Details
Description
Sigil has started to explore showing pdfs inside QWebEngineViews and when only one main window is open, showing pdfs is rock solid. As soon as I create a second main window and try to load a pdf, I get a completely reproducible crash deep in QtWebEngine as it tries to use its PrefsService to see if the pdf extension is allowed. The crash is actually caused by invalid data left when the ExtensionsPrefs was freed or deleted (but we never closed any main windows, just opened a new one).
Here is the completely reproducible backtrace:
```
- thread #1, name = 'CrBrowserMain', queue = 'com.apple.main-thread', stop reason = EXC_BREAKPOINT (code=EXC_I386_BPT, subcode=0x0)
frame #0: 0x000000011bb848a5 QtWebEngineCore`PrefService::GetPreferenceValue(base::BasicStringPiece<char, std::__1::char_traits<char> >) const (.cold.1) + 5
QtWebEngineCore`PrefService::GetPreferenceValue(base::BasicStringPiece<char, std::__1::char_traits<char> >) const (.cold.1):
-> 0x11bb848a5 <+5>: ud2
0x11bb848a7 <+7>: nopw (%rax,%rax)
QtWebEngineCore`PrefService::GetPreferenceValue(base::BasicStringPiece<char, std::__1::char_traits<char> >) const (.cold.2):
0x11bb848b0 <+0>: pushq %rbp
0x11bb848b1 <+1>: movq %rsp, %rbp
Target 0: (Sigil) stopped.
(lldb) bt
- thread #1, name = 'CrBrowserMain', queue = 'com.apple.main-thread', stop reason = EXC_BREAKPOINT (code=EXC_I386_BPT, subcode=0x0)
- frame #0: 0x000000011bb848a5 QtWebEngineCore`PrefService::GetPreferenceValue(base::BasicStringPiece<char, std::__1::char_traits<char> >) const (.cold.1) + 5
frame #1: 0x00000001174c129d QtWebEngineCore`PrefService::GetPreferenceValue(base::BasicStringPiece<char, std::__1::char_traits<char> >) const + 285
frame #2: 0x00000001174c0939 QtWebEngineCore`PrefService::GetValue(base::BasicStringPiece<char, std::__1::char_traits<char> >) const + 9
frame #3: 0x00000001161e9478 QtWebEngineCore`extensions::ExtensionPrefs::GetExtensionPref(std::_1::basic_string<char, std::1::char_traits<char>, std::_1::allocator<char> > const&) const + 72
frame #4: 0x00000001161ea399 QtWebEngineCore`extensions::ExtensionPrefs::AllowFileAccess(std::_1::basic_string<char, std::1::char_traits<char>, std::_1::allocator<char> > const&) const + 9
frame #5: 0x000000011620350a QtWebEngineCore`extensions::util::InitializeFileSchemeAccessForExtension(int, std::_1::basic_string<char, std::1::char_traits<char>, std::_1::allocator<char> > const&, content::BrowserContext*) + 42
frame #6: 0x00000001162040b6 QtWebEngineCore`extensions::ExtensionWebContentsObserver::RenderFrameCreated(content::RenderFrameHost*) + 118
frame #7: 0x000000011270eefd QtWebEngineCore`extensions::ExtensionWebContentsObserverQt::RenderFrameCreated(content::RenderFrameHost*) + 29
frame #8: 0x00000001156914b0 QtWebEngineCore`void content::WebContentsImpl::WebContentsObserverList::NotifyObservers<void (content::WebContentsObserver::)(content::RenderFrameHost), content::RenderFrameHostImpl*&>(void (content::WebContentsObserver::)(content::RenderFrameHost), content::RenderFrameHostImpl*&) + 336
frame #9: 0x00000001156a8b7b QtWebEngineCore`content::WebContentsImpl::RenderFrameCreated(content::RenderFrameHostImpl*) + 107
