Bug 845318

Summary: [RFE] IcedTea crashes in Webkit, already fixed in the upstream mercurial tree 1.2.2pre
Product: [Fedora] Fedora Reporter: Zoltan Boszormenyi <zboszor>
Component: icedtea-webAssignee: Deepak Bhole <dbhole>
Status: CLOSED WONTFIX QA Contact: Fedora Extras Quality Assurance <extras-qa>
Severity: unspecified Docs Contact:
Priority: unspecified    
Version: 17CC: dbhole, omajid
Target Milestone: ---   
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2013-08-01 18:40:46 UTC Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Attachments:
Description Flags
Use g_mutex_free() instead of g_free() on the GMutex
none
Use the new GMutex API none

Description Zoltan Boszormenyi 2012-08-02 16:15:02 UTC
Description of problem:

I am writing a custom browser frontend using webkitgtk which displays the main site and popups in the same window, adding them to a GtkHBox and hiding all previous pages and popups but the last visible one. I hooked into the "close-web-view" signal in webkit, which is called when e.g. window.close() is called from JavaScript. The callback function calls gtk_widget_destroy() on the WebKitWebView pointer passed to it. It works when the popup only contains JavaScript. However, gtk_widget_destroy() crashes on a page that contains both Flash and Java applets. The crash happens inside IcedTea according to the backtrace I got:

(gdb) bt
#0  0x00007f2f8612d925 in __GI_raise (sig=sig@entry=6) at ../nptl/sysdeps/unix/sysv/linux/raise.c:64
#1  0x00007f2f8612f0d8 in __GI_abort () at abort.c:91
#2  0x00007f2f8616d64b in __libc_message (do_abort=do_abort@entry=2, fmt=fmt@entry=0x7f2f86270c28 "*** glibc detected *** %s: %s: 0x%s ***\n") at ../sysdeps/unix/sysv/linux/libc_fatal.c:198
#3  0x00007f2f861747ce in malloc_printerr (ptr=0xa0dc80, str=0x7f2f8626eab5 "free(): invalid pointer", action=3) at malloc.c:5027
#4  _int_free (av=0x7f2f864a8720, p=0xa0dc70, have_lock=0) at malloc.c:3948
#5  0x00007f2f8671d37f in g_free (mem=0xa0dc80) at gmem.c:252
#6  0x00007f2f0777dfe0 in plugin_data_destroy (instance=0x7f2f05f12ae0) at /usr/src/debug/icedtea-web-1.2/plugin/icedteanp/IcedTeaNPPlugin.cc:2003
#7  ITNP_Destroy (instance=0x7f2f05f12ae0, save=<optimized out>) at /usr/src/debug/icedtea-web-1.2/plugin/icedteanp/IcedTeaNPPlugin.cc:713
#8  0x00007f2f89f4b056 in WebCore::PluginView::stop (this=this@entry=0x7f2f05f12900) at Source/WebCore/plugins/PluginView.cpp:381
#9  0x00007f2f89f4bbbc in WebCore::PluginView::~PluginView (this=0x7f2f05f12900, __in_chrg=<optimized out>) at Source/WebCore/plugins/PluginView.cpp:300
#10 0x00007f2f89f4c109 in WebCore::PluginView::~PluginView (this=0x7f2f05f12900, __in_chrg=<optimized out>) at Source/WebCore/plugins/PluginView.cpp:313
#11 0x00007f2f8a06383f in deref (this=<optimized out>) at Source/JavaScriptCore/wtf/RefCounted.h:183
