[webkit-dev] webkit-gtk issue: destroying webview widget directly causes crash.

[Zhe Su]

Hi,
  Recently I encountered a crash issue related to webkit-gtk.  Attached
program will crash when destroying webview widget. The backtrace is:

Program received signal SIGSEGV, Segmentation fault.
webkit_web_view_screen_changed (this=<value optimized out>) at
WebKit/gtk/webkit/webkitwebview.cpp:1624
1624        Settings* settings = core(webView)->settings();
Current language:  auto; currently c++
(gdb) bt
#0  0x000000389ae6fb8b in webkit_web_view_screen_changed (this=<value
optimized out>) from /usr/lib64/libwebkit-1.0.so.2
#1  0x000000388ba0b8ee in IA__g_closure_invoke (closure=0x692770,
return_value=0x0, n_param_values=2, param_values=0x6796d0,
    invocation_hint=0x7fffffffd9b0) at gclosure.c:767
#2  0x000000388ba21f18 in signal_emit_unlocked_R (node=0x65e040,
detail=<value optimized out>, instance=<value optimized out>,
    emission_return=<value optimized out>, instance_and_params=<value
optimized out>) at gsignal.c:3244
#3  0x000000388ba232fe in IA__g_signal_emit_valist (instance=0x690030,
signal_id=<value optimized out>, detail=0, var_args=0x7fffffffdba0)
    at gsignal.c:2977
#4  0x000000388ba23893 in IA__g_signal_emit (instance=0x690030,
signal_id=6488272, detail=0) at gsignal.c:3034
#5  0x000000389343602a in gtk_widget_propagate_hierarchy_changed_recurse
(widget=0x690030, client_data=0x7fffffffdca0) at gtkwidget.c:6185
#6  0x0000003893439a80 in _gtk_widget_propagate_hierarchy_changed
(widget=0x690030, previous_toplevel=0x681090) at gtkwidget.c:6225
#7  0x0000003893443899 in IA__gtk_widget_unparent (widget=0x690030) at
gtkwidget.c:2916
#8  0x000000389327a600 in gtk_bin_remove (container=0x681090,
child=0x6300d0) at gtkbin.c:109
#9  0x000000388ba0b8ee in IA__g_closure_invoke (closure=0x6615d0,
return_value=0x0, n_param_values=2, param_values=0x679800,
    invocation_hint=0x7fffffffdf00) at gclosure.c:767
#10 0x000000388ba21715 in signal_emit_unlocked_R (node=0x661640,
detail=<value optimized out>, instance=<value optimized out>,
    emission_return=<value optimized out>, instance_and_params=<value
optimized out>) at gsignal.c:3174
#11 0x000000388ba232fe in IA__g_signal_emit_valist (instance=0x681090,
signal_id=<value optimized out>, detail=0, var_args=0x7fffffffe0f0)
    at gsignal.c:2977
#12 0x000000388ba23893 in IA__g_signal_emit (instance=0x690030,
signal_id=6488272, detail=0) at gsignal.c:3034
#13 0x000000389343ed85 in gtk_widget_dispose (object=0x690030) at
gtkwidget.c:7898
#14 0x000000388ba0ddd0 in IA__g_object_run_dispose (object=0x690030) at
gobject.c:789
#15 0x0000000000400a23 in main (argc=1, argv=0x7fffffffe308) at webkit.c:12
(gdb)

tested against webkit-gtk 1.1.1. Is it a bug?

Regards
James Su
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.webkit.org/pipermail/webkit-dev/attachments/20090404/8dd4b847/attachment.html>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: webkit.c
Type: application/octet-stream
Size: 388 bytes
Desc: not available
URL: <http://lists.webkit.org/pipermail/webkit-dev/attachments/20090404/8dd4b847/attachment.obj>