Bug 52569

Summary: [Qt][WK2] Crash due to double destruction of QSharedMemory
Product: WebKit Reporter: Balazs Kelemen <kbalazs>
Component: WebKit2Assignee: Nobody <webkit-unassigned>
Status: RESOLVED FIXED    
Severity: Normal    
Priority: P2    
Version: 528+ (Nightly build)   
Hardware: PC   
OS: All   
Attachments:
Description Flags
Patch none

Balazs Kelemen
Reported 2011-01-17 04:59:40 PST
Some layout tests are crashing because of a bug associated with the CleanupHandler. For example fast/forms/form-associated-element-crash.html produce the following backtrace: Program received signal SIGSEGV, Segmentation fault. 0x080c9f50 in ?? () (gdb) bt 10 #0 0x080c9f50 in ?? () #1 0xb70e3925 in WTF::RefCounted<WebKit::SharedMemory>::deref (this=0x80ef9e8) at ../../../../Source/JavaScriptCore/wtf/RefCounted.h:139 #2 0xb70e3961 in WTF::derefIfNotNull<WebKit::SharedMemory> (ptr=0x80ef9e8) at ../../../../Source/JavaScriptCore/wtf/PassRefPtr.h:59 #3 0xb70e39ad in WTF::RefPtr<WebKit::SharedMemory>::~RefPtr (this=0x80ccee8, __in_chrg=<value optimized out>) at ../../../../Source/JavaScriptCore/wtf/RefPtr.h:57 #4 0xb70f6097 in WebKit::VisitedLinkTable::~VisitedLinkTable (this=0x80ccee8, __in_chrg=<value optimized out>) at ../../../../Source/WebKit2/Shared/VisitedLinkTable.cpp:42 #5 0xb714a50a in WebKit::VisitedLinkProvider::~VisitedLinkProvider (this=0x80cced8, __in_chrg=<value optimized out>) at ../../../../Source/WebKit2/UIProcess/VisitedLinkProvider.h:40 #6 0xb7140dd5 in WebKit::WebContext::~WebContext (this=0x80cce70, __in_chrg=<value optimized out>) at ../../../../Source/WebKit2/UIProcess/WebContext.cpp:120 ... This is the symptom of deleting the QSharedMemory twice. The following happens in this scenario in time oriented order: 1. QApplication stopping => 2. CleanupHandler deletes the QSharedMemory in the slot connected to QApplication::aboutToQuit 3. Destructor of SharedMemory is reached through the destruction of the TestController. The code that was preventing from this behavior was removed by http://trac.webkit.org/changeset/74967 because of my wrong assumption that it is not needed anymore.
Attachments
Patch (3.29 KB, patch)
2011-01-17 05:06 PST, Balazs Kelemen
no flags
Balazs Kelemen
Comment 1 2011-01-17 05:06:44 PST
Andreas Kling
Comment 2 2011-01-17 05:23:31 PST
Comment on attachment 79158 [details] Patch r=me
Balazs Kelemen
Comment 3 2011-01-17 05:29:04 PST
Comment on attachment 79158 [details] Patch Clearing flags on attachment: 79158 Committed r75935: <http://trac.webkit.org/changeset/75935>
Balazs Kelemen
Comment 4 2011-01-17 05:29:12 PST
All reviewed patches have been landed. Closing bug.
Note You need to log in before you can comment on or make changes to this bug.