Bug 69037

Summary: ASSERT if WebView's UIDelegate does not implement webView:runOpenPanel
Product: WebKit Reporter: Joseph Pecoraro <joepeck>
Component: WebKit APIAssignee: Nobody <webkit-unassigned>
Severity: Normal CC: joepeck, webkit.review.bot
Priority: P2    
Version: 528+ (Nightly build)   
Hardware: Unspecified   
OS: Unspecified   
Description Flags
[PATCH] Proposed Fix none

Description Joseph Pecoraro 2011-09-28 16:00:30 PDT
If a WebView's UIDelegate does not implement any of the webView:runOpenPanel delegates
then WebChromeClient will ASSERT(!_chooser) when the unused WebOpenPanelResultListener
deallocated. WebKit expects an action (-cancel, -chooseFile:, or -chooseFiles:) to be called
on the listener before its deallocated.

We can either not create the listener if its not needed, or just default to cancel if no delegate is implemented.
Comment 1 Joseph Pecoraro 2011-09-28 17:06:01 PDT
Created attachment 109096 [details]
[PATCH] Proposed Fix

Easiest approach was to just send a -cancel to the listener.
Comment 2 Joseph Pecoraro 2011-09-28 17:08:33 PDT
This would also fix a leak for those cases.
Comment 3 Alexey Proskuryakov 2011-09-28 17:20:30 PDT
Comment on attachment 109096 [details]
[PATCH] Proposed Fix

Is it right to -release after -cancel? This looks like an over-release.
Comment 4 Joseph Pecoraro 2011-09-28 17:25:11 PDT
In this case, -cancel doesn't release the object, it just sends a message down
to the WebCore::FileChooser and clears the FileChooser. -release just
deallocates, which expects the chooser to have already been cleared.

The relevant code here is:

    ifndef NDEBUG
    - (void)dealloc
        [super dealloc];
    - (void)finalize
        [super finalize];

    - (void)cancel
        if (!_chooser)
        _chooser = 0;
Comment 5 Joseph Pecoraro 2011-09-28 17:27:16 PDT
(In reply to comment #4)
> "it just sends a message down to the WebCore::FileChooser"

Actually the -cancel path doesn't send a message. The -chooseFile(s) paths
do send a message and clear the chooser. The rest of my comment is still fine.
Comment 6 WebKit Review Bot 2011-09-28 17:44:36 PDT
Comment on attachment 109096 [details]
[PATCH] Proposed Fix

Clearing flags on attachment: 109096

Committed r96279: <http://trac.webkit.org/changeset/96279>
Comment 7 WebKit Review Bot 2011-09-28 17:44:40 PDT
All reviewed patches have been landed.  Closing bug.