frame #10: 0x00000001154dbf33 QtWebEngineCore`content::RenderFrameHostImpl::RenderFrameCreated() + 211
frame #11: 0x000000011554ad9f QtWebEngineCore`content::RenderViewHostImpl::CreateRenderView(absl::optional<blink::MultiToken<base::TokenType<blink::LocalFrameTokenTypeMarker>, base::TokenType<blink::RemoteFrameTokenTypeMarker> > > const&, int, bool) + 2511
frame #12: 0x00000001156b274d QtWebEngineCore`content::WebContentsImpl::CreateRenderViewForRenderManager(content::RenderViewHost*, absl::optional<blink::MultiToken<base::TokenType<blink::LocalFrameTokenTypeMarker>, base::TokenType<blink::RemoteFrameTokenTypeMarker> > > const&, content::RenderFrameProxyHost*) + 141
frame #13: 0x000000011551dcad QtWebEngineCore`content::RenderFrameHostManager::InitRenderView(content::SiteInstanceGroup*, content::RenderViewHostImpl*, content::RenderFrameProxyHost*) + 285
frame #14: 0x000000011568a0a9 QtWebEngineCore`content::WebContentsImpl::AttachInnerWebContents(std::_1::unique_ptr<content::WebContents, std::_1::default_delete<content::WebContents> >, content::RenderFrameHost*, mojo::PendingAssociatedRemote<blink::mojom::RemoteFrame>, mojo::PendingAssociatedReceiver<blink::mojom::RemoteFrameHost>, bool) + 377
frame #15: 0x000000011b9e39f7 QtWebEngineCore`guest_view::GuestViewBase::WillAttach(std::_1::unique_ptr<guest_view::GuestViewBase, std::_1::default_delete<guest_view::GuestViewBase> >, content::WebContents*, content::RenderFrameHost*, int, bool, base::OnceCallback<void ()>, base::OnceCallback<void ()>) + 519
frame #16: 0x000000011b9e4b33 QtWebEngineCore`guest_view::GuestViewBase::AttachToOuterWebContentsFrame(std::_1::unique_ptr<guest_view::GuestViewBase, std::_1::default_delete<guest_view::GuestViewBase> >, content::RenderFrameHost*, int, bool, base::OnceCallback<void ()>) + 275
frame #17: 0x0000000116210b48 QtWebEngineCore`extensions::MimeHandlerViewAttachHelper::ResumeAttachOrDestroy(std::_1::unique_ptr<extensions::MimeHandlerViewGuest, std::_1::default_delete<extensions::MimeHandlerViewGuest> >, int, bool, content::RenderFrameHost*) + 344
frame #18: 0x000000011621293d QtWebEngineCore`base::internal::Invoker<base::internal::BindState<void (extensions::MimeHandlerViewAttachHelper::)(std::_1::unique_ptr<extensions::MimeHandlerViewGuest, std::1::default_delete<extensions::MimeHandlerViewGuest> >, int, bool, content::RenderFrameHost), base::WeakPtr<extensions::MimeHandlerViewAttachHelper>, std::1::unique_ptr<extensions::MimeHandlerViewGuest, std::_1::default_delete<extensions::MimeHandlerViewGuest> >, int, bool>, void (content::RenderFrameHost*)>::RunOnce(base::internal::BindStateBase*, content::RenderFrameHost*) + 125
frame #19: 0x00000001155207a7 QtWebEngineCore`base::internal::Invoker<base::internal::BindState<content::RenderFrameHostManager::NotifyPrepareForInnerDelegateAttachComplete(bool)::$_14, base::OnceCallback<void (content::RenderFrameHost*)>, int, int>, void ()>::RunOnce(base::internal::BindStateBase*) + 55
frame #20: 0x00000001168b5137 QtWebEngineCore`base::TaskAnnotator::RunTaskImpl(base::PendingTask&) + 231
