Bug 52569 - [Qt][WK2] Crash due to double destruction of QSharedMemory
Summary: [Qt][WK2] Crash due to double destruction of QSharedMemory
Alias: None
Product: WebKit
Classification: Unclassified
Component: WebKit2 (show other bugs)
Version: 528+ (Nightly build)
Hardware: PC All
: P2 Normal
Assignee: Nobody
Depends on:
Reported: 2011-01-17 04:59 PST by Balazs Kelemen
Modified: 2011-01-17 05:29 PST (History)
0 users

See Also:

Patch (3.29 KB, patch)
2011-01-17 05:06 PST, Balazs Kelemen
no flags Details | Formatted Diff | Diff

Note You need to log in before you can comment on or make changes to this bug.
Description Balazs Kelemen 2011-01-17 04:59:40 PST
Some layout tests are crashing because of a bug associated with the CleanupHandler.
For example fast/forms/form-associated-element-crash.html produce the following backtrace:
Program received signal SIGSEGV, Segmentation fault.
0x080c9f50 in ?? ()
(gdb) bt 10
#0  0x080c9f50 in ?? ()
#1  0xb70e3925 in WTF::RefCounted<WebKit::SharedMemory>::deref (this=0x80ef9e8) at ../../../../Source/JavaScriptCore/wtf/RefCounted.h:139
#2  0xb70e3961 in WTF::derefIfNotNull<WebKit::SharedMemory> (ptr=0x80ef9e8) at ../../../../Source/JavaScriptCore/wtf/PassRefPtr.h:59
#3  0xb70e39ad in WTF::RefPtr<WebKit::SharedMemory>::~RefPtr (this=0x80ccee8, __in_chrg=<value optimized out>)
    at ../../../../Source/JavaScriptCore/wtf/RefPtr.h:57
#4  0xb70f6097 in WebKit::VisitedLinkTable::~VisitedLinkTable (this=0x80ccee8, __in_chrg=<value optimized out>)
    at ../../../../Source/WebKit2/Shared/VisitedLinkTable.cpp:42
#5  0xb714a50a in WebKit::VisitedLinkProvider::~VisitedLinkProvider (this=0x80cced8, __in_chrg=<value optimized out>)
    at ../../../../Source/WebKit2/UIProcess/VisitedLinkProvider.h:40
#6  0xb7140dd5 in WebKit::WebContext::~WebContext (this=0x80cce70, __in_chrg=<value optimized out>)
    at ../../../../Source/WebKit2/UIProcess/WebContext.cpp:120

This is the symptom of deleting the QSharedMemory twice.
The following happens in this scenario in time oriented order:
1. QApplication stopping =>
2. CleanupHandler deletes the QSharedMemory in the slot connected to QApplication::aboutToQuit
3. Destructor of SharedMemory is reached through the destruction of the TestController.

The code that was preventing from this behavior was removed by http://trac.webkit.org/changeset/74967 because of my wrong assumption that
it is not needed anymore.
Comment 1 Balazs Kelemen 2011-01-17 05:06:44 PST
Created attachment 79158 [details]
Comment 2 Andreas Kling 2011-01-17 05:23:31 PST
Comment on attachment 79158 [details]

Comment 3 Balazs Kelemen 2011-01-17 05:29:04 PST
Comment on attachment 79158 [details]

Clearing flags on attachment: 79158

Committed r75935: <http://trac.webkit.org/changeset/75935>
Comment 4 Balazs Kelemen 2011-01-17 05:29:12 PST
All reviewed patches have been landed.  Closing bug.