[Webkit-unassigned] [Bug 151162] New: [win] Heap corruption when closing webView not associated with a window

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=151162

            Bug ID: 151162
           Summary: [win] Heap corruption when closing webView not
                    associated with a window
    Classification: Unclassified
           Product: WebKit
           Version: WebKit Nightly Build
          Hardware: PC
                OS: Windows 10
            Status: NEW
          Severity: Normal
          Priority: P2
         Component: WebKit API
          Assignee: webkit-unassigned at lists.webkit.org
          Reporter: isaac+webkit at devinesystems.co.nz

Created attachment 265330
  --> https://bugs.webkit.org/attachment.cgi?id=265330&action=review
Visual Studio 2015 project and solution which recreates the issue.

The following dialog box is shown when close is called on the webview:

---------------------------
Microsoft Visual C++ Runtime Library
---------------------------
Debug Assertion Failed!

Program: ...tudio 2015\Projects\webkitdebugheap\Debug\webkitdebugheap.exe
File: minkernel\crts\ucrt\src\appcrt\heap\debug_heap.cpp
Line: 892

Expression: is_block_type_valid(header->_block_use)

For information on how your program can cause an assertion
failure, see the Visual C++ documentation on asserts.

(Press Retry to debug the application)

---------------------------
Abort   Retry   Ignore   
---------------------------

The call stack shows that this raised by line 769 of Webkit\win\WebView.cpp with the content of "delete m_page;"

This is against revision 192147 of trunk. 

This is under Microsoft Visual Studio 2015, which was also used to compile webkit.

Attached is a minimal test case. Headers and libraries are assumed to be under C:\deps

The webkit headers were collected from both: $WEBKITBUILD\DerivedSources\ForwardingHeaders\Webkit and $WEBKITBUILD\DerivedSources\Webkit\Interfaces

-- 
You are receiving this mail because:
You are the assignee for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.webkit.org/pipermail/webkit-unassigned/attachments/20151112/c2dc05ab/attachment.html>