Bug 32028 – WebKitGTK generally does not handle WebView being destroyed in a callback

• Status: RESOLVED
• Resolution: WONTFIX
• Component: WebKitGTK

[Grant Gayed]

using WebKitGTK 1.1.16

Steps to reproduce:

- start with the GtkLauncher example
- add: static int counter = 0;
- add to link_hover_cb:
    if (++counter == 3) {
        fprintf(stdout, "destroy it!!\n"); fflush(stdout);
	gtk_widget_destroy(GTK_WIDGET(web_view));
    }
- run it, hover over a couple of links in the initial page, crash

I assume this is happening because WebKitGTK does not check for whether a WebView has been destroyed after sending a signal.  I've confirmed similar problems when destroying a WebView within a callback in at least the following set:

- "create-web-view" crashes
- "hovering-over-link" crashes
- "load-finished" writes: GLib-CRITICAL **: g_hash_table_lookup_extended: assertion `hash_table != NULL' failed
- "notify::progress" crashes
- "notify::title" writes:
     (GtkLauncher:18119): GLib-GObject-WARNING **: instance with invalid (NULL) class pointer
     (GtkLauncher:18119): GLib-GObject-CRITICAL **: g_signal_emit_by_name: assertion `G_TYPE_CHECK_INSTANCE (instance)' failed
- "populate-popup" crashes
- "status-bar-text-changed" crashes

Destroying a widget in a callback is a valid thing to do.  SWT (Eclipse) is keen to make use of WebKitGTK in its Browser widget, but we cannot do so if Browser client callbacks will crash in scenarios like this.  This is why the severity is marked as critical, even though in some other embedding contexts a simple "well, don't do that" might be a valid workaround ;-).

[Grant Gayed]

One more:

- "notify::load-status"
  -> if webkit_web_view_get_load_status (web_view) == WEBKIT_LOAD_COMMITTED then writes:  CRITICAL **: WebKitWebFrame* webkit_web_view_get_main_frame(WebKitWebView*): assertion `WEBKIT_IS_WEB_VIEW(webView)' failed
  -> if the load status is different then it crashes

[Jérémy Lal]

I'm reproducing this easily when calling from gir bindings.
From nodejs, but i suppose it is as easy to reproduce from gjs too.

[Martin Robinson]

Going to close this since it's a WebKit1 bug.