Bug 45535

Summary: Crash in WebProcess::removeWebFrame on exit with WebKit2 (Release builds only)
Product: WebKit Reporter: Adam Roben (:aroben) <aroben>
Component: WebKit2Assignee: Nobody <webkit-unassigned>
Status: RESOLVED FIXED    
Severity: Normal CC: andersca, sam
Priority: P2 Keywords: InRadar
Version: 528+ (Nightly build)   
Hardware: PC   
OS: Windows XP   
Attachments:
Description Flags
Don't crash when a frame is destroyed after the UI process has disconnected darin: review+

Description Adam Roben (:aroben) 2010-09-10 05:47:26 PDT 
To reproduce:

1. Go to any web page
2. Quit the application

You'll crash in WebProcess::removeWebFrame because m_connection is null. Here's the backtrace:


>	WebKit.dll!CoreIPC::Connection::sendMessage(CoreIPC::MessageID messageID={...}, WTF::PassOwnPtr<CoreIPC::ArgumentEncoder> arguments={...})  Line 82	C++
 	WebKit.dll!WebKit::WebProcess::removeWebFrame(unsigned __int64 frameID=1154279296239097896)  Line 396	C++
 	WebKit.dll!WebKit::WebFrameLoaderClient::frameLoaderDestroyed()  Line 82	C++
 	WebKit.dll!WebCore::Frame::~Frame()  Line 223 + 0x149 bytes	C++
 	WebKit.dll!WebCore::Frame::lifeSupportTimerFired(WebCore::Timer<WebCore::Frame> * __formal=0x7feb5db0)  Line 883 + 0x6 bytes	C++
 	WebKit.dll!WebCore::Timer<WebCore::RenderMedia>::fired()  Line 98 + 0xe bytes	C++
 	WebKit.dll!WebCore::ThreadTimers::sharedTimerFiredInternal()  Line 115	C++
 	WebKit.dll!WebCore::ThreadTimers::sharedTimerFired()  Line 91	C++
 	WebKit.dll!WebCore::TimerWindowWndProc(HWND__ * hWnd=0x00030314, unsigned int message=49573, unsigned int wParam=0, long lParam=0)  Line 104	C++
 	user32.dll!_InternalCallWinProc@20()  + 0x28 bytes	
 	user32.dll!_UserCallWinProcCheckWow@32()  + 0xb7 bytes	
 	user32.dll!_DispatchMessageWorker@8()  + 0xdc bytes	
 	user32.dll!_DispatchMessageW@4()  + 0xf bytes	
 	WebKit.dll!RunLoop::run()  Line 72 + 0x7 bytes	C++
 	WebKit.dll!WebKit::WebProcessMain(WebKit::CommandLine * commandLine=0x0012ff00)  Line 81	C++
 	WebKit.dll!WebKitMain(HINSTANCE__ * hInstance=0x00400000, HINSTANCE__ * hPrevInstance=0x00000000, wchar_t * lpstrCmdLine=0x00020bf0, int nCmdShow=10)  Line 101 + 0xa bytes	C++
 	WebKit2WebProcess.exe!wWinMain(HINSTANCE__ * hInstance=0x00400000, HINSTANCE__ * hPrevInstance=0x00000000, wchar_t * lpstrCmdLine=0x00020bf0, int nCmdShow=10)  Line 44 + 0x1a bytes	C++
 	WebKit2WebProcess.exe!__tmainCRTStartup()  Line 589 + 0x1c bytes	C
 	kernel32.dll!_BaseProcessStart@4()  + 0x23 bytes

<rdar://problem/8412928>
Comment 1 Adam Roben (:aroben) 2010-09-10 05:52:02 PDT 
You can ignore the bogus frameID passed to removeWebFrame. That's just an artifact of Release builds being dodgy in the debugger.
Comment 2 Adam Roben (:aroben) 2010-09-10 05:52:24 PDT 
m_connection is null because WebProcess::invalidate has already been called.
Comment 3 Adam Roben (:aroben) 2010-09-10 05:54:22 PDT 
Created attachment 67173 [details]
Don't crash when a frame is destroyed after the UI process has disconnected
Comment 4 Adam Roben (:aroben) 2010-09-10 08:53:15 PDT 
Committed r67202: <http://trac.webkit.org/changeset/67202>