[webkit-changes] [WebKit/WebKit] 34f750: [GTK] UI process crash in gtk_accessible_update_ch...

[Michael Catanzaro]

  Branch: refs/heads/main
  Home:   https://github.com/WebKit/WebKit
  Commit: 34f75014ef7332cc8060d161bfd31e12a6ba49ca
      https://github.com/WebKit/WebKit/commit/34f75014ef7332cc8060d161bfd31e12a6ba49ca
  Author: Michael Catanzaro <mcatanzaro at redhat.com>
  Date:   2024-05-31 (Fri, 31 May 2024)

  Changed paths:
    M Source/WebKit/UIProcess/gtk/WebDataListSuggestionsDropdownGtk.cpp
    M Source/WebKit/UIProcess/ios/WebDataListSuggestionsDropdownIOS.mm

  Log Message:
  -----------
  [GTK] UI process crash in gtk_accessible_update_children
https://bugs.webkit.org/show_bug.cgi?id=274927

Reviewed by Carlos Garcia Campos.

We are failing to unparent the WebDataListSuggestionsDropdownGtk from
the WebKitWebView before finalizing the web view. WebPageProxy calls
WebDataListSuggestionsDropdown::close, but doesn't drop its ref until
WebPageProxy::didCloseSuggestions is called. That happens in
WebDataListSuggestionsDropdown::close, but the GTK implementation fails
to chain up. Oops.

I checked the color chooser and date/time picker widgets, which are
implemented similarly, but didn't find any similar problem. I did notice
that iOS also fails to chain up. It doesn't have this bug since it does
the same work in the subclass instead, but it's surely safest to chain
up here to be robust to future changes. Developers tend to get surprised
when virtual function do not chain up.

* Source/WebKit/UIProcess/gtk/WebDataListSuggestionsDropdownGtk.cpp:
(WebKit::WebDataListSuggestionsDropdownGtk::close):
* Source/WebKit/UIProcess/ios/WebDataListSuggestionsDropdownIOS.mm:
(WebKit::WebDataListSuggestionsDropdownIOS::close):

Canonical link: https://commits.webkit.org/279571@main



To unsubscribe from these emails, change your notification settings at https://github.com/WebKit/WebKit/settings/notifications