Bug 272248 – Crash in WebKit::WebDataListSuggestionPicker::close

• Status: RESOLVED
• Resolution: WORKSFORME
• Component: WebCore Misc.

[Michael Catanzaro]

Created attachment 470776 [details]
Full backtrace

I'm not able to reproduce this, but here's a crash that occurred after clicking Back from https://www.brother-usa.com/home to https://pwg.org/printers/. Looks like I must have had a search input focused, but that's not sufficient to make it crash.

#0  WebKit::WebPage::identifier (this=0x0) at /buildstream/gnome/sdk/webkitgtk-6.0.bst/Source/WebKit/WebProcess/WebPage/WebPage.h:439
#1  WebKit::WebDataListSuggestionPicker::close (this=0x7fb0229a5460)
    at /buildstream/gnome/sdk/webkitgtk-6.0.bst/Source/WebKit/WebProcess/WebCoreSupport/WebDataListSuggestionPicker.cpp:62
#2  0x00007fb03bb3ea27 in WebCore::TextFieldInputType::closeSuggestions (this=0x7fb0222c8400)
    at /buildstream/gnome/sdk/webkitgtk-6.0.bst/Source/WebCore/html/TextFieldInputType.cpp:1012
#3  WebCore::TextFieldInputType::~TextFieldInputType (this=0x7fb0222c8400)
    at /buildstream/gnome/sdk/webkitgtk-6.0.bst/Source/WebCore/html/TextFieldInputType.cpp:87
#4  0x00007fb03bb366fe in WebCore::SearchInputType::~SearchInputType (this=0x7fb0222c8400)
    at /buildstream/gnome/sdk/webkitgtk-6.0.bst/Source/WebCore/html/SearchInputType.h:41
#5  WebCore::SearchInputType::~SearchInputType (this=0x7fb0222c8400) at /buildstream/gnome/sdk/webkitgtk-6.0.bst/Source/WebCore/html/SearchInputType.h:41
#6  0x00007fb03ba72a1f in std::default_delete<WebCore::InputType>::operator() (__ptr=0x7fb0229a5460, this=<optimized out>)
    at /usr/bin/../lib/gcc/x86_64-unknown-linux-gnu/13.2.0/../../../../include/c++/13.2.0/bits/unique_ptr.h:99
#7  WTF::RefCounted<WebCore::InputType, std::default_delete<WebCore::InputType> >::deref (this=0x7fb0229a5468) at WTF/Headers/wtf/RefCounted.h:220
#8  WTF::DefaultRefDerefTraits<WebCore::InputType>::derefIfNotNull (ptr=0x7fb0229a5460) at WTF/Headers/wtf/Ref.h:62
#9  WTF::RefPtr<WebCore::InputType, WTF::RawPtrTraits<WebCore::InputType>, WTF::DefaultRefDerefTraits<WebCore::InputType> >::~RefPtr (this=0x7f97be010c58)
    at WTF/Headers/wtf/RefPtr.h:60
#10 WebCore::HTMLInputElement::~HTMLInputElement (this=0x7f97be010b60)
    at /buildstream/gnome/sdk/webkitgtk-6.0.bst/Source/WebCore/html/HTMLInputElement.cpp:158

Full backtrace attached.

[Michael Catanzaro]

OK, found a reproducer and it's very simple. Visit https://pwg.org/printers/, click on the "Make, model, etc." search entry, press Ctrl+W to close the page. It will crash.

[Michael Catanzaro]

Well the problem seems clear enough. Since 272284@main WebDataListSuggestionPicker keeps a WeakRef<WebPage> m_page, expecting it to become nullptr. But everywhere it uses m_page, it assumes that it will never be nullptr. This is inconsistent.

[Alexey Proskuryakov]

FWIW, the crash doesn't reproduce in Safari. Perhaps we just destroy the process without running the destructors?

[Michael Catanzaro]

(In reply to Alexey Proskuryakov from comment #3)
> FWIW, the crash doesn't reproduce in Safari. Perhaps we just destroy the
> process without running the destructors?

Doubt it. You have to fire event handlers when the page is closed, for example. Probably something else is different.

The weak pointer misuse is a cross-platform issue and looks easy to fix. The only challenge here will be figuring out if this is testable and writing a test if so.

[Michael Catanzaro]

(Well, I'm also uncomfortable with the WebPage itself being destroyed while JS code is still executing. But that's apparently expected.)

[Radar WebKit Bug Importer]

<rdar://problem/126374998>

[Michael Catanzaro]

It's no longer possible to reproduce this due to bug #274927, a UI process crash that occurs first.

[Michael Catanzaro]

After fixing that crash, I still can't reproduce this, so I'm going to assume it is fixed and not worth investigating further.