Bug 160229 – [GTK] ASSERTION FAILED: !m_adoptionIsRequired when Inspector Server is connected

• Status: RESOLVED
• Resolution: FIXED
• Component: WebKitGTK

[Fujii Hironori]

[GTK] ASSERTION FAILED: !m_adoptionIsRequired when Inspector Server is connected

trunk@203718

1) ./Tools/Scripts/build-webkit --gtk --debug --64-bit
2) export WEBKIT_INSPECTOR_SERVER=127.0.0.1:2999
3) ./Tools/Scripts/run-minibrowser --gtk --debug
4) Open http://127.0.0.1:2999/ in other browser
5) ASSERTION FAILED in UI process

ASSERTION FAILED: !m_adoptionIsRequired


> #0  0x00007ff15526fc53 in WTFCrash () at ../../Source/WTF/wtf/Assertions.cpp:323
> #1  0x00007ff15d84515a in WTF::RefCountedBase::ref (this=0x7ff13e7ef804) at ../../Source/WTF/wtf/RefCounted.h:44
> #2  0x00007ff15f639e97 in WTF::refIfNotNull<WebCore::SocketStreamHandle> (ptr=0x7ff13e7ef780) at ../../Source/WTF/wtf/PassRefPtr.h:34
> #3  0x00007ff15f639ac7 in WTF::RefPtr<WebCore::SocketStreamHandle>::RefPtr (this=0x7ffeef1b33d0, ptr=0x7ff13e7ef780)
>     at ../../Source/WTF/wtf/RefPtr.h:46
> #4  0x00007ff15f638a3e in (anonymous namespace)::SocketStreamHandle::connected(<unknown type in /home/fujii/work/webkit/w1/WebKitBuild/Debug/lib/libwebkit2gtk-4.0.so.37, CU 0x0, DIE 0x1535d>) (this=0x7ff13e7ef780, 
>     socketConnection=<unknown type in /home/fujii/work/webkit/w1/WebKitBuild/Debug/lib/libwebkit2gtk-4.0.so.37, CU 0x0, DIE 0x1535d>)
>     at ../../Source/WebCore/platform/network/soup/SocketStreamHandleSoup.cpp:88
> #5  0x00007ff15f63874b in (anonymous namespace)::SocketStreamHandle::SocketStreamHandle (this=0x7ff13e7ef780, 
>     socketConnection=0x105a600, client=...) at ../../Source/WebCore/platform/network/soup/SocketStreamHandleSoup.cpp:73
> #6  0x00007ff15ddced37 in (anonymous namespace)::SocketStreamHandle::create (socketConnection=0x105a600, client=...)
>     at ../../Source/WebCore/platform/network/soup/SocketStreamHandle.h:53
> #7  0x00007ff15ddce950 in (anonymous namespace)::connectionCallback (connection=0x105a600, server=0xf3a9e0)
>     at ../../Source/WebKit2/UIProcess/InspectorServer/soup/WebSocketServerSoup.cpp:50
> #8  0x00007ff14975cc58 in ffi_call_unix64 () from /lib64/libffi.so.6
> #9  0x00007ff14975c6ba in ffi_call () from /lib64/libffi.so.6
> #10 0x00007ff156afb38e in g_cclosure_marshal_generic ()
>    from /home/fujii/work/webkit/w1/WebKitBuild/DependenciesGTK/Root/lib/libgobject-2.0.so.0
> #11 0x00007ff156af9c72 in g_closure_invoke () from /home/fujii/work/webkit/w1/WebKitBuild/DependenciesGTK/Root/lib/libgobject-2.0.so.0
> #12 0x00007ff156b15842 in signal_emit_unlocked_R ()
>    from /home/fujii/work/webkit/w1/WebKitBuild/DependenciesGTK/Root/lib/libgobject-2.0.so.0
> #13 0x00007ff156b14c26 in g_signal_emit_valist ()
>    from /home/fujii/work/webkit/w1/WebKitBuild/DependenciesGTK/Root/lib/libgobject-2.0.so.0
> #14 0x00007ff156b150d2 in g_signal_emit () from /home/fujii/work/webkit/w1/WebKitBuild/DependenciesGTK/Root/lib/libgobject-2.0.so.0
> #15 0x00007ff156dddd41 in g_socket_service_incoming ()
>    from /home/fujii/work/webkit/w1/WebKitBuild/DependenciesGTK/Root/lib/libgio-2.0.so.0
> #16 0x00007ff156dddea8 in g_socket_service_ready ()
>    from /home/fujii/work/webkit/w1/WebKitBuild/DependenciesGTK/Root/lib/libgio-2.0.so.0
> #17 0x00007ff156ddfbd7 in g_task_return_now () from /home/fujii/work/webkit/w1/WebKitBuild/DependenciesGTK/Root/lib/libgio-2.0.so.0
> #18 0x00007ff156ddfcdf in g_task_return () from /home/fujii/work/webkit/w1/WebKitBuild/DependenciesGTK/Root/lib/libgio-2.0.so.0
> #19 0x00007ff156de049c in g_task_return_pointer () from /home/fujii/work/webkit/w1/WebKitBuild/DependenciesGTK/Root/lib/libgio-2.0.so.0
> #20 0x00007ff156dd8607 in accept_ready () from /home/fujii/work/webkit/w1/WebKitBuild/DependenciesGTK/Root/lib/libgio-2.0.so.0
> #21 0x00007ff156dcf693 in socket_source_dispatch ()
>    from /home/fujii/work/webkit/w1/WebKitBuild/DependenciesGTK/Root/lib/libgio-2.0.so.0
> #22 0x00007ff1567d95f7 in g_main_dispatch () from /home/fujii/work/webkit/w1/WebKitBuild/DependenciesGTK/Root/lib/libglib-2.0.so.0
> #23 0x00007ff1567da42e in g_main_context_dispatch ()
>    from /home/fujii/work/webkit/w1/WebKitBuild/DependenciesGTK/Root/lib/libglib-2.0.so.0
> #24 0x00007ff1567da612 in g_main_context_iterate ()
>    from /home/fujii/work/webkit/w1/WebKitBuild/DependenciesGTK/Root/lib/libglib-2.0.so.0
> #25 0x00007ff1567daa38 in g_main_loop_run () from /home/fujii/work/webkit/w1/WebKitBuild/DependenciesGTK/Root/lib/libglib-2.0.so.0
> #26 0x00007ff1584b4f5f in gtk_main () from /home/fujii/work/webkit/w1/WebKitBuild/DependenciesGTK/Root/lib/libgtk-3.so.0
> #27 0x0000000000416496 in main (argc=1, argv=0x7ffeef1b4218) at ../../Tools/MiniBrowser/gtk/main.c:326

