Updates:
Cc: [email protected]
Comment #1 on issue 8712 by [email protected]: Linux crash on wrench ->
exit
http://code.google.com/p/chromium/issues/detail?id=8712
This bug seems actually kinda tricky. It must be a difference in when our
messages
are dispatched compared to Windows. What happens is in our
BrowserWindowGtk::Close,
we destroy the window. This causes the destroy signal to be emitted right
away, so
our destroy handler is called right away, which deletes the
BrowserWindowGtk object.
In the destructor of the BrowserWindowGtk object, we destroy the Browser
instance,
which remove the browser from the BrowserList. The problem is here:
brower_list.cc CloseAllBrowsers
|104 BrowserList::const_iterator
iter; |
|105 for (iter = BrowserList::begin(); iter !=
BrowserList::end();) { |
B+>|106 if (use_post)
{ |
|107
(*iter)->window()->Close(); |
B+ |108
++iter; |
|109 } else {
On line 107, calling Close() on Linux can cause BrowserList to be modified,
which
invalidates the iterators. We are looping through a second time on an
invalidate
iterator and crashing.
There is a second bug here in the Linux implementation that would cause
Close() to
reenter on itself, but that's a simple fix. I was surprised when the
message was
processed right away, I was expecting the message to be fired after going
back to the
run loop.
The only obvious fixes I see for this that will work for both cases is:
- Make a copy of the BrowserList std::vector when we loop on use_post.
- In the Linux implementation of Close(), schedule the real work with an
idle
callback, so that it goes back to the run loop. (This is basically like
PostTask /
DeleteSoon). We could in fact just use DeleteSoon from the
MainWindowDestroyed.
--
You received this message because you are listed in the owner
or CC fields of this issue, or because you starred this issue.
You may adjust your issue notification preferences at:
http://code.google.com/hosting/settings
--~--~---------~--~----~------------~-------~--~----~
Automated mail from issue updates at http://crbug.com/
Subscription options: http://groups.google.com/group/chromium-bugs
-~----------~----~----~----~------~----~------~--~---
