Whenever a new WebView is created, WebView::windowAncestryDidChange() is called so that the WebView is added as a WindowMessageListener in the WindowMessageBroadcaster for its top level window. However, we don't remove it from the listener list when the WebView is destroyed. That will leave a stale WebView in the listener list of WindowMessageBroadcaster and can result in a crash later. We should do what we did in the original WebKit: have a WebView::setHostWindow() that calls WebView::windowAncestryDidChange(), and have WebView call setHostWindow(0) when it's destroyed.
Created attachment 57843 [details] Patch Call setHostWindow(0) when the WebView is destroyed, which will call windowAncestryDidChange() and remove this WebView from the WindowMessageBroadcaster's listeners list.
Attachment 57843 [details] did not pass style-queue: Failed to run "['WebKitTools/Scripts/check-webkit-style', '--no-squash']" exit_code: 1 WebKit2/UIProcess/win/WebView.cpp:79: A case label should not be indented, but line up with its switch statement. [whitespace/indent] [4] Total errors found: 1 in 5 files If any of these errors are false positives, please file a bug against check-webkit-style.
Created attachment 57844 [details] Patch - fix the switch case indentation
Comment on attachment 57843 [details] Patch > +void WebView::setHostWindow(HWND hostWindow) > +{ > + if (m_window) { > + if (hostWindow) > + SetParent(m_window, hostWindow); > + else if (!isBeingDestroyed()) { > + // Turn the WebView into a message-only window so it will no longer be a child of the > + // old host window and will be hidden from screen. We only do this when > + // isBeingDestroyed() is false because doing this while handling WM_DESTROY can leave > + // m_viewWindow in a weird state (see <http://webkit.org/b/29337>). > + SetParent(m_window, HWND_MESSAGE); > + } The comment should be updated to say m_window, not m_viewWindow. Let's just bail out early if GetParent(m_window) == hostWindow. (I know WebView doesn't do that, but it seems like a good idea.) I don't think the private set/isBeginDestroyed functions are all that helpful. r=me
Comment on attachment 57844 [details] Patch - fix the switch case indentation Actually, I think it's better to check in your first patch (since it matches the local style).
Fixed in http://trac.webkit.org/changeset/60691