[WK2] Page reloading will crash UIProcess after WebProcess was killed
authorcommit-queue@webkit.org <commit-queue@webkit.org@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Wed, 13 Feb 2013 02:39:07 +0000 (02:39 +0000)
committercommit-queue@webkit.org <commit-queue@webkit.org@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Wed, 13 Feb 2013 02:39:07 +0000 (02:39 +0000)
https://bugs.webkit.org/show_bug.cgi?id=109305

Patch by Adenilson Cavalcanti <cavalcantii@gmail.com> on 2013-02-12
Reviewed by Benjamin Poulain.

Source/WebKit2:

Re-initialize the pointer to a WebInspectorProxy object before calling
initializeWebPage().

When the WebProcess crashes, WebPageProxy::processDidCrash() will
set WebInspectorProxy pointer to null, which later is accessed by
initializeWebPage(). This patch avoids a crash scenario where
calls into a null pointer would be made.

* UIProcess/WebPageProxy.cpp:
(WebKit::WebPageProxy::reattachToWebProcess):

Tools:

Adding a new test to simulate the case of WebProcess crash followed by a trying
to load a new page.

* TestWebKitAPI/GNUmakefile.am:
* TestWebKitAPI/PlatformEfl.cmake:
* TestWebKitAPI/TestWebKitAPI.xcodeproj/project.pbxproj:
* TestWebKitAPI/Tests/WebKit2/ReloadPageAfterCrash.cpp: Added.
(TestWebKitAPI):
(TestWebKitAPI::didFinishLoad):
(TestWebKitAPI::TEST):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@142704 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Source/WebKit2/ChangeLog
Source/WebKit2/UIProcess/WebPageProxy.cpp
Tools/ChangeLog
Tools/TestWebKitAPI/GNUmakefile.am
Tools/TestWebKitAPI/PlatformEfl.cmake
Tools/TestWebKitAPI/TestWebKitAPI.xcodeproj/project.pbxproj
Tools/TestWebKitAPI/Tests/WebKit2/ReloadPageAfterCrash.cpp [new file with mode: 0644]

index 15f735e0fe3604d9d5e4d0d7c2ab2466cbe79b73..758715466f97627f5f6b1e9f19c106e55632542a 100644 (file)
@@ -1,3 +1,21 @@
+2013-02-12  Adenilson Cavalcanti  <cavalcantii@gmail.com>
+
+        [WK2] Page reloading will crash UIProcess after WebProcess was killed
+        https://bugs.webkit.org/show_bug.cgi?id=109305
+
+        Reviewed by Benjamin Poulain.
+
+        Re-initialize the pointer to a WebInspectorProxy object before calling
+        initializeWebPage().
+
+        When the WebProcess crashes, WebPageProxy::processDidCrash() will
+        set WebInspectorProxy pointer to null, which later is accessed by
+        initializeWebPage(). This patch avoids a crash scenario where
+        calls into a null pointer would be made.
+
+        * UIProcess/WebPageProxy.cpp:
+        (WebKit::WebPageProxy::reattachToWebProcess):
+
 2013-02-12  Joseph Pecoraro  <pecoraro@apple.com>
 
         [iOS] Enable PAGE_VISIBILITY_API
index 4ac339301e629c9cf8a373383f39ddf55e6d770e..c583e51cae1cd86eeb02052765161807512c6a5c 100644 (file)
@@ -396,17 +396,17 @@ void WebPageProxy::reattachToWebProcess()
     m_process->addExistingWebPage(this, m_pageID);
     m_process->addMessageReceiver(Messages::WebPageProxy::messageReceiverName(), m_pageID, this);
 
-    initializeWebPage();
-
-    m_pageClient->didRelaunchProcess();
-    m_drawingArea->waitForBackingStoreUpdateOnNextPaint();
-
 #if ENABLE(INSPECTOR)
     m_inspector = WebInspectorProxy::create(this);
 #endif
 #if ENABLE(FULLSCREEN_API)
     m_fullScreenManager = WebFullScreenManagerProxy::create(this);
 #endif
+
+    initializeWebPage();
+
+    m_pageClient->didRelaunchProcess();
+    m_drawingArea->waitForBackingStoreUpdateOnNextPaint();
 }
 
 void WebPageProxy::reattachToWebProcessWithItem(WebBackForwardListItem* item)
index fa52970433b7abf466c7c0b4aae1be58ba915178..8a39989a4ef066e362901aa0200c901501b39547 100644 (file)
@@ -1,3 +1,21 @@
+2013-02-12  Adenilson Cavalcanti  <cavalcantii@gmail.com>
+
+        [WK2] Page reloading will crash UIProcess after WebProcess was killed
+        https://bugs.webkit.org/show_bug.cgi?id=109305
+
+        Reviewed by Benjamin Poulain.
+
+        Adding a new test to simulate the case of WebProcess crash followed by a trying
+        to load a new page.
+
+        * TestWebKitAPI/GNUmakefile.am:
+        * TestWebKitAPI/PlatformEfl.cmake:
+        * TestWebKitAPI/TestWebKitAPI.xcodeproj/project.pbxproj:
+        * TestWebKitAPI/Tests/WebKit2/ReloadPageAfterCrash.cpp: Added.
+        (TestWebKitAPI):
+        (TestWebKitAPI::didFinishLoad):
+        (TestWebKitAPI::TEST):
+
 2013-02-11  Brent Fulgham  <bfulgham@webkit.org>
 