#12 deref (this=<optimized out>) at Source/JavaScriptCore/wtf/HashTable.h:925
#13 derefIfNotNull<WebCore::Widget> (ptr=<optimized out>) at Source/JavaScriptCore/wtf/PassRefPtr.h:52
#14 ~RefPtr (this=<optimized out>, __in_chrg=<optimized out>) at Source/JavaScriptCore/wtf/RefPtr.h:58
#15 ~pair (this=<optimized out>, __in_chrg=<optimized out>) at /usr/include/c++/4.7.0/bits/stl_pair.h:88
#16 WTF::HashTable<WTF::RefPtr<WebCore::Widget>, std::pair<WTF::RefPtr<WebCore::Widget>, WebCore::FrameView*>, WTF::PairFirstExtractor<std::pair<WTF::RefPtr<WebCore::Widget>, WebCore::FrameView*> >, WTF::PtrHash<WTF::RefPtr<WebCore::Widget> >, WTF::PairHashTraits<WTF::HashTraits<WTF::RefPtr<WebCore::Widget> >, WTF::HashTraits<WebCore::FrameView*> >, WTF::HashTraits<WTF::RefPtr<WebCore::Widget> > >::deallocateTable (
    table=0x7f2f8b1ca800, size=<optimized out>) at Source/JavaScriptCore/wtf/HashTable.h:930
#17 0x00007f2f8a062dae in ~HashTable (this=<optimized out>, __in_chrg=<optimized out>) at Source/JavaScriptCore/wtf/HashTable.h:313
#18 ~HashMap (this=<optimized out>, __in_chrg=<optimized out>) at Source/JavaScriptCore/wtf/RefPtrHashMap.h:32
#19 WebCore::RenderWidget::resumeWidgetHierarchyUpdates () at Source/WebCore/rendering/RenderWidget.cpp:82
#20 0x00007f2f89a31e54 in WebCore::ContainerNode::detach (this=0x7f2f17e91000) at Source/WebCore/dom/ContainerNode.cpp:796
#21 0x00007f2f89a56b83 in WebCore::Document::detach (this=0x7f2f17e91000) at Source/WebCore/dom/Document.cpp:1957
#22 0x00007f2f89e22534 in WebCore::Frame::setView (this=0x7f2f06073b00, view=...) at Source/WebCore/page/Frame.cpp:255
#23 0x00007f2f89d7f947 in WebCore::FrameLoader::closeAndRemoveChild (this=this@entry=0x7f2f05978b70, child=0x7f2f06073b00) at Source/WebCore/loader/FrameLoader.cpp:2346
#24 0x00007f2f89d80d57 in WebCore::FrameLoader::detachFromParent (this=0x7f2f06073b70) at Source/WebCore/loader/FrameLoader.cpp:2424
#25 0x00007f2f89d80efc in WebCore::FrameLoader::detachChildren (this=<optimized out>) at Source/WebCore/loader/FrameLoader.cpp:2339
#26 0x00007f2f89d80d01 in WebCore::FrameLoader::detachFromParent (this=0x7f2f05978b70) at Source/WebCore/loader/FrameLoader.cpp:2413
#27 0x00007f2f897bac58 in webkit_web_view_dispose (object=0x97a380 [WebKitWebView]) at Source/WebKit/gtk/webkit/webkitwebview.cpp:1322
#28 0x00007f2f8701d6d1 in g_object_run_dispose (object=0x97a380 [WebKitWebView]) at gobject.c:1061
#29 0x0000000000401461 in close_web_view (web_view=0x97a380 [WebKitWebView], user_data=0x0) at guru.c:107
#30 0x00007f2f897c332a in webkit_marshal_BOOLEAN__VOID (closure=0xbd0930, return_value=0x7fffd16695f0, n_param_values=<optimized out>, param_values=<optimized out>, invocation_hint=<optimized out>, 
    marshal_data=<optimized out>) at DerivedSources/webkit/webkitmarshal.cpp:685