frame #21: 0x00000001168d065f QtWebEngineCore`base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWorkImpl(base::LazyNow*) + 751
frame #22: 0x00000001168d00a3 QtWebEngineCore`base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWork() + 83
frame #23: 0x00000001168d0d15 QtWebEngineCore`non-virtual thunk to base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWork() + 21
frame #24: 0x000000011263edfa QtWebEngineCore`QtWebEngineCore::MessagePumpForUIQt::handleScheduledWork() + 58
frame #25: 0x0000000103b00ff7 QtCore`QObject::event(QEvent*) + 103
frame #26: 0x0000000103343fd7 QtWidgets`QApplicationPrivate::notify_helper(QObject*, QEvent*) + 247
frame #27: 0x0000000103344e73 QtWidgets`QApplication::notify(QObject*, QEvent*) + 499
frame #28: 0x0000000103ab8d7a QtCore`QCoreApplication::notifyInternal2(QObject*, QEvent*) + 170
frame #29: 0x0000000103ab9cb3 QtCore`QCoreApplicationPrivate::sendPostedEvents(QObject*, int, QThreadData*) + 803
frame #30: 0x0000000104121fc6 libqcocoa.dylib`QCocoaEventDispatcherPrivate::processPostedEvents() + 342
frame #31: 0x00000001041229fd libqcocoa.dylib`QCocoaEventDispatcherPrivate::postedEventsSourceCallback(void*) + 445
frame #32: 0x00007ff81b188f2a CoreFoundation`_CFRUNLOOP_IS_CALLING_OUT_TO_A_SOURCE0_PERFORM_FUNCTION_ + 17
frame #33: 0x00007ff81b188ecc CoreFoundation`__CFRunLoopDoSource0 + 157
frame #34: 0x00007ff81b188ca5 CoreFoundation`__CFRunLoopDoSources0 + 217
frame #35: 0x00007ff81b18792f CoreFoundation`__CFRunLoopRun + 916
frame #36: 0x00007ff81b186f31 CoreFoundation`CFRunLoopRunSpecific + 560
frame #37: 0x00007ff824c02dad HIToolbox`RunCurrentEventLoopInMode + 292
frame #38: 0x00007ff824c02bbe HIToolbox`ReceiveNextEventCommon + 657
frame #39: 0x00007ff824c02918 HIToolbox`_BlockUntilNextEventMatchingListInModeWithFilter + 64
frame #40: 0x00007ff81e21b5d0 AppKit`_DPSNextEvent + 858
frame #41: 0x00007ff81e21a47a AppKit`-[NSApplication(NSEvent) _nextEventMatchingEventMask:untilDate:inMode:dequeue:] + 1214
frame #42: 0x00007ff81e20cae8 AppKit`-[NSApplication run] + 586
frame #43: 0x000000010412124b libqcocoa.dylib`QCocoaEventDispatcher::processEvents(QFlags<QEventLoop::ProcessEventsFlag>) + 2235
frame #44: 0x0000000103ac1ef6 QtCore`QEventLoop::exec(QFlags<QEventLoop::ProcessEventsFlag>) + 486
frame #45: 0x0000000103ab9367 QtCore`QCoreApplication::exec() + 119
frame #46: 0x00000001000435ee Sigil`main + 10382
frame #47: 0x00007ff81ad5341f dyld`start + 1903
```
So this appears to be a use after free.
I have tried to create a very very simple standalone test case but so far have failed.
And hints or ideas on how best to work around this issue are welcome.
Attachments
For Gerrit Dashboard: QTBUG-115188 | ||||||
---|---|---|---|---|---|---|
# | Subject | Branch | Project | Status | CR | V |
491807,3 | Fix crashing PDF viewer after changing the storage path | dev | qt/qtwebengine | Status: MERGED | +2 | 0 |
493928,2 | Fix crashing PDF viewer after changing the storage path | 6.6 | qt/qtwebengine | Status: MERGED | +2 | 0 |
493929,2 | Fix crashing PDF viewer after changing the storage path | 6.5 | qt/qtwebengine | Status: MERGED | +2 | 0 |