         Update WebKitDirs.pm for new Windows paths
index 69713a0f0a5bea618991c7f57aff55bf2af0b373..aa881333aa8d5a40905ec158cf2ffe4b6ac80d1d 100644 (file)
@@ -152,6 +152,7 @@ Programs_TestWebKitAPI_TestWebKit2_SOURCES = \
        Tools/TestWebKitAPI/Tests/WebKit2/LoadAlternateHTMLStringWithNonDirectoryURL.cpp \
        Tools/TestWebKitAPI/Tests/WebKit2/LoadCanceledNoServerRedirectCallback.cpp \
        Tools/TestWebKitAPI/Tests/WebKit2/MouseMoveAfterCrash.cpp \
+       Tools/TestWebKitAPI/Tests/WebKit2/ReloadPageAfterCrash.cpp \
        Tools/TestWebKitAPI/Tests/WebKit2/NewFirstVisuallyNonEmptyLayout.cpp \
        Tools/TestWebKitAPI/Tests/WebKit2/NewFirstVisuallyNonEmptyLayoutFails.cpp \
        Tools/TestWebKitAPI/Tests/WebKit2/NewFirstVisuallyNonEmptyLayoutForImages.cpp \
index cfd9327fb3a839ac3cae111af7468ae6c7ce7a1d..d8f5a7810026b525603a6e781847a4b190c9b2da 100644 (file)
@@ -69,6 +69,7 @@ set(test_webkit2_api_BINARIES
     LoadAlternateHTMLStringWithNonDirectoryURL
     LoadCanceledNoServerRedirectCallback
     MouseMoveAfterCrash
+    ReloadPageAfterCrash
     NewFirstVisuallyNonEmptyLayout
     NewFirstVisuallyNonEmptyLayoutFails
     NewFirstVisuallyNonEmptyLayoutForImages
index a1cc291ee413c5fb452e0d105c29da3ed733f5e7..dc3ba60e593d358339e42d37b7a89a241ed7b496 100644 (file)
@@ -88,6 +88,7 @@
                76E182DD1547569100F1FADD /* WillSendSubmitEvent_Bundle.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 76E182DC1547569100F1FADD /* WillSendSubmitEvent_Bundle.cpp */; };
                76E182DF154767E600F1FADD /* auto-submitting-form.html in Copy Resources */ = {isa = PBXBuildFile; fileRef = 76E182DE15475A8300F1FADD /* auto-submitting-form.html */; };
                81B50193140F232300D9EB58 /* StringBuilder.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 81B50192140F232300D9EB58 /* StringBuilder.cpp */; };
+               8A3AF93B16C9ED2700D248C1 /* ReloadPageAfterCrash.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 8A3AF93A16C9ED2700D248C1 /* ReloadPageAfterCrash.cpp */; };
                930AD402150698D00067970F /* lots-of-text.html in Copy Resources */ = {isa = PBXBuildFile; fileRef = 930AD401150698B30067970F /* lots-of-text.html */; };
                9318778915EEC57700A9CCE3 /* NewFirstVisuallyNonEmptyLayoutForImages.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 93AF4ECA1506F035007FD57E /* NewFirstVisuallyNonEmptyLayoutForImages.cpp */; };
                9361002914DC95A70061379D /* lots-of-iframes.html in Copy Resources */ = {isa = PBXBuildFile; fileRef = 9361002814DC957B0061379D /* lots-of-iframes.html */; };
                76E182DC1547569100F1FADD /* WillSendSubmitEvent_Bundle.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = WillSendSubmitEvent_Bundle.cpp; sourceTree = "<group>"; };
                76E182DE15475A8300F1FADD /* auto-submitting-form.html */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text.html; path = "auto-submitting-form.html"; sourceTree = "<group>"; };
                81B50192140F232300D9EB58 /* StringBuilder.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = StringBuilder.cpp; path = WTF/StringBuilder.cpp; sourceTree = "<group>"; };
+               8A3AF93A16C9ED2700D248C1 /* ReloadPageAfterCrash.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = ReloadPageAfterCrash.cpp; sourceTree = "<group>"; };
                8DD76FA10486AA7600D96B5E /* TestWebKitAPI */ = {isa = PBXFileReference; explicitFileType = "compiled.mach-o.executable"; includeInIndex = 0; path = TestWebKitAPI; sourceTree = BUILT_PRODUCTS_DIR; };
                930AD401150698B30067970F /* lots-of-text.html */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text.html; path = "lots-of-text.html"; sourceTree = "<group>"; };