#31 0x00007f2f87017664 in g_closure_invoke (closure=0xbd0930, return_value=return_value@entry=0x7fffd16695f0, n_param_values=1, param_values=param_values@entry=0x7fffd16696a0, 
    invocation_hint=invocation_hint@entry=0x7fffd1669640) at gclosure.c:777
#32 0x00007f2f870286d8 in signal_emit_unlocked_R (node=node@entry=0x967970, detail=detail@entry=0, instance=instance@entry=0x97a380, emission_return=emission_return@entry=0x7fffd1669760, 
    instance_and_params=instance_and_params@entry=0x7fffd16696a0) at gsignal.c:3551
#33 0x00007f2f870302a7 in g_signal_emit_valist (instance=instance@entry=0x97a380, signal_id=signal_id@entry=114, detail=detail@entry=0, var_args=var_args@entry=0x7fffd1669938) at gsignal.c:3310
#34 0x00007f2f87030cd0 in g_signal_emit_by_name (instance=0x97a380, detailed_signal=0x7f2f8a81620e "close-web-view") at gsignal.c:3393
#35 0x00007f2f8977ac77 in WebKit::emitCloseWebViewSignalLater (view=<error reading variable: value has been optimized out>) at Source/WebKit/gtk/WebCoreSupport/ChromeClientGtk.cpp:264
#36 0x00007f2f8671822b in g_timeout_dispatch (source=source@entry=0xb72a00, callback=<optimized out>, user_data=<optimized out>) at gmain.c:3882
#37 0x00007f2f86717695 in g_main_dispatch (context=0x91e870) at gmain.c:2539
#38 g_main_context_dispatch (context=context@entry=0x91e870) at gmain.c:3075
#39 0x00007f2f867179c8 in g_main_context_iterate (context=0x91e870, block=block@entry=1, dispatch=dispatch@entry=1, self=<optimized out>) at gmain.c:3146
#40 0x00007f2f86717dc2 in g_main_loop_run (loop=0x95c710) at gmain.c:3340
#41 0x00007f2f88e92c57 in IA__gtk_main () at gtkmain.c:1257
#42 0x0000000000401d5f in main (argc=1, argv=0x7fffd1669d48) at guru.c:301

GLIBC says it's an invalid (double?) free:

*** glibc detected *** ./guru: free(): invalid pointer: 0x0000000000a0dc80 ***
======= Backtrace: =========
/lib64/libc.so.6(+0x7c7ce)[0x7f2f861747ce]
/lib64/libglib-2.0.so.0(g_free+0xf)[0x7f2f8671d37f]
/usr/lib64/IcedTeaPlugin.so(_Z12ITNP_DestroyP4_NPPPP12_NPSavedData+0xe0)[0x7f2f0777dfe0]
/lib64/libwebkitgtk-1.0.so.0(+0xb8b056)[0x7f2f89f4b056]
/lib64/libwebkitgtk-1.0.so.0(+0xb8bbbc)[0x7f2f89f4bbbc]
/lib64/libwebkitgtk-1.0.so.0(+0xb8c109)[0x7f2f89f4c109]
/lib64/libwebkitgtk-1.0.so.0(+0xca383f)[0x7f2f8a06383f]
/lib64/libwebkitgtk-1.0.so.0(+0xca2dae)[0x7f2f8a062dae]
/lib64/libwebkitgtk-1.0.so.0(+0x671e54)[0x7f2f89a31e54]
/lib64/libwebkitgtk-1.0.so.0(+0x696b83)[0x7f2f89a56b83]
/lib64/libwebkitgtk-1.0.so.0(+0xa62534)[0x7f2f89e22534]
/lib64/libwebkitgtk-1.0.so.0(+0x9bf947)[0x7f2f89d7f947]
/lib64/libwebkitgtk-1.0.so.0(+0x9c0d57)[0x7f2f89d80d57]
/lib64/libwebkitgtk-1.0.so.0(+0x9c0efc)[0x7f2f89d80efc]
/lib64/libwebkitgtk-1.0.so.0(+0x9c0d01)[0x7f2f89d80d01]
/lib64/libwebkitgtk-1.0.so.0(+0x3fac58)[0x7f2f897bac58]
