From: timothy_horton@apple.com <timothy_horton@apple.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Date: Thu, 18 Sep 2014 16:26:27 +0000 (+0000)
Subject: Occasional unreproducible crashes in MessageReceiverMap::dispatchMessage
X-Git-Url: https://git.webkit.org/?p=WebKit-https.git;a=commitdiff_plain;h=e6a888a4d17147b0ded0772d4807b3785ccd92da

Occasional unreproducible crashes in MessageReceiverMap::dispatchMessage
https://bugs.webkit.org/show_bug.cgi?id=136909
<rdar://problem/17758325>

Reviewed by Anders Carlsson.

* UIProcess/API/Cocoa/WKWebView.mm:
(-[WKWebView dealloc]):
We're seeing some messages dispatched on the WebContext that end up
attempting to call dispatchMessage on a freed MessageReceiver.
The WKRemoteObjectRegistry message receiver is added to the WebContext
message receiver map, but never removed, despite the WebContext easily
outliving the WKWebView that owns the remote object registry.


git-svn-id: https://svn.webkit.org/repository/webkit/trunk@173722 268f45cc-cd09-0410-ab3c-d52691b4dbfc
---

diff --git a/Source/WebKit2/ChangeLog b/Source/WebKit2/ChangeLog
index 4ee82346f328..c14b4c2b8b8e 100644
--- a/Source/WebKit2/ChangeLog
+++ b/Source/WebKit2/ChangeLog
@@ -1,3 +1,19 @@
+2014-09-18  Tim Horton  <timothy_horton@apple.com>
+
+        Occasional unreproducible crashes in MessageReceiverMap::dispatchMessage
+        https://bugs.webkit.org/show_bug.cgi?id=136909
+        <rdar://problem/17758325>
+
+        Reviewed by Anders Carlsson.
+
+        * UIProcess/API/Cocoa/WKWebView.mm:
+        (-[WKWebView dealloc]):
+        We're seeing some messages dispatched on the WebContext that end up
+        attempting to call dispatchMessage on a freed MessageReceiver.
+        The WKRemoteObjectRegistry message receiver is added to the WebContext
+        message receiver map, but never removed, despite the WebContext easily
+        outliving the WKWebView that owns the remote object registry.
+
 2014-09-17  Rohit Kumar  <kumar.rohit@samsung.com>
 
         [EFL][WK2] Use the correct enum for control key in Ewk_Event_Modifiers in ewk_navigation_policy_decision.cpp
diff --git a/Source/WebKit2/UIProcess/API/Cocoa/WKWebView.mm b/Source/WebKit2/UIProcess/API/Cocoa/WKWebView.mm
index 3a6bcd754608..cdd9c165c015 100644
--- a/Source/WebKit2/UIProcess/API/Cocoa/WKWebView.mm
+++ b/Source/WebKit2/UIProcess/API/Cocoa/WKWebView.mm
@@ -352,6 +352,9 @@ static int32_t deviceOrientation()
 
 - (void)dealloc
 {
+    if (_remoteObjectRegistry)
+        _page->process().context().removeMessageReceiver(Messages::RemoteObjectRegistry::messageReceiverName(), _page->pageID());
+
     _page->close();
 
     [_remoteObjectRegistry _invalidate];