Changeset 192880 in webkit

Timestamp:

Dec 1, 2015 4:23:34 AM (8 years ago)

Author:

Carlos Garcia Campos

Message:

[GTK] ASSERTION FAILED: m_table running /webkit2/BackForwardList/navigation in Debug build
​https://bugs.webkit.org/show_bug.cgi?id=151700

Reviewed by Martin Robinson.

This happens when the frame notifies its observers that the page
will be detached. The m_table that asserts is the
FrameDestructionObserver HashSet. It happens when clearing the
GObject DOM cache wrappers during frame destruction, and there's a
Document object wrapped whose last reference is held by the DOM
wrapper. In that case, the Document object is destroyed while the
frame is being destroyed. Deleting the wrapper objects after the
frame destruction fixes the crash.

• bindings/gobject/DOMObjectCache.cpp:

Location:

trunk/Source/WebCore

Files:

• ChangeLog (modified) (1 diff)
• bindings/gobject/DOMObjectCache.cpp (modified) (1 diff)

trunk/Source/WebCore/ChangeLog

@@ +1 @@
+2015-12-01  Carlos Garcia Campos  <cgarcia@igalia.com>
+
+        [GTK] ASSERTION FAILED: m_table running /webkit2/BackForwardList/navigation in Debug build
+        https://bugs.webkit.org/show_bug.cgi?id=151700
+
+        Reviewed by Martin Robinson.
+
+        This happens when the frame notifies its observers that the page
+        will be detached. The m_table that asserts is the
+        FrameDestructionObserver HashSet. It happens when clearing the
+        GObject DOM cache wrappers during frame destruction, and there's a
+        Document object wrapped whose last reference is held by the DOM
+        wrapper. In that case, the Document object is destroyed while the
+        frame is being destroyed. Deleting the wrapper objects after the
+        frame destruction fixes the crash.
+
+        * bindings/gobject/DOMObjectCache.cpp:
+
 2015-12-01  Youenn Fablet  <youenn.fablet@crf.canon.fr>
 

trunk/Source/WebCore/bindings/gobject/DOMObjectCache.cpp

@@ -156 +156 @@
 
         auto objects = WTF::move(m_objects);
-        for (auto* data : objects) {
+
+        // Deleting of DOM wrappers might end up deleting the wrapped core object which could cause some problems
+        // for example if a Document is deleted during the frame destruction, so we remove the weak references now
+        // and delete the objects on next run loop iteration. See https://bugs.webkit.org/show_bug.cgi?id=151700.
+        for (auto* data : objects)
             g_object_weak_unref(data->object, DOMObjectCacheFrameObserver::objectFinalizedCallback, this);
-            data->clearObject();
-        }
+
+        RunLoop::main().dispatch([objects] {
+            for (auto* data : objects)
+                data->clearObject();
+        });
     }