Details
-
Bug
-
Resolution: Done
-
P1: Critical
-
6.2.0 Alpha
-
None
-
-
e04d8c65b350146fc4458ded5576c4a07601d041 (qt/qtwebengine/dev) d590e174e8734ba88748fb60209fbec64a6e6fef (qt/qtwebengine/6.2)
Description
WebContestsImpl and delegate inside it removed during the call, since new window is opened in the same page:
==3797129==ERROR: AddressSanitizer: heap-use-after-free on address 0x61f000056b40 at pc 0x7fc31aad8f1b bp 0x7ffdbb2b8b30 sp 0x7ffdbb2b8b28 READ of size 8 at 0x61f000056b40 thread T0 #0 0x7fc31aad8f1a in content::WebContentsImpl::CreateNewWindow(content::RenderFrameHost*, content::mojom::CreateNewWindowParams const&, bool, bool, content::SessionStorageNamespace*) /b/dev/qtwebengine/src/core/RelWithDebInfo/../../../../../../home/user/qt/qtwebengine/src/3rdparty/chromium/content/browser/web_contents/web_contents_impl.cc:3686:11 #1 0x7fc319c67889 in content::RenderFrameHostImpl::CreateNewWindow(mojo::StructPtr<content::mojom::CreateNewWindowParams>, base::OnceCallback<void (content::mojom::CreateNewWindowStatus, mojo::StructPtr<content::mojom::CreateNewWindowReply>)>) /b/dev/qtwebengine/src/core/RelWithDebInfo/../../../../../../home/user/qt/qtwebengine/src/3rdparty/chromium/content/browser/renderer_host/render_frame_host_impl.cc:5212:18 #2 0x7fc301e020f6 in content::mojom::FrameHostStubDispatch::AcceptWithResponder(content::mojom::FrameHost*, mojo::Message*, std::unique_ptr<mojo::MessageReceiverWithStatus, std::default_delete<mojo::MessageReceiverWithStatus> >) /b/dev/qtwebengine/src/core/RelWithDebInfo/gen/content/common/frame.mojom.cc:6568:13 #3 0x7fc319ca46b7 in content::mojom::FrameHostStub<mojo::RawPtrImplRefTraits<content::mojom::FrameHost> >::AcceptWithResponder(mojo::Message*, std::unique_ptr<mojo::MessageReceiverWithStatus, std::default_delete<mojo::MessageReceiverWithStatus> >) /b/dev/qtwebengine/src/core/RelWithDebInfo/gen/content/common/frame.mojom.h:1010:12 #4 0x7fc30b75707e in mojo::InterfaceEndpointClient::HandleValidatedMessage(mojo::Message*) /b/dev/qtwebengine/src/core/RelWithDebInfo/../../../../../../home/user/qt/qtwebengine/src/3rdparty/chromium/mojo/public/cpp/bindings/lib/interface_endpoint_client.cc:528:56 #5 0x7fc30b770f6a in mojo::MessageDispatcher::Accept(mojo::Message*) /b/dev/qtwebengine/src/core/RelWithDebInfo/../../../../../../home/user/qt/qtwebengine/src/3rdparty/chromium/mojo/public/cpp/bindings/lib/message_dispatcher.cc:46:24 #6 0x7fc30b75af64 in mojo::InterfaceEndpointClient::HandleIncomingMessage(mojo::Message*) /b/dev/qtwebengine/src/core/RelWithDebInfo/../../../../../../home/user/qt/qtwebengine/src/3rdparty/chromium/mojo/public/cpp/bindings/lib/interface_endpoint_client.cc:356:22 #7 0x7fc30ba3fd06 in IPC::(anonymous namespace)::ChannelAssociatedGroupController::AcceptSyncMessage(unsigned int, unsigned int) /b/dev/qtwebengine/src/core/RelWithDebInfo/../../../../../../home/user/qt/qtwebengine/src/3rdparty/chromium/ipc/ipc_mojo_bootstrap.cc:982:24 #8 0x7fc30ba4137c in Invoke<void (IPC::(anonymous namespace)::ChannelAssociatedGroupController::*)(unsigned int, unsigned int), scoped_refptr<IPC::(anonymous namespace)::ChannelAssociatedGroupController>, unsigned int, unsigned int> /b/dev/qtwebengine/src/core/RelWithDebInfo/../../../../../../home/user/qt/qtwebengine/src/3rdparty/chromium/base/bind_internal.h:498:12 #9 0x7fc30ba4137c in MakeItSo<void (IPC::(anonymous namespace)::ChannelAssociatedGroupController::*)(unsigned int, unsigned int), scoped_refptr<IPC::(anonymous namespace)::ChannelAssociatedGroupController>, unsigned int, unsigned int> /b/dev/qtwebengine/src/core/RelWithDebInfo/../../../../../../home/user/qt/qtwebengine/src/3rdparty/chromium/base/bind_internal.h:637:12 #10 0x7fc30ba4137c in RunImpl<void (IPC::(anonymous namespace)::ChannelAssociatedGroupController::*)(unsigned int, unsigned int), std::tuple<scoped_refptr<IPC::(anonymous namespace)::ChannelAssociatedGroupController>, unsigned int, unsigned int>, 0, 1, 2> /b/dev/qtwebengine/src/core/RelWithDebInfo/../../../../../../home/user/qt/qtwebengine/src/3rdparty/chromium/base/bind_internal.h:710:12 #11 0x7fc30ba4137c in base::internal::Invoker<base::internal::BindState<void (IPC::(anonymous namespace)::ChannelAssociatedGroupController::*)(unsigned int, unsigned int), scoped_refptr<IPC::(anonymous namespace)::ChannelAssociatedGroupController>, unsigned int, unsigned int>, void ()>::RunOnce(base::internal::BindStateBase*) /b/dev/qtwebengine/src/core/RelWithDebInfo/../../../../../../home/user/qt/qtwebengine/src/3rdparty/chromium/base/bind_internal.h:679:12 #12 0x7fc30951c3da in Run /b/dev/qtwebengine/src/core/RelWithDebInfo/../../../../../../home/user/qt/qtwebengine/src/3rdparty/chromium/base/callback.h:101:12 #13 0x7fc30951c3da in base::TaskAnnotator::RunTask(char const*, base::PendingTask*) /b/dev/qtwebengine/src/core/RelWithDebInfo/../../../../../../home/user/qt/qtwebengine/src/3rdparty/chromium/base/task/common/task_annotator.cc:163:33 #14 0x7fc30957aa8d in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWorkImpl(base::sequence_manager::LazyNow*) /b/dev/qtwebengine/src/core/RelWithDebInfo/../../../../../../home/user/qt/qtwebengine/src/3rdparty/chromium/base/task/sequence_manager/thread_controller_with_message_pump_impl.cc:357:25 #15 0x7fc30957a0fe in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWork() /b/dev/qtwebengine/src/core/RelWithDebInfo/../../../../../../home/user/qt/qtwebengine/src/3rdparty/chromium/base/task/sequence_manager/thread_controller_with_message_pump_impl.cc:268:36 #16 0x7fc2fdb71b9b in QtWebEngineCore::MessagePumpForUIQt::handleScheduledWork() /home/user/qt/qtwebengine/src/core/browser_main_parts_qt.cpp:215:80 #17 0x7fc309316fa9 in std::function<void ()>::operator()() const /usr/bin/../lib64/gcc/x86_64-pc-linux-gnu/11.1.0/../../../../include/c++/11.1.0/bits/std_function.h:560:9 #18 0x7fc309316fa9 in QWebEngineMessagePumpScheduler::timerEvent(QTimerEvent*) /home/user/qt/qtwebengine/src/core/api/qwebenginemessagepumpscheduler.cpp:71:5 #19 0x7fc2e807fe06 in QObject::event(QEvent*) /home/user/qt/qtbase/src/corelib/kernel/qobject.cpp #20 0x7fc2eab5f97b in QApplicationPrivate::notify_helper(QObject*, QEvent*) /home/user/qt/qtbase/src/widgets/kernel/qapplication.cpp:3396:26 #21 0x7fc2eab63d56 in QApplication::notify(QObject*, QEvent*) /home/user/qt/qtbase/src/widgets/kernel/qapplication.cpp #22 0x7fc2e7f8dd27 in QCoreApplication::notifyInternal2(QObject*, QEvent*) /home/user/qt/qtbase/src/corelib/kernel/qcoreapplication.cpp:1061:18 #23 0x7fc2e7f91fba in QCoreApplication::sendEvent(QObject*, QEvent*) /home/user/qt/qtbase/src/corelib/kernel/qcoreapplication.cpp:1469:12 #24 0x7fc2e7f91fba in QCoreApplicationPrivate::sendPostedEvents(QObject*, int, QThreadData*) /home/user/qt/qtbase/src/corelib/kernel/qcoreapplication.cpp:1828:9 #25 0x7fc2e7f8ff64 in QCoreApplication::sendPostedEvents(QObject*, int) /home/user/qt/qtbase/src/corelib/kernel/qcoreapplication.cpp:1687:5 #26 0x7fc2e87b7881 in postEventSourceDispatch(_GSource*, int (*)(void*), void*) /home/user/qt/qtbase/src/corelib/kernel/qeventdispatcher_glib.cpp:279:5 #27 0x7fc2e742a02b in g_main_context_dispatch (/usr/lib/libglib-2.0.so.0+0x5402b)
Technically, exists in 5.15 also, but doesn't crash since web_contents_impl doesn't do anything after the call to delegate. But not anymore in 88-based.