Bug 189199 – Assertion hit in ~CompletionHandler() from ~WebFrame()

• Status: RESOLVED
• Resolution: FIXED
• Component: WebKit2

[Chris Dumez]

Assertion hit in ~CompletionHandler() from ~WebFrame():
Thread 0 Crashed:: Dispatch queue: com.apple.main-thread
0   com.apple.JavaScriptCore      	0x00000005e8d9bdb0 WTFCrash + 16 (Assertions.cpp:267)
1   com.apple.WebCore             	0x00000005d8b1de83 WTF::CompletionHandler<void ()>::~CompletionHandler() + 115 (CompletionHandler.h:51)
2   com.apple.WebCore             	0x00000005d8b1d6e5 WTF::CompletionHandler<void ()>::~CompletionHandler() + 21 (CompletionHandler.h:52)
3   com.apple.WebCore             	0x00000005da8251f1 WTF::Function<void ()>::CallableWrapper<WTF::CompletionHandler<void ()> >::~CallableWrapper() + 49 (Function.h:91)
4   com.apple.WebCore             	0x00000005da825165 WTF::Function<void ()>::CallableWrapper<WTF::CompletionHandler<void ()> >::~CallableWrapper() + 21 (Function.h:91)
5   com.apple.WebCore             	0x00000005da825189 WTF::Function<void ()>::CallableWrapper<WTF::CompletionHandler<void ()> >::~CallableWrapper() + 25 (Function.h:91)
6   com.apple.WebKit              	0x000000010862319f WTF::Function<void ()>::~Function() + 175 (memory:2598)
7   com.apple.WebKit              	0x0000000108622235 WTF::Function<void ()>::~Function() + 21 (Function.h:33)
8   com.apple.WebKit              	0x00000001086a9a79 WTF::KeyValuePair<unsigned long long, WTF::Function<void ()> >::~KeyValuePair() + 25 (KeyValuePair.h:33)
9   com.apple.WebKit              	0x00000001086a9a45 WTF::KeyValuePair<unsigned long long, WTF::Function<void ()> >::~KeyValuePair() + 21 (KeyValuePair.h:33)
10  com.apple.WebKit              	0x00000001086a99da WTF::HashTable<unsigned long long, WTF::KeyValuePair<unsigned long long, WTF::Function<void ()> >, WTF::KeyValuePairKeyExtractor<WTF::KeyValuePair<unsigned long long, WTF::Function<void ()> > >, WTF::IntHash<unsigned long long>, WTF::HashMap<unsigned long long, WTF::Function<void ()>, WTF::IntHash<unsigned long long>, WTF::HashTraits<unsigned long long>, WTF::HashTraits<WTF::Function<void ()> > >::KeyValuePairTraits, WTF::HashTraits<unsigned long long> >::deallocateTable(WTF::KeyValuePair<unsigned long long, WTF::Function<void ()> >*, unsigned int) + 90 (HashTable.h:1159)
11  com.apple.WebKit              	0x00000001086a97c9 WTF::HashTable<unsigned long long, WTF::KeyValuePair<unsigned long long, WTF::Function<void ()> >, WTF::KeyValuePairKeyExtractor<WTF::KeyValuePair<unsigned long long, WTF::Function<void ()> > >, WTF::IntHash<unsigned long long>, WTF::HashMap<unsigned long long, WTF::Function<void ()>, WTF::IntHash<unsigned long long>, WTF::HashTraits<unsigned long long>, WTF::HashTraits<WTF::Function<void ()> > >::KeyValuePairTraits, WTF::HashTraits<unsigned long long> >::~HashTable() + 57
12  com.apple.WebKit              	0x00000001086a9785 WTF::HashTable<unsigned long long, WTF::KeyValuePair<unsigned long long, WTF::Function<void ()> >, WTF::KeyValuePairKeyExtractor<WTF::KeyValuePair<unsigned long long, WTF::Function<void ()> > >, WTF::IntHash<unsigned long long>, WTF::HashMap<unsigned long long, WTF::Function<void ()>, WTF::IntHash<unsigned long long>, WTF::HashTraits<unsigned long long>, WTF::HashTraits<WTF::Function<void ()> > >::KeyValuePairTraits, WTF::HashTraits<unsigned long long> >::~HashTable() + 21 (HashTable.h:365)
13  com.apple.WebKit              	0x00000001086a9765 WTF::HashMap<unsigned long long, WTF::Function<void ()>, WTF::IntHash<unsigned long long>, WTF::HashTraits<unsigned long long>, WTF::HashTraits<WTF::Function<void ()> > >::~HashMap() + 21 (HashMap.h:36)
14  com.apple.WebKit              	0x000000010869b7e5 WTF::HashMap<unsigned long long, WTF::Function<void ()>, WTF::IntHash<unsigned long long>, WTF::HashTraits<unsigned long long>, WTF::HashTraits<WTF::Function<void ()> > >::~HashMap() + 21 (HashMap.h:36)
15  com.apple.WebKit              	0x00000001094971ef WebKit::WebFrame::~WebFrame() + 335 (WebFrame.cpp:169)

