Bug 102192 – [Qt] Crash in PasteboardQt.cpp Pasteboard::writeSelection

• Status: RESOLVED
• Resolution: FIXED
• Component: Platform

[Fabien Vallée]

Tested with Qt 4.8. 
Running layoutTests with child-processes=4, pasteboard related tests (e.g. editing/pasteboard/4944770-2.html) crash (randomly) in Pasteboard::writeSelection.
(it happens when several tests access simultaneously the clipboard).

The crash is at the line :
md->setData(QLatin1String("application/vnd.qtwebkit.smartpaste"), QByteArray());   ( Source/WebCore/platform/qt/PasteboardQt.cpp@134566 )


I believe there is a bug in  Pasteboard::writeSelection. The function logic is :

1) creates a new QMimeData object (raw pointer)
2) set its content (setHtml, ...)
3) gives the QMimeData raw pointer to the QGuiApplication::clipboard() ( QGuiApplication::clipboard()->setMimeData).
4) set the QMimeData data for smartpaste on the raw pointer

Pasteboard::writeSelection lost the ownership on the QMimeData object in step 3), therefore it should not access the object in 4).
Step 4) shall be done before step 3)

The following fix should be enough to fix the issue :

--- a/Source/WebCore/platform/qt/PasteboardQt.cpp
+++ b/Source/WebCore/platform/qt/PasteboardQt.cpp
@@ -74,11 +74,11 @@ void Pasteboard::writeSelection(Range* selectedRange, bool canSmartCopyOrDelete,
     md->setHtml(markup);
 #endif
 
+    if (canSmartCopyOrDelete)
+        md->setData(QLatin1String("application/vnd.qtwebkit.smartpaste"), QByteArray());
 #ifndef QT_NO_CLIPBOARD
     QGuiApplication::clipboard()->setMimeData(md, m_selectionMode ? QClipboard::Selection : QClipboard::Clipboard);
 #endif
-    if (canSmartCopyOrDelete)
-        md->setData(QLatin1String("application/vnd.qtwebkit.smartpaste"), QByteArray());
 }

[Allan Sandfeld Jensen]

I can not trigger the crash, but we have transfered ownership, so the current order must be wrong.

[Allan Sandfeld Jensen]

Created attachment 183797 [details]
Patch

[Jocelyn Turcotte]

Comment on attachment 183797 [details]
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=183797&action=review

Could you do the same modification in Pasteboard::writePlainText as well?

> Source/WebCore/ChangeLog:9
> +        QClipboard::setData transfers ownership of QMimeData to the clipboard,

QClipboard::setMimeData

[Allan Sandfeld Jensen]

Created attachment 183972 [details]
Patch

[Jocelyn Turcotte]

Comment on attachment 183972 [details]
Patch

Overall comments

[WebKit Review Bot]

Comment on attachment 183972 [details]
Patch

Clearing flags on attachment: 183972

Committed r140423: <http://trac.webkit.org/changeset/140423>

[WebKit Review Bot]

All reviewed patches have been landed.  Closing bug.