Bug 25045 – [GTK] Plugins with missing NPAPI callbacks crash WebKit

• Status: RESOLVED
• Resolution: WONTFIX
• Component: WebKitGTK

[James Su]

webkit gtk crashed when destroying a webview wich is loading a flash. The backtrace is:

(gdb) bt
#0  0x0000000000000000 in ?? ()
#1  0x00007fffedab2ed1 in WebCore::NetscapePlugInStreamLoader::didFinishLoading (this=0x7fffe82ffa00) at WebCore/loader/NetscapePlugInStreamLoader.cpp:103
#2  0x00007fffedab5361 in WebCore::ResourceLoader::didCancel (this=0x7fffe82ffa00, error=@0x7fffffffc7c0) at WebCore/loader/ResourceLoader.cpp:338
#3  0x00007fffedab2dc3 in WebCore::NetscapePlugInStreamLoader::didCancel (this=0x7fffe82ffa00, error=@0x7fffffffc7c0)
    at WebCore/loader/NetscapePlugInStreamLoader.cpp:127
#4  0x00007fffedab6416 in WebCore::ResourceLoader::cancel (this=0x7fffe82ffa00, error=<value optimized out>) at WebCore/loader/ResourceLoader.cpp:359
#5  0x00007fffedab61e4 in WebCore::ResourceLoader::cancel (this=0x7fffe82ff500) at WebCore/loader/ResourceLoader.cpp:349
#6  0x00007fffeda83b35 in WebCore::cancelAll (loaders=<value optimized out>) at WebCore/loader/DocumentLoader.cpp:127
#7  0x00007fffeda83c3f in WebCore::DocumentLoader::stopLoadingPlugIns (this=<value optimized out>, this=<value optimized out>) at WebCore/loader/DocumentLoader.cpp:744
#8  WebCore::DocumentLoader::stopLoading (this=<value optimized out>, this=<value optimized out>) at WebCore/loader/DocumentLoader.cpp:324
#9  0x00007fffeda98a30 in WebCore::FrameLoader::stopAllLoaders (this=0x7fffe81a9050) at WebCore/loader/FrameLoader.cpp:2673
#10 0x00007fffed800f1c in webkit_web_view_dispose (object=0x78dc10) at WebKit/gtk/webkit/webkitwebview.cpp:830
#11 0x000000388ba0ddd0 in IA__g_object_run_dispose (object=0x78dc10) at gobject.c:789
#12 0x00000038932eafa8 in gtk_fixed_forall (container=<value optimized out>, include_internals=<value optimized out>, callback=0x389343efd0 <IA__gtk_widget_destroy>, 
    callback_data=0x0) at gtkfixed.c:449
#13 0x00000038932acdb9 in gtk_container_destroy (object=0x8140c0) at gtkcontainer.c:1066

Test environment: Fedora rawhide 64bit, webkit gtk 1.1.1

[Jan Alonzo]

Hi James, Can you please try with 1.1.8 and a recent flash plugin 64-bit from Adobe? I'm currently using ToT + the 64-bit plugin and it works fine here.

[Jean Brefort]

Created attachment 42085 [details]
fixes this and analog crashes

Some plugins seem to not implement all functions. This might be considered as a bug in the plugin, but anyway webkit should not crash.
This might occur for plugins which load data only from temporary files (such plugins might not work anyway with webkit because of #19012).

[Nicolas Dufresne]

(In reply to comment #2)
> Created an attachment (id=42085) [details]
> fixes this and analog crashes
> 
> Some plugins seem to not implement all functions. This might be considered as a bug in the plugin, but anyway webkit should not crash.
> This might occur for plugins which load data only from temporary files (such plugins might not work anyway with webkit because of #19012).

I think adding stub functions would be better instead, would keep the code more readable.

[Martin Robinson]

Nicolas, are you going to tackle this one?

[Nicolas Dufresne]

(In reply to comment #4)
> Nicolas, are you going to tackle this one?

This is not my first priority at the moment, but I planned to do so eventually. This also need unit testing I think.

[Martin Robinson]

Probably should be re-approached from the WebKit2 perspective.