Uploaded image for project: 'Qt'
  1. Qt
  2. QTBUG-119564

QtWebEngine segfaults in content::WebContentsImpl::DidInferColorScheme when opening certain links in new window

    XMLWordPrintable

Details

    • Bug
    • Resolution: Fixed
    • P2: Important
    • None
    • 6.6.0
    • None
    • C++ tested on GNU+Linux, Python tested on Windows
    • All
    • 50833718f (112-based)

    Description

      Steps to reproduce:

      1. Get "simplebrowser" example code for Python/C++ (https://doc.qt.io/qtforpython-6/examples/example_webenginewidgets_simplebrowser.html or https://doc.qt.io/qt-6/qtwebengine-webenginewidgets-simplebrowser-example.html )
      2. Compile the program if C++
      3. Run program, navigate to https://outlook.com , sign in
      4. Try to open any message in new window (double click on a message in your Inbox)

      The program will freeze and exit on Python (with return code 0xC0000005 (STATUS_ACCESS_VIOLATION) on Windows). On GNU+Linux and C++, it will segfault.

       

      Here is a gdb backtrace from the crash on C++ and GNU+Linux, provided by The-Compiler (qutebrowser maintainer) on IRC:

      Thread 1 "simplebrowser" received signal SIGSEGV, Segmentation fault.
      0x00007ffff0aef1cf in content::WebContentsImpl::DidInferColorScheme ()
          at ../../../../../qtwebengine-everywhere-src-6.6.0/src/3rdparty/chromium/content/browser/web_contents/web_contents_impl.cc:6147
      Downloading source file /usr/src/debug/qt6-webengine/build/src/core/RelWithDebInfo/x86_64/../../../../../qtwebengine-everywhere-src-6.6.0/src/3rdparty/chromium/content/browser/web_contents/web_contents_impl.cc
      6147	     if (web_preferences_->preferred_color_scheme ==                                                         
      (gdb) bt
      #0  0x00007ffff0aef1cf in content::WebContentsImpl::DidInferColorScheme(content::PageImpl&) () at ../../../../../qtwebengine-everywhere-src-6.6.0/src/3rdparty/chromium/content/browser/web_contents/web_contents_impl.cc:6147
      #1  content::WebContentsImpl::DidInferColorScheme(content::PageImpl&) () at ../../../../../qtwebengine-everywhere-src-6.6.0/src/3rdparty/chromium/content/browser/web_contents/web_contents_impl.cc:6136
      #2  0x00007fffefe1a98f in blink::mojom::LocalFrameHostStubDispatch::Accept(blink::mojom::LocalFrameHost*, mojo::Message*) () at /usr/lib/libQt6WebEngineCore.so.6
      #3  0x00007ffff21302a3 in mojo::InterfaceEndpointClient::HandleValidatedMessage(mojo::Message*) () at ../../../../../qtwebengine-everywhere-src-6.6.0/src/3rdparty/chromium/mojo/public/cpp/bindings/lib/interface_endpoint_client.cc:1000
      #4  0x00007ffff2131307 in mojo::MessageDispatcher::Accept(mojo::Message*) () at ../../../../../qtwebengine-everywhere-src-6.6.0/src/3rdparty/chromium/mojo/public/cpp/bindings/lib/message_dispatcher.cc:48
      #5  0x00007ffff212fcce in mojo::InterfaceEndpointClient::HandleIncomingMessage(mojo::Message*) () at ../../../../../qtwebengine-everywhere-src-6.6.0/src/3rdparty/chromium/mojo/public/cpp/bindings/lib/interface_endpoint_client.cc:694
      #6  0x00007ffff2389402 in AcceptOnEndpointThread() () at ../../../../../qtwebengine-everywhere-src-6.6.0/src/3rdparty/chromium/ipc/ipc_mojo_bootstrap.cc:1075
      #7  0x00007ffff23860e9 in Invoke<void (IPC::(anonymous namespace)::ChannelAssociatedGroupController::*)(mojo::Message), scoped_refptr<IPC::(anonymous namespace)::ChannelAssociatedGroupController>, mojo::Message> ()
          at ../../../../../qtwebengine-everywhere-src-6.6.0/src/3rdparty/chromium/base/functional/bind_internal.h:764
      #8  MakeItSo<void (IPC::(anonymous namespace)::ChannelAssociatedGroupController::*)(mojo::Message), std::tuple<scoped_refptr<IPC::(anonymous namespace)::ChannelAssociatedGroupController>, mojo::Message> > ()
          at ../../../../../qtwebengine-everywhere-src-6.6.0/src/3rdparty/chromium/base/functional/bind_internal.h:943
      #9  RunImpl<void (IPC::(anonymous namespace)::ChannelAssociatedGroupController::*)(mojo::Message), std::tuple<scoped_refptr<IPC::(anonymous namespace)::ChannelAssociatedGroupController>, mojo::Message>, 0, 1> ()
          at ../../../../../qtwebengine-everywhere-src-6.6.0/src/3rdparty/chromium/base/functional/bind_internal.h:1038
      #10 RunOnce() () at ../../../../../qtwebengine-everywhere-src-6.6.0/src/3rdparty/chromium/base/functional/bind_internal.h:989
      #11 0x00007ffff18f0d1e in base::OnceCallback<void ()>::Run() && () at ../../../../../qtwebengine-everywhere-src-6.6.0/src/3rdparty/chromium/base/functional/callback.h:152
      #12 base::TaskAnnotator::RunTaskImpl(base::PendingTask&) () at ./../../../../../qtwebengine-everywhere-src-6.6.0/src/3rdparty/chromium/base/task/common/task_annotator.cc:162
