WebKit/GTK+ crashes when destroying a WebView that has opened a page containing a <script> tag. Here's how to reproduce it: open GtkLauncher, go to http://google.com/ or the attached test html. If you try to close GtkLauncher now it will crash with segmentation fault. Removing the empty <script> tag from the test HTML is enough to make the crash go away. I have tried this with SVN revision 39434.
WebKit was built using the following configure line:
./configure --prefix=/usr \
It doesn't seem to crash when building with debug disabled. I'm attaching test cases. I'm not really sure this problem is specific to GTK+, I didn't try with other ports, though.
Created attachment 26208 [details]
simple test case
gcc -g -o test-sigsegv test-sigsegv.c `pkg-config --cflags --libs webkit-1.0`
Created attachment 26209 [details]
simple test html
Created attachment 26210 [details]
Created attachment 27531 [details]
fixes the crash
It seems like there is this one condition in which m_group can be made NULL while m_singlePageGroup is left as it is, which causes the ASSERT on initGroup to fail, causing the crash.
Small backtrace of when setGroupName is called with an empty string:
#0 WebCore::Page::setGroupName (this=0x96a4488, name=@0xbf8c3928)
__PRETTY_FUNCTION__ = "void WebCore::Page::setGroupName(const WebCore::String&)"
#1 0xb717d419 in ~Page (this=0x96a4488) at ../../WebCore/page/Page.cpp:158
#2 0xb6dc702b in webkit_web_view_dispose (object=0x96a4828)
webView = (WebKitWebView *) 0x96a4828
priv = (WebKitWebViewPrivate *) 0x96a4870
Comment on attachment 27531 [details]
fixes the crash
Why would we want to clear m_singlePageGroup in this case? If the group name is empty then this item should still be in the single page group, so you wouldn't want to clear it. Also, m_singlePageGroup is an OwnPtr so it will be initialized to 0, so the change to Page is unneeded and hence wrong; we left that out on purpose.
I think the right fix is to set m_group to m_singlePageGroup.get() rather than to 0.
(In reply to comment #6)
> I think the right fix is to set m_group to m_singlePageGroup.get() rather than
> to 0.
OK, that makes sense to me. I'll upload a new patch soon. Do you think a LayoutTest is required for this? I meant to write one, but didn't see it fitting anywhere, and couldn't find a good description, nor a good way to write the test.
Created attachment 27545 [details]
ok, this basically implements what Darin asks for, which also fixes the bug
Comment on attachment 27545 [details]
Landed in r41037.
*** Bug 22024 has been marked as a duplicate of this bug. ***