Changeset 192792 in webkit

Timestamp:

Nov 30, 2015 1:39:49 AM (8 years ago)

Author:

Carlos Garcia Campos

Message:

[GTK] UI process crash when the screensaver DBus proxy is being created while the web view is destroyed
​https://bugs.webkit.org/show_bug.cgi?id=151653

Reviewed by Martin Robinson.

We correctly cancel the proxy creation, but when the async ready
callback is called, the view could be destroyed already. In that
case g_dbus_proxy_new_for_bus_finish() will return nullptr and
fail with cancelled error, but we are using the passed web view
without checking first if the creation failed or not.

• UIProcess/API/gtk/WebKitWebViewBase.cpp:

(screenSaverProxyCreatedCallback):

Location:

trunk/Source/WebKit2

Files:

• ChangeLog (modified) (1 diff)
• UIProcess/API/gtk/WebKitWebViewBase.cpp (modified) (1 diff)

trunk/Source/WebKit2/ChangeLog

@@ +1 @@
+2015-11-30  Carlos Garcia Campos  <cgarcia@igalia.com>
+
+        [GTK] UI process crash when the screensaver DBus proxy is being created while the web view is destroyed
+        https://bugs.webkit.org/show_bug.cgi?id=151653
+
+        Reviewed by Martin Robinson.
+
+        We correctly cancel the proxy creation, but when the async ready
+        callback is called, the view could be destroyed already. In that
+        case g_dbus_proxy_new_for_bus_finish() will return nullptr and
+        fail with cancelled error, but we are using the passed web view
+        without checking first if the creation failed or not.
+
+        * UIProcess/API/gtk/WebKitWebViewBase.cpp:
+        (screenSaverProxyCreatedCallback):
+
 2015-11-28  Tim Horton  <timothy_horton@apple.com>
 

trunk/Source/WebKit2/UIProcess/API/gtk/WebKitWebViewBase.cpp

@@ -1171 +1171 @@
 static void screenSaverProxyCreatedCallback(GObject*, GAsyncResult* result, WebKitWebViewBase* webViewBase)
 {
-    WebKitWebViewBasePrivate* priv = webViewBase->priv;
-    priv->screenSaverProxy = adoptGRef(g_dbus_proxy_new_for_bus_finish(result, nullptr));
-    if (!priv->screenSaverProxy)
-        return;
-
+    // WebKitWebViewBase cancels the proxy creation on dispose, which means this could be called
+    // after the web view has been destroyed and g_dbus_proxy_new_for_bus_finish will return nullptr.
+    // So, make sure we don't use the web view unless we have a valid proxy.
+    // See https://bugs.webkit.org/show_bug.cgi?id=151653.
+    GRefPtr<GDBusProxy> proxy = adoptGRef(g_dbus_proxy_new_for_bus_finish(result, nullptr));
+    if (!proxy)
+        return;
+
+    webViewBase->priv->screenSaverProxy = proxy;
     webkitWebViewBaseSendInhibitMessageToScreenSaver(webViewBase);
 }