Bug 25759 - [Invalid memory write] HTMLCanvasElement object accessed after deletion
Summary: [Invalid memory write] HTMLCanvasElement object accessed after deletion
Status: RESOLVED FIXED
Alias: None
Product: WebKit
Classification: Unclassified
Component: DOM (show other bugs)
Version: 528+ (Nightly build)
Hardware: PC Windows XP
: P2 Normal
Assignee: Nobody
URL: LayoutTests/fast/canvas/canvas-as-ima...
Keywords:
Depends on:
Blocks:
 
Reported: 2009-05-13 14:06 PDT by Rahul Kuchhal
Modified: 2009-05-13 18:47 PDT (History)
0 users

See Also:


Attachments
Fix invalid memory write seen in HTMLCanvasElement by Valgrind (3.14 KB, patch)
2009-05-13 18:36 PDT, Eric Seidel (no email)
oliver: review+
Details | Formatted Diff | Diff

Note You need to log in before you can comment on or make changes to this bug.
Description Rahul Kuchhal 2009-05-13 14:06:08 PDT
Webkit r43650

Debug Webkit using Safari and open LayoutTests/fast/canvas/canvas-as-image.html in Safari. When the page gets unloaded:

Document.cpp:420 - m_cssCanvasElements.clear();
ends up destroying canvas element

Later when Document gets deleted, CSSCanvasValue::~CSSCanvasValue() gets called which tries to call HTMLCanvasElement::setObserver() on an object that has already been deleted.
Comment 1 Eric Seidel (no email) 2009-05-13 18:34:07 PDT
Scribbled and guarded I'm not able to produce a crash here.

MallocScribble=1 run-webkit-tests --guard LayoutTests/fast/canvas/canvas-as-image.html

But I was able to see this happening in the debugger.

I have a patch to fix this which I'll post shortly.
Comment 2 Eric Seidel (no email) 2009-05-13 18:36:14 PDT
Created attachment 30311 [details]
Fix invalid memory write seen in HTMLCanvasElement by Valgrind

 5 files changed, 31 insertions(+), 4 deletions(-)
Comment 3 Eric Seidel (no email) 2009-05-13 18:47:29 PDT
Committing to http://svn.webkit.org/repository/webkit/trunk ...
	M	WebCore/ChangeLog
	M	WebCore/css/CSSCanvasValue.cpp
	M	WebCore/css/CSSCanvasValue.h
	M	WebCore/html/HTMLCanvasElement.cpp
	M	WebCore/html/HTMLCanvasElement.h
Committed r43678