Bug 151162 - [win] Heap corruption when closing webView
Summary: [win] Heap corruption when closing webView
Status: NEW
Alias: None
Product: WebKit
Classification: Unclassified
Component: WebKit API (show other bugs)
Version: WebKit Nightly Build
Hardware: PC Windows 10
: P2 Normal
Assignee: Nobody
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2015-11-11 16:21 PST by isaac+webkit
Modified: 2016-04-13 16:55 PDT (History)
1 user (show)

See Also:


Attachments
Visual Studio 2015 project and solution which recreates the issue. (4.75 KB, application/zip)
2015-11-11 16:21 PST, isaac+webkit
no flags Details

Note You need to log in before you can comment on or make changes to this bug.
Description isaac+webkit 2015-11-11 16:21:25 PST
Created attachment 265330 [details]
Visual Studio 2015 project and solution which recreates the issue.

The following dialog box is shown when close is called on the webview:

---------------------------
Microsoft Visual C++ Runtime Library
---------------------------
Debug Assertion Failed!

Program: ...tudio 2015\Projects\webkitdebugheap\Debug\webkitdebugheap.exe
File: minkernel\crts\ucrt\src\appcrt\heap\debug_heap.cpp
Line: 892

Expression: is_block_type_valid(header->_block_use)

For information on how your program can cause an assertion
failure, see the Visual C++ documentation on asserts.

(Press Retry to debug the application)

---------------------------
Abort   Retry   Ignore   
---------------------------

The call stack shows that this raised by line 769 of Webkit\win\WebView.cpp with the content of "delete m_page;"

This is against revision 192147 of trunk. 

This is under Microsoft Visual Studio 2015, which was also used to compile webkit.

Attached is a minimal test case. Headers and libraries are assumed to be under C:\deps

The webkit headers were collected from both: $WEBKITBUILD\DerivedSources\ForwardingHeaders\Webkit and $WEBKITBUILD\DerivedSources\Webkit\Interfaces
Comment 1 isaac+webkit 2015-11-17 17:24:23 PST
This also affects minibrowser in the tests directory. (run it, attach debugger and close the minibrowser window).

I.e. it affects *all webviews*, including those attached to host windows.

Turns out the assertion is thrown when m_mutex is destroyed in Hashtable.h (line 493).
The Lock pointer held by the unique_ptr is bad, as shown by the following stack trace:

>	ucrtbased.dll!free_dbg_nolock(void * const block, const int block_use) Line 892	C++
 	ucrtbased.dll!_free_dbg(void * block, int block_use) Line 1011	C++
 	WebKit.dll!operator delete(void * block) Line 17	C++
 	WebKit.dll!operator delete(void * block, unsigned int __formal) Line 15	C++
 	WebKit.dll!std::default_delete<WTF::Lock>::operator()(WTF::Lock * _Ptr) Line 1201	C++
 	WebKit.dll!std::unique_ptr<WTF::Lock,std::default_delete<WTF::Lock> >::~unique_ptr<WTF::Lock,std::default_delete<WTF::Lock> >() Line 1404	C++
 	WebKit.dll!WTF::HashTable<WTF::String,WTF::KeyValuePair<WTF::String,Inspector::SupplementalBackendDispatcher *>,WTF::KeyValuePairKeyExtractor<WTF::KeyValuePair<WTF::String,Inspector::SupplementalBackendDispatcher *> >,WTF::StringHash,WTF::HashMap<WTF::String,Inspector::SupplementalBackendDispatcher *,WTF::StringHash,WTF::HashTraits<WTF::String>,WTF::HashTraits<Inspector::SupplementalBackendDispatcher *> >::KeyValuePairTraits,WTF::HashTraits<WTF::String> >::~HashTable<WTF::String,WTF::KeyValuePair<WTF::String,Inspector::SupplementalBackendDispatcher *>,WTF::KeyValuePairKeyExtractor<WTF::KeyValuePair<WTF::String,Inspector::SupplementalBackendDispatcher *> >,WTF::StringHash,WTF::HashMap<WTF::String,Inspector::SupplementalBackendDispatcher *,WTF::StringHash,WTF::HashTraits<WTF::String>,WTF::HashTraits<Inspector::SupplementalBackendDispatcher *> >::KeyValuePairTraits,WTF::HashTraits<WTF::String> >() Line 362	C++
 	[External Code]	
 	WebKit.dll!WTF::RefCounted<Inspector::BackendDispatcher>::deref() Line 146	C++
 	WebKit.dll!WTF::Ref<Inspector::BackendDispatcher>::~Ref<Inspector::BackendDispatcher>() Line 57	C++
 	WebKit.dll!WebCore::InspectorController::~InspectorController() Line 190	C++
 	[External Code]	
 	WebKit.dll!WebCore::Page::~Page() Line 293	C++
 	[External Code]	
 	WebKit.dll!WebView::close() Line 769	C++
 	webkitdebugheap.exe!WinMain(HINSTANCE__ * hinst, HINSTANCE__ * __formal, char * __formal, int nShowCmd) Line 214	C++
 	[External Code]