                9361002814DC957B0061379D /* lots-of-iframes.html */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text.html; path = "lots-of-iframes.html"; sourceTree = "<group>"; };
                                C54237ED16B8955800E638FC /* PasteboardNotifications_Bundle.cpp */,
                                333B9CE11277F23100FEFCE3 /* PreventEmptyUserAgent.cpp */,
                                F6FDDDD214241AD4004F1729 /* PrivateBrowsingPushStateNoHistoryCallback.cpp */,
+                               8A3AF93A16C9ED2700D248C1 /* ReloadPageAfterCrash.cpp */,
                                C0BD669C131D3CF700E18F2A /* ResponsivenessTimerDoesntFireEarly.cpp */,
                                C0BD669E131D3CFF00E18F2A /* ResponsivenessTimerDoesntFireEarly_Bundle.cpp */,
                                C0ADBE8212FCA6AA00D2C129 /* RestoreSessionStateContainingFormData.cpp */,
                                333B9CE21277F23100FEFCE3 /* PreventEmptyUserAgent.cpp in Sources */,
                                F6FDDDD314241AD4004F1729 /* PrivateBrowsingPushStateNoHistoryCallback.cpp in Sources */,
                                0FC6C4CC141027E0005B7F0C /* RedBlackTree.cpp in Sources */,
+                               8A3AF93B16C9ED2700D248C1 /* ReloadPageAfterCrash.cpp in Sources */,
                                3722C8691461E03E00C45D00 /* RenderedImageFromDOMRange.mm in Sources */,
                                C0BD669D131D3CF700E18F2A /* ResponsivenessTimerDoesntFireEarly.cpp in Sources */,
                                C0ADBE8312FCA6AA00D2C129 /* RestoreSessionStateContainingFormData.cpp in Sources */,
diff --git a/Tools/TestWebKitAPI/Tests/WebKit2/ReloadPageAfterCrash.cpp b/Tools/TestWebKitAPI/Tests/WebKit2/ReloadPageAfterCrash.cpp
new file mode 100644 (file)
index 0000000..7960dcb
--- /dev/null
@@ -0,0 +1,85 @@
+/*
+ * Copyright (C) 2013 Adenilson Cavalcanti <cavalcantii@gmail.com>
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "PlatformUtilities.h"
+#include "PlatformWebView.h"
+#include "Test.h"
+#include <WebKit2/WKRetainPtr.h>
+
+namespace TestWebKitAPI {
+
+static bool loadBeforeCrash = false;
+static bool loadAfterCrash = false;
+
+static void didFinishLoad(WKPageRef page, WKFrameRef frame, WKTypeRef userData, const void* clientInfo)
+{
+    // First load before WebProcess was terminated.
+    if (!loadBeforeCrash) {
+        loadBeforeCrash = true;
+        return;
+    }
+
+    // Next load after WebProcess was terminated (hopefully
+    // it will be correctly re-spawned).
+    EXPECT_EQ(static_cast<uint32_t>(kWKFrameLoadStateFinished), WKFrameGetFrameLoadState(frame));
+    EXPECT_FALSE(loadAfterCrash);
+
+    // Set it, otherwise the loop will not end.
+    loadAfterCrash = true;
+}
+
+static void didCrash(WKPageRef page, const void*)
+{
+    // Test if first load actually worked.
+    EXPECT_TRUE(loadBeforeCrash);
+
+    // Reload should re-spawn webprocess.
+    WKPageReload(page);
+}
+
+TEST(WebKit2, ReloadPageAfterCrash)
+{
+    WKRetainPtr<WKContextRef> context(AdoptWK, WKContextCreate());
+    PlatformWebView webView(context.get());
+
+    WKPageLoaderClient loaderClient;
+    memset(&loaderClient, 0, sizeof(loaderClient));
+    loaderClient.didFinishLoadForFrame = didFinishLoad;
+    loaderClient.processDidCrash = didCrash;
+    WKPageSetPageLoaderClient(webView.page(), &loaderClient);
+
+    WKRetainPtr<WKURLRef> url = adoptWK(WKURLCreateWithUTF8CString("about:blank"));
+    // Load a blank page and next kills WebProcess.
+    WKPageLoadURL(webView.page(), url.get());
+    Util::run(&loadBeforeCrash);
+    WKPageTerminate(webView.page());
+
+    // Let's try load a page and see what happens.
+    WKPageLoadURL(webView.page(), url.get());
+    Util::run(&loadAfterCrash);
+}
+
+} // namespace TestWebKitAPI