Bug 69037 – ASSERT if WebView's UIDelegate does not implement webView:runOpenPanel

• Component: WebKit API
• Status: RESOLVED FIXED

[Joseph Pecoraro]

If a WebView's UIDelegate does not implement any of the webView:runOpenPanel delegates
then WebChromeClient will ASSERT(!_chooser) when the unused WebOpenPanelResultListener
deallocated. WebKit expects an action (-cancel, -chooseFile:, or -chooseFiles:) to be called
on the listener before its deallocated.

We can either not create the listener if its not needed, or just default to cancel if no delegate is implemented.

[Joseph Pecoraro]

Created attachment 109096 [details]
[PATCH] Proposed Fix

Easiest approach was to just send a -cancel to the listener.

[Joseph Pecoraro]

This would also fix a leak for those cases.

[Alexey Proskuryakov]

Comment on attachment 109096 [details]
[PATCH] Proposed Fix

Is it right to -release after -cancel? This looks like an over-release.

[Joseph Pecoraro]

In this case, -cancel doesn't release the object, it just sends a message down
to the WebCore::FileChooser and clears the FileChooser. -release just
deallocates, which expects the chooser to have already been cleared.

The relevant code here is:

    ifndef NDEBUG
    - (void)dealloc
    {
        ASSERT(!_chooser);
        [super dealloc];
    }
    - (void)finalize
    {
        ASSERT(!_chooser);
        [super finalize];
    }
    #endif

    - (void)cancel
    {
        ASSERT(_chooser);
        if (!_chooser)
            return;
        _chooser->deref();
        _chooser = 0;
    }

[Joseph Pecoraro]

(In reply to comment #4)
> "it just sends a message down to the WebCore::FileChooser"

Actually the -cancel path doesn't send a message. The -chooseFile(s) paths
do send a message and clear the chooser. The rest of my comment is still fine.

[WebKit Review Bot]

Comment on attachment 109096 [details]
[PATCH] Proposed Fix

Clearing flags on attachment: 109096

Committed r96279: <http://trac.webkit.org/changeset/96279>

[WebKit Review Bot]

All reviewed patches have been landed.  Closing bug.