[Chris Dumez]

<rdar://problem/42657233>

[Chris Dumez]

Created attachment 348649 [details]
Patch

[youenn fablet]

Comment on attachment 348649 [details]
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=348649&action=review

> Source/WebCore/loader/EmptyClients.cpp:461
> +void EmptyFrameLoaderClient::dispatchWillSubmitForm(FormState&, CompletionHandler<void(void)>&& completionHandler)

s/void(void)/void()/ here and below?

> Source/WebKit/WebProcess/WebPage/WebFrame.cpp:252
> +        completionHandler();

Should we be safe here and move m_willSubmitFormCompletionHandlers.values in a local variable as well.
Then no need to clear it anymore below.

[Chris Dumez]

Created attachment 348652 [details]
Patch

[Alex Christensen]

Comment on attachment 348652 [details]
Patch

Hooray!  CompletionHandlers found and fixed a loading bug!

[WebKit Commit Bot]

Comment on attachment 348652 [details]
Patch

Clearing flags on attachment: 348652

Committed r235562: <https://trac.webkit.org/changeset/235562>

[WebKit Commit Bot]

All reviewed patches have been landed.  Closing bug.

[Ryan Haddad]

This change broke the Windows build:
C:\cygwin\home\buildbot\slave\win-release\build\Source\WebKitLegacy\win\WebCoreSupport\WebFrameLoaderClient.cpp(626): error C3848: expression having type 'const WTF::CompletionHandler<void (void)>' would lose some const-volatile qualifiers in order to call 'void WTF::CompletionHandler<void (void)>::operator ()(void)' [C:\cygwin\home\buildbot\slave\win-release\build\WebKitBuild\Release\Source\WebKitLegacy\WebKitLegacy.vcxproj]

https://build.webkit.org/builders/Apple%20Win%20Release%20%28Build%29/builds/11591/steps/compile-webkit/logs/stdio

[Chris Dumez]

(In reply to Ryan Haddad from comment #8)
> This change broke the Windows build:
> C:\cygwin\home\buildbot\slave\win-
> release\build\Source\WebKitLegacy\win\WebCoreSupport\WebFrameLoaderClient.
> cpp(626): error C3848: expression having type 'const
> WTF::CompletionHandler<void (void)>' would lose some const-volatile
> qualifiers in order to call 'void WTF::CompletionHandler<void
> (void)>::operator ()(void)'
> [C:\cygwin\home\buildbot\slave\win-
> release\build\WebKitBuild\Release\Source\WebKitLegacy\WebKitLegacy.vcxproj]
> 
> https://build.webkit.org/builders/Apple%20Win%20Release%20%28Build%29/builds/
> 11591/steps/compile-webkit/logs/stdio

Thanks, will fix now.

[Chris Dumez]

(In reply to Chris Dumez from comment #9)
> (In reply to Ryan Haddad from comment #8)
> > This change broke the Windows build:
> > C:\cygwin\home\buildbot\slave\win-
> > release\build\Source\WebKitLegacy\win\WebCoreSupport\WebFrameLoaderClient.
> > cpp(626): error C3848: expression having type 'const
> > WTF::CompletionHandler<void (void)>' would lose some const-volatile
> > qualifiers in order to call 'void WTF::CompletionHandler<void
> > (void)>::operator ()(void)'
> > [C:\cygwin\home\buildbot\slave\win-
> > release\build\WebKitBuild\Release\Source\WebKitLegacy\WebKitLegacy.vcxproj]
> > 
> > https://build.webkit.org/builders/Apple%20Win%20Release%20%28Build%29/builds/
> > 11591/steps/compile-webkit/logs/stdio
> 
> Thanks, will fix now.

Should be fixed as of  <https://trac.webkit.org/changeset/235566>.