[Fujii Hironori]

Soup port has two types of SocketStreamHandle constructor:

a) SocketStreamHandle::SocketStreamHandle(const URL& url, SocketStreamHandleClient& client)
b) SocketStreamHandle::SocketStreamHandle(GSocketConnection* socketConnection, SocketStreamHandleClient& client)

(a) does relaxAdoptionRequirement(), but (b) does not.
WebSocketServerSoup uses (b).

[Fujii Hironori]

Created attachment 284672 [details]
Patch

[Carlos Garcia Campos]

Comment on attachment 284672 [details]
Patch

Thanks! It was not obvious because the ref happens in connected and not in the constructor (but called from the constructor in any case).

[WebKit Commit Bot]

Comment on attachment 284672 [details]
Patch

Clearing flags on attachment: 284672

Committed r203762: <http://trac.webkit.org/changeset/203762>

[WebKit Commit Bot]

All reviewed patches have been landed.  Closing bug.

[Darin Adler]

Comment on attachment 284672 [details]
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=284672&action=review

> Source/WebCore/ChangeLog:11
> +        An assertion fails because refcount of SocketStreamHandle is
> +        incremented before adoptRef, in the constructor of
> +        SocketStreamHandle.  The constructor of SocketStreamHandle needs
> +        to increment recount because it passes this pointer to libsoup.

This is an incorrect solution; relaxAdoptionRequirement should *not* be used here. The correct solution is to make the constructor private and make a public creation function which does the rest of the job of initializing the object, *after* the constructor has run and we have the object pointer inside a Ref already.

[Darin Adler]

The same should be done for both constructors.

[Fujii Hironori]

(In reply to comment #6)

Thank you so much. I will fix in another bug:

  Bug 160281 – [soup] Incorrect usage of relaxAdoptionRequirement in the constructor of SocketStreamHandle