Bug 55932 – [GTK] close-web-view emitted on disposed WebView

• Component: WebKitGTK
• Status: RESOLVED FIXED

[Philippe Normand]

Test fast/frames/iframe-reparenting-plugins.html produces this warning:

instance of invalid non-instantiatable type `<invalid>'
g_signal_emit_by_name: assertion `G_TYPE_CHECK_INSTANCE (instance)' failed

bt:

#0  g_logv (log_domain=<value optimized out>, log_level=<value optimized out>, format=<value optimized out>, 
    args1=0x7fff565dbce0) at gmessages.c:563
#1  0x00007fbe63487653 in g_log (log_domain=0x7fbe6229fe40 "", log_level=0, format=
    0x1 <Address 0x1 out of bounds>) at gmessages.c:577
#2  0x00007fbe63d86725 in g_type_check_instance (type_instance=<value optimized out>) at gtype.c:4073
#3  0x00007fbe63d849dd in g_signal_emit_by_name (instance=0x7fbe6229fe40, detailed_signal=0x0)
    at gsignal.c:3065
#4  0x00007fbe662e22a3 in WebKit::emitCloseWebViewSignalLater (view=0x19f84c0)
    at ../../Source/WebKit/gtk/WebCoreSupport/ChromeClientGtk.cpp:255
#5  0x00007fbe6347cd6b in g_timeout_dispatch (source=0x23717a0, callback=0, user_data=0x1) at gmain.c:3878
#6  0x00007fbe6347c312 in g_main_dispatch (context=0x198e0d0) at gmain.c:2440
#7  g_main_context_dispatch (context=0x198e0d0) at gmain.c:3013
#8  0x00007fbe634809d8 in g_main_context_iterate (context=0x198e0d0, block=<value optimized out>, 
    dispatch=<value optimized out>, self=<value optimized out>) at gmain.c:3091
#9  0x00007fbe63480ee5 in g_main_loop_run (loop=0x2a942c0) at gmain.c:3299
#10 0x00007fbe653e7557 in IA__gtk_main () at gtkmain.c:1255
#11 0x000000000041f2f5 in runTest (testPathOrURL=...)
    at ../../Tools/DumpRenderTree/gtk/DumpRenderTree.cpp:679
#12 0x000000000041e987 in runTestingServerLoop () at ../../Tools/DumpRenderTree/gtk/DumpRenderTree.cpp:489
#13 0x0000000000420a6c in main (argc=2, argv=0x7fff565dcb58)
    at ../../Tools/DumpRenderTree/gtk/DumpRenderTree.cpp:1143

[Philippe Normand]

(gdb) p *view
$2 = {parent_instance = {widget = {object = {parent_instance = {g_type_instance = {g_class = 0x19f8280}, 
          ref_count = 0, qdata = 0xaaaaaaaaaaaaaaaa}, flags = 2863311530}, private_flags = 43690, 
      state = 170 '\252', saved_state = 170 '\252', name = 
    0xaaaaaaaaaaaaaaaa <Address 0xaaaaaaaaaaaaaaaa out of bounds>, style = 0xaaaaaaaaaaaaaaaa, 
      requisition = {width = -1431655766, height = -1431655766}, allocation = {x = -1431655766, 
        y = -1431655766, width = -1431655766, height = -1431655766}, window = 0xaaaaaaaaaaaaaaaa, parent = 
    0xaaaaaaaaaaaaaaaa}, focus_child = 0xaaaaaaaaaaaaaaaa, border_width = 43690, need_resize = 0, 
    resize_mode = 1, reallocate_redraws = 1, has_focus_chain = 0}, priv = 0xaaaaaaaaaaaaaaaa}

[Philippe Normand]

Created attachment 85040 [details]
proposed patch

[Martin Robinson]

Comment on attachment 85040 [details]
proposed patch

Isn't it possible to use m_closeSoonTimer in the ChromeClient destructor to cancel the source. That seems more reliable than counting on the view pointer to be junk.

[Philippe Normand]

Created attachment 85142 [details]
updated patch

[Martin Robinson]

Comment on attachment 85142 [details]
updated patch

Great stuff! Thank you.

[Philippe Normand]

Committed r80836: <http://trac.webkit.org/changeset/80836>