      #13 0x00007ffff1909819 in RunTask<base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWorkImpl(base::LazyNow*)::<lambda(perfetto::EventContext&)> > ()
          at ../../../../../qtwebengine-everywhere-src-6.6.0/src/3rdparty/chromium/base/task/common/task_annotator.h:88
      #14 base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWorkImpl(base::LazyNow*) ()
          at ./../../../../../qtwebengine-everywhere-src-6.6.0/src/3rdparty/chromium/base/task/sequence_manager/thread_controller_with_message_pump_impl.cc:490
      #15 0x00007ffff190a266 in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWork() ()
          at ./../../../../../qtwebengine-everywhere-src-6.6.0/src/3rdparty/chromium/base/task/sequence_manager/thread_controller_with_message_pump_impl.cc:340
      #16 0x00007fffedd50192 in QtWebEngineCore::MessagePumpForUIQt::handleScheduledWork() () at /usr/src/debug/qt6-webengine/qtwebengine-everywhere-src-6.6.0/src/core/browser_main_parts_qt.cpp:197
      #17 0x00007fffeb5a4fe6 in QObject::event(QEvent*) (this=0x55555595b6d0, e=0x7fff28049290) at /usr/src/debug/qt6-base/qtbase-everywhere-src-6.6.0/src/corelib/kernel/qobject.cpp:1414
      #18 0x00007ffff777318b in QApplicationPrivate::notify_helper(QObject*, QEvent*) (this=<optimized out>, receiver=0x55555595b6d0, e=0x7fff28049290)
          at /usr/src/debug/qt6-base/qtbase-everywhere-src-6.6.0/src/widgets/kernel/qapplication.cpp:3290
      #19 0x00007fffeb5626d8 in QCoreApplication::notifyInternal2(QObject*, QEvent*) (receiver=0x55555595b6d0, event=event@entry=0x7fff28049290) at /usr/src/debug/qt6-base/qtbase-everywhere-src-6.6.0/src/corelib/kernel/qcoreapplication.cpp:1118
      #20 0x00007fffeb562a5b in QCoreApplication::sendEvent(QObject*, QEvent*) (event=0x7fff28049290, receiver=<optimized out>) at /usr/src/debug/qt6-base/qtbase-everywhere-src-6.6.0/src/corelib/kernel/qcoreapplication.cpp:1536
      #21 QCoreApplicationPrivate::sendPostedEvents(QObject*, int, QThreadData*) (receiver=0x0, event_type=0, data=0x5555555e0ac0) at /usr/src/debug/qt6-base/qtbase-everywhere-src-6.6.0/src/corelib/kernel/qcoreapplication.cpp:1898
      #22 0x00007fffeb799d24 in QCoreApplication::sendPostedEvents(QObject*, int) (receiver=0x0, event_type=0) at /usr/src/debug/qt6-base/qtbase-everywhere-src-6.6.0/src/corelib/kernel/qcoreapplication.cpp:1757
      #23 postEventSourceDispatch(GSource*, GSourceFunc, gpointer) (s=0x555555643bc0) at /usr/src/debug/qt6-base/qtbase-everywhere-src-6.6.0/src/corelib/kernel/qeventdispatcher_glib.cpp:243
      #24 0x00007fffea50df69 in g_main_dispatch (context=0x7fffd0000ef0) at ../glib/glib/gmain.c:3476
      #25 0x00007fffea56c327 in g_main_context_dispatch_unlocked (context=0x7fffd0000ef0) at ../glib/glib/gmain.c:4284
      #26 g_main_context_iterate_unlocked.isra.0 (context=context@entry=0x7fffd0000ef0, block=block@entry=1, dispatch=dispatch@entry=1, self=<optimized out>) at ../glib/glib/gmain.c:4349
      #27 0x00007fffea50c162 in g_main_context_iteration (context=0x7fffd0000ef0, may_block=1) at ../glib/glib/gmain.c:4414
      #28 0x00007fffeb797934 in QEventDispatcherGlib::processEvents(QFlags<QEventLoop::ProcessEventsFlag>) (this=0x55555563bc90, flags=...) at /usr/src/debug/qt6-base/qtbase-everywhere-src-6.6.0/src/corelib/kernel/qeventdispatcher_glib.cpp:393
      #29 0x00007fffeb56cc5e in QEventLoop::processEvents(QFlags<QEventLoop::ProcessEventsFlag>) (flags=..., this=0x7fffffffc850) at /usr/src/debug/qt6-base/qtbase-everywhere-src-6.6.0/src/corelib/kernel/qeventloop.cpp:100
      #30 QEventLoop::exec(QFlags<QEventLoop::ProcessEventsFlag>) (this=0x7fffffffc850, flags=...) at /usr/src/debug/qt6-base/qtbase-everywhere-src-6.6.0/src/corelib/kernel/qeventloop.cpp:182
      #31 0x00007fffeb565178 in QCoreApplication::exec() () at /usr/src/debug/qt6-base/qtbase-everywhere-src-6.6.0/src/corelib/global/qflags.h:74
      #32 0x0000555555565f2d in main ()
      (gdb)  

      If I understand the trace right, there is no default web_preferences_ struct or class instance defined, and it seems to be pointing to nullptr..?

      Attachments

        No reviews matched the request. Check your Options in the drop-down menu of this sections header.

        Activity

          People

            davidsz Szabolcs David
            jussihi Jussi Hietanen
            Votes:
            1 Vote for this issue
            Watchers:
            3 Start watching this issue

            Dates

              Created:
              Updated:
              Resolved:

              Gerrit Reviews

                There are no open Gerrit changes