS: | Linux | ||||||||
See Also: |
https://bugzilla.redhat.com/show_bug.cgi?id=1408225 https://bugzilla.gnome.org/show_bug.cgi?id=776391 |
||||||||
Attachments: |
|
Description
Michael Catanzaro
2016-12-22 07:31:42 PST
Most likely m_coordinator is null. It's not expected to be null since there's an assert at the top of notifyFlushRequired() that checks that. (In reply to comment #1) > Most likely m_coordinator is null. It's not expected to be null since > there's an assert at the top of notifyFlushRequired() that checks that. I'm pretty sure I've hit that assert many times before. Milan says this is 100% reproducible when opening the web inspector in Evolution when running in X11. Doesn't happen in Wayland nor in Epiphany. Note: we only have five reports of this total in Fedora. But that's not unexpected if it requires opening the web inspector. Maybe the downstream reporter, who didn't mention inspector at all, accidentally triggered the inspector keybinding and didn't realize it. Right, for me, when not running under Wayland, it's enough to show the inspector and move a mouse pointer above its area (even its top buttons), but only from within the Evolution for some reason. Created attachment 297927 [details]
test-wk2.c
This is a test program to reproduce the crash. As Tom told me, the trick is to use WEBKIT_DISABLE_COMPOSITING_MODE=1, which evolution does by default now, then the application crashes when moving the mouse cursor for example above the HTML nodes of the inspector.
The first line of the file contains a command line to compile & run it. Then click the Show Inspector button at the top and finally hover the mouse above the area of the docked inspector.
(In reply to comment #5) > Created attachment 297927 [details] > test-wk2.c > > This is a test program to reproduce the crash. As Tom told me, the trick is > to use WEBKIT_DISABLE_COMPOSITING_MODE=1, which evolution does by default > now, then the application crashes when moving the mouse cursor for example > above the HTML nodes of the inspector. As Carlos told me the web inspector requires the AC to be enabled. So basically it is "expected" that it will misbehave (crash) when it is disabled. I don't think it should crash, maybe things like page overlay wont' work, but it shouldn't crash. Running Epiphany with WEBKIT_DISABLE_COMPOSITING_MODE=1, the inspector appears to work until I click the inspect button (which I guess creates the page overlay). When clicking the Inspect button, the web process immediately crashes. (In reply to comment #8) > Running Epiphany with WEBKIT_DISABLE_COMPOSITING_MODE=1, the inspector > appears to work With the caveat that it is not possible to close, resize, or dock/undock, it just stays open forever. I think this should be fixed now by r211083. Feel free to reopen if I'm wrong. It's still possible to crash in CoordinatedGraphicsLayer::notifyFlushRequired(), I'm getting this when closing a page that is being inspected. #0 0x00007f6e3cc7d20b in WebCore::CoordinatedGraphicsLayer::notifyFlushRequired() () from /home/cgarcia/src/git/gnome/WebKit-remote-inspector/WebKitBuild/Release/lib/libwebkit2gtk-4.0.so.37 #1 0x00007f6e3cc812f5 in WebCore::CoordinatedGraphicsLayer::removeFromParent() () from /home/cgarcia/src/git/gnome/WebKit-remote-inspector/WebKitBuild/Release/lib/libwebkit2gtk-4.0.so.37 #2 0x00007f6e3baef810 in WebKit::WebInspectorClient::~WebInspectorClient() () from /home/cgarcia/src/git/gnome/WebKit-remote-inspector/WebKitBuild/Release/lib/libwebkit2gtk-4.0.so.37 #3 0x00007f6e3baef8e7 in WebKit::WebInspectorClient::inspectedPageDestroyed() () from /home/cgarcia/src/git/gnome/WebKit-remote-inspector/WebKitBuild/Release/lib/libwebkit2gtk-4.0.so.37 #4 0x00007f6e3c3df5b2 in WebCore::InspectorController::inspectedPageDestroyed() () from /home/cgarcia/src/git/gnome/WebKit-remote-inspector/WebKitBuild/Release/lib/libwebkit2gtk-4.0.so.37 #5 0x00007f6e3c5c8859 in WebCore::Page::~Page() () from /home/cgarcia/src/git/gnome/WebKit-remote-inspector/WebKitBuild/Release/lib/libwebkit2gtk-4.0.so.37 #6 0x00007f6e3bb13dd0 in WebKit::WebPage::close() () from /home/cgarcia/src/git/gnome/WebKit-remote-inspector/WebKitBuild/Release/lib/libwebkit2gtk-4.0.so.37 #7 0x00007f6e3bd2fd81 in WebKit::WebPage::didReceiveWebPageMessage(IPC::Connection&, IPC::Decoder&) () from /home/cgarcia/src/git/gnome/WebKit-remote-inspector/WebKitBuild/Release/lib/libwebkit2gtk-4.0.so.37 #8 0x00007f6e3b92b3f9 in IPC::MessageReceiverMap::dispatchMessage(IPC::Connection&, IPC::Decoder&) () from /home/cgarcia/src/git/gnome/WebKit-remote-inspector/WebKitBuild/Release/lib/libwebkit2gtk-4.0.so.37 #9 0x00007f6e3ba68d06 in WebKit::WebProcess::didReceiveMessage(IPC::Connection&, IPC::Decoder&) () from /home/cgarcia/src/git/gnome/WebKit-remote-inspector/WebKitBuild/Release/lib/libwebkit2gtk-4.0.so.37 #10 0x00007f6e3b926edb in IPC::Connection::dispatchMessage(std::unique_ptr<IPC::Decoder, std::default_delete<IPC::Decoder> >) () from /home/cgarcia/src/git/gnome/WebKit-remote-inspector/WebKitBuild/Release/lib/libwebkit2gtk-4.0.so.37 #11 0x00007f6e3b927e08 in IPC::Connection::dispatchOneMessage() () from /home/cgarcia/src/git/gnome/WebKit-remote-inspector/WebKitBuild/Release/lib/libwebkit2gtk-4.0.so.37 #12 0x00007f6e38868e95 in WTF::RunLoop::performWork() () from /home/cgarcia/src/git/gnome/WebKit-remote-inspector/WebKitBuild/Release/lib/libjavascriptcoregtk-4.0.so.18 #13 0x00007f6e3889e189 in WTF::RunLoop::RunLoop()::{lambda(void*)#1}::_FUN(void*) () from /home/cgarcia/src/git/gnome/WebKit-remote-inspector/WebKitBuild/Release/lib/libjavascriptcoregtk-4.0.so.18 #14 0x00007f6e3190613a in g_main_dispatch (context=0x55ca754c5470) at gmain.c:3203 #15 g_main_context_dispatch (context=context@entry=0x55ca754c5470) at gmain.c:3856 #16 0x00007f6e319064b8 in g_main_context_iterate (context=0x55ca754c5470, block=block@entry=1, dispatch=dispatch@entry=1, self=<optimized out>) at gmain.c:3929 #17 0x00007f6e319067d2 in g_main_loop_run (loop=0x55ca755eca80) at gmain.c:4125 #18 0x00007f6e3889ea20 in WTF::RunLoop::run() () from /home/cgarcia/src/git/gnome/WebKit-remote-inspector/WebKitBuild/Release/lib/libjavascriptcoregtk-4.0.so.18 #19 0x00007f6e3bce1092 in int WebKit::ChildProcessMain<WebKit::WebProcess, WebKit::WebProcessMain>(int, char**) () from /home/cgarcia/src/git/gnome/WebKit-remote-inspector/WebKitBuild/Release/lib/libwebkit2gtk-4.0.so.37 #20 0x00007f6e2e4782b1 in __libc_start_main (main=0x55ca734eac30 <main>, argc=2, argv=0x7ffc7503da48, init=<optimized out>, fini=<optimized out>, rtld_fini=<optimized out>, stack_end=0x7ffc7503da38) at ../csu/libc-start.c:291 #21 0x000055ca734eac8a in _start () When CoordinatedGraphicsLayer::removefromParent is called, the coordinator has already been invalidated, so all its layers were set a nullptr coordinator. I think it's safe to simply handle m_coordinator being nullptr there. Created attachment 303187 [details]
Patch
Committed r213276: <http://trac.webkit.org/changeset/213276> |