/lib64/libgobject-2.0.so.0(g_object_run_dispose+0x61)[0x7f2f8701d6d1]
./guru[0x401461]
/lib64/libwebkitgtk-1.0.so.0(webkit_marshal_BOOLEAN__VOID+0x8a)[0x7f2f897c332a]
/lib64/libgobject-2.0.so.0(g_closure_invoke+0x194)[0x7f2f87017664]
/lib64/libgobject-2.0.so.0(+0x206d8)[0x7f2f870286d8]
/lib64/libgobject-2.0.so.0(g_signal_emit_valist+0xa17)[0x7f2f870302a7]
/lib64/libgobject-2.0.so.0(g_signal_emit_by_name+0x500)[0x7f2f87030cd0]
/lib64/libwebkitgtk-1.0.so.0(+0x3bac77)[0x7f2f8977ac77]
/lib64/libglib-2.0.so.0(+0x4822b)[0x7f2f8671822b]
/lib64/libglib-2.0.so.0(g_main_context_dispatch+0x135)[0x7f2f86717695]
/lib64/libglib-2.0.so.0(+0x479c8)[0x7f2f867179c8]
/lib64/libglib-2.0.so.0(g_main_loop_run+0x72)[0x7f2f86717dc2]
/lib64/libgtk-x11-2.0.so.0(gtk_main+0xa7)[0x7f2f88e92c57]
./guru[0x401d5f]
/lib64/libc.so.6(__libc_start_main+0xf5)[0x7f2f86119735]
./guru[0x401199]
======= Memory map: ========
00400000-00403000 r-xp 00000000 08:11 116029412                          /home/zozo/cvs/webkit/example/guru
00602000-00603000 rw-p 00002000 08:11 116029412                          /home/zozo/cvs/webkit/example/guru
008e0000-01c12000 rw-p 00000000 00:00 0                                  [heap]
7f2ee4000000-7f2ee4021000 rw-p 00000000 00:00 0 
7f2ee4021000-7f2ee8000000 ---p 00000000 00:00 0 
7f2eeafe5000-7f2eec000000 rw-p 00000000 00:00 0 
7f2eec000000-7f2eec021000 rw-p 00000000 00:00 0 
7f2eec021000-7f2ef0000000 ---p 00000000 00:00 0 
7f2ef002d000-7f2ef0bf2000 rw-p 00000000 00:00 0 
7f2ef0bf2000-7f2ef1b52000 ---p 00000000 00:00 0 
7f2ef1b52000-7f2ef2d96000 rw-p 00000000 00:00 0 
7f2ef2d96000-7f2ef2d97000 ---p 00000000 00:00 0 
7f2ef2d97000-7f2ef3597000 rw-p 00000000 00:00 0                          [stack:27455]
7f2ef3597000-7f2ef3598000 ---p 00000000 00:00 0 
7f2ef3598000-7f2ef3d98000 rw-p 00000000 00:00 0                          [stack:27454]
7f2ef3d98000-7f2ef7d99000 rw-s 00000000 00:0f 11028471                   /dev/shm/pulse-shm-1198485570
7f2ef7da0000-7f2ef7df5000 r-xp 00000000 08:03 1180720                    /usr/lib64/libsndfile.so.1.0.25
7f2ef7df5000-7f2ef7ff5000 ---p 00055000 08:03 1180720                    /usr/lib64/libsndfile.so.1.0.25
7f2ef7ff5000-7f2ef7ff7000 r--p 00055000 08:03 1180720                    /usr/lib64/libsndfile.so.1.0.25
7f2ef7ff7000-7f2ef7ff8000 rw-p 00057000 08:03 1180720                    /usr/lib64/libsndfile.so.1.0.25
7f2ef7ff8000-7f2ef7ffc000 rw-p 00000000 00:00 0 
7f2ef8000000-7f2ef8021000 rw-p 00000000 00:00 0 
7f2ef8021000-7f2efc000000 ---p 00000000 00:00 0 
7f2efc018000-7f2efc01d000 r-xp 00000000 08:03 1192731                    /usr/lib64/libasyncns.so.0.3.1
7f2efc01d000-7f2efc21c000 ---p 00005000 08:03 1192731                    /usr/lib64/libasyncns.so.0.3.1
7f2efc21c000-7f2efc21d000 r--p 00004000 08:03 1192731                    /usr/lib64/libasyncns.so.0.3.1
