Bug 210643 - REGRESSION (r162729): [iOS] WebKitTestRunner over-releases UITextField in WTR::PlatformWebView::removeChromeInputField()
Summary: REGRESSION (r162729): [iOS] WebKitTestRunner over-releases UITextField in WTR...
Status: RESOLVED FIXED
Alias: None
Product: WebKit
Classification: Unclassified
Component: Tools / Tests (show other bugs)
Version: WebKit Nightly Build
Hardware: Unspecified Unspecified
: P2 Normal
Assignee: David Kilzer (:ddkilzer)
URL:
Keywords: InRadar
Depends on: 127448
Blocks:
  Show dependency treegraph
 
Reported: 2020-04-17 02:32 PDT by David Kilzer (:ddkilzer)
Modified: 2020-04-17 07:57 PDT (History)
4 users (show)

See Also:


Attachments
Patch v1 (1.28 KB, patch)
2020-04-17 02:38 PDT, David Kilzer (:ddkilzer)
no flags Details | Formatted Diff | Diff

Note You need to log in before you can comment on or make changes to this bug.
Description David Kilzer (:ddkilzer) 2020-04-17 02:32:00 PDT
WebKitTestRunner over-releases UITextField in WTR::PlatformWebView::removeChromeInputField()

This regressed in r162729 for Bug 127448: <https://trac.webkit.org/r162729>

Briefly fixed by r189228 for Bug 189228 before that commit was reverted in r235832 for Bug 189464.

Found by clang static analyzer.

void PlatformWebView::addChromeInputField()
{
    UITextField* textField = [[UITextField alloc] initWithFrame:CGRectMake(0, 0, 100, 20)];
    textField.tag = 1;
    [m_window addSubview:textField];
    [textField release];
}

void PlatformWebView::removeChromeInputField()
{
    UITextField* textField = (UITextField*)[m_window viewWithTag:1];
    if (textField) {
        [textField removeFromSuperview];
        makeWebViewFirstResponder();
        [textField release];  // Over-release.
    }
}

NOTE: This may be the cause of some of the autoreleasePool crashes in WebKitTestRunner that we see occasionally.
Comment 1 Radar WebKit Bug Importer 2020-04-17 02:32:15 PDT
<rdar://problem/61927190>
Comment 2 David Kilzer (:ddkilzer) 2020-04-17 02:38:13 PDT
(In reply to David Kilzer (:ddkilzer) from comment #0)
> NOTE: This may be the cause of some of the autoreleasePool crashes in
> WebKitTestRunner that we see occasionally.

The reason I say that is because this line will return an autoreleased object from UIKit under ARC:

    UITextField* textField = (UITextField*)[m_window viewWithTag:1];

And then the -release call over-releases the object.

But we won't crash until the autoreleasePool containing the UITextField object is drained, which apparently doesn't happen consistently during test runs.
Comment 3 David Kilzer (:ddkilzer) 2020-04-17 02:38:52 PDT
Created attachment 396749 [details]
Patch v1
Comment 4 EWS 2020-04-17 07:57:19 PDT
Committed r260250: <https://trac.webkit.org/changeset/260250>

All reviewed patches have been landed. Closing bug and clearing flags on attachment 396749 [details].