WebKit Bugzilla
New
Browse
Log In
×
Sign in with GitHub
or
Remember my login
Create Account
·
Forgot Password
Forgotten password account recovery
RESOLVED FIXED
100930
[Chromium] debug builds: Use after free under ~PageOverlay()
https://bugs.webkit.org/show_bug.cgi?id=100930
Summary
[Chromium] debug builds: Use after free under ~PageOverlay()
tapted
Reported
2012-11-01 01:44:40 PDT
Downstream bug:
http://crbug.com/157097
What steps will reproduce the problem? 0. Run a debug build of Chromium 1. Open a packaged app Shell window, or popout a Google Chat Panel window 2. Right-click -> Inspect Element, Developer tools opens in new window 3. Close the original Shell/Panel Window 4. segfault around: void GraphicsLayer::willBeDestroyed() { #ifndef NDEBUG if (m_client) m_client->verifyNotPainting(); #endif This code added in
bug 81954
(from March) The problem is that WebKit::PageOverlay is declared like this: class PageOverlay { /* snip */ WebViewImpl* m_viewImpl; WebPageOverlay* m_overlay; OwnPtr<WebCore::GraphicsLayer> m_layer; OwnPtr<WebCore::GraphicsLayerClient> m_layerClient; int m_zOrder; }; So m_layerClient will be destroyed before m_layer at the end of ~PageOverlay(). So, it is not valid for GraphicsLayer::willBeDestroyed (called from the ~GraphicsLayerChromium leaf class) to access its own GraphicsLayerClient data member in this situation to do m_client->verifyNotPainting();. Some possible solutions: - Fix the destruction order (reorder members) - explicitly set PageOverlay::m_layer->m_client to NULL in ~PageOverlay - something-else-because-i-don't-really-know-webkit-that-well
Attachments
Patch
(1.24 KB, patch)
2012-11-01 07:35 PDT
,
Vsevolod Vlasov
no flags
Details
Formatted Diff
Diff
Patch
(1.34 KB, patch)
2012-11-01 07:36 PDT
,
Vsevolod Vlasov
no flags
Details
Formatted Diff
Diff
Show Obsolete
(1)
View All
Add attachment
proposed patch, testcase, etc.
Vsevolod Vlasov
Comment 1
2012-11-01 07:35:35 PDT
Created
attachment 171850
[details]
Patch
Vsevolod Vlasov
Comment 2
2012-11-01 07:36:29 PDT
Created
attachment 171851
[details]
Patch
WebKit Review Bot
Comment 3
2012-11-01 09:51:39 PDT
Comment on
attachment 171851
[details]
Patch Clearing flags on attachment: 171851 Committed
r133188
: <
http://trac.webkit.org/changeset/133188
>
WebKit Review Bot
Comment 4
2012-11-01 09:51:42 PDT
All reviewed patches have been landed. Closing bug.
Note
You need to
log in
before you can comment on or make changes to this bug.
Top of Page
Format For Printing
XML
Clone This Bug