7f2efc21d000-7f2efc21e000 rw-p 00005000 08:03 1192731                    /usr/lib64/libasyncns.so.0.3.1
7f2efc220000-7f2efc229000 r-xp 00000000 08:03 1192390                    /usr/lib64/libwrap.so.0.7.6
7f2efc229000-7f2efc428000 ---p 00009000 08:03 1192390                    /usr/lib64/libwrap.so.0.7.6
7f2efc428000-7f2efc429000 r--p 00008000 08:03 1192390                    /usr/lib64/libwrap.so.0.7.6
7f2efc429000-7f2efc42a000 rw-p 00009000 08:03 1192390                    /usr/lib64/libwrap.so.0.7.6
7f2efc42a000-7f2efc42b000 rw-p 00000000 00:00 0 
7f2efc430000-7f2efc435000 r-xp 00000000 08:03 1182180                    /usr/lib64/libXtst.so.6.1.0
7f2efc435000-7f2efc634000 ---p 00005000 08:03 1182180                    /usr/lib64/libXtst.so.6.1.0
7f2efc634000-7f2efc635000 r--p 00004000 08:03 1182180                    /usr/lib64/libXtst.so.6.1.0
7f2efc635000-7f2efc636000 rw-p 00005000 08:03 1182180                    /usr/lib64/libXtst.so.6.1.0
7f2efc638000-7f2efc698000 r-xp 00000000 08:03 1195814                    /usr/lib64/libpulsecommon-1.1.so
7f2efc698000-7f2efc897000 ---p 00060000 08:03 1195814                    /usr/lib64/libpulsecommon-1.1.so
7f2efc897000-7f2efc898000 r--p 0005f000 08:03 1195814                    /usr/lib64/libpulsecommon-1.1.so
7f2efc898000-7f2efc89a000 rw-p 00060000 08:03 1195814                    /usr/lib64/libpulsecommon-1.1.so
7f2efc8a0000-7f2efc8a7000 r-xp 00000000 08:03 1182247                    /usr/lib64/libjson.so.0.0.1
7f2efc8a7000-7f2efcaa6000 ---p 00007000 08:03 1182247                    /usr/lib64/libjson.so.0.0.1
7f2efcaa6000-7f2efcaa7000 r--p 00006000 08:03 1182247                    /usr/lib64/libjson.so.0.0.1
7f2efcaa7000-7f2efcaa8000 rw-p 00007000 08:03 1182247                    /usr/lib64/libjson.so.0.0.1
7f2efcaa8000-7f2efcaef000 r-xp 00000000 08:03 1195813                    /usr/lib64/libpulse.so.0.13.5
7f2efcaef000-7f2efccee000 ---p 00047000 08:03 1195813                    /usr/lib64/libpulse.so.0.13.5
7f2efccee000-7f2efccef000 r--p 00046000 08:03 1195813                    /usr/lib64/libpulse.so.0.13.5
7f2efccef000-7f2efccf0000 rw-p 00047000 08:03 1195813                    /usr/lib64/libpulse.so.0.13.5
7f2efccf0000-7f2efccf6000 r-xp 00000000 08:03 5256047                    /usr/lib64/alsa-lib/libasound_module_pcm_pulse.so
7f2efccf6000-7f2efcef5000 ---p 00006000 08:03 5256047                    /usr/lib64/alsa-lib/libasound_module_pcm_pulse.so
7f2efcef5000-7f2efcef6000 r--p 00005000 08:03 5256047                    /usr/lib64/alsa-lib/libasound_module_pcm_pulse.so
7f2efcef6000-7f2efcef7000 rw-p 00006000 08:03 5256047                    /usr/lib64/alsa-lib/libasound_module_pcm_pulse.so
7f2efcef7000-7f2efd08d000 rw-p 00000000 00:00 0 
7f2efd08d000-7f2efd08e000 ---p 00000000 00:00 0 
7f2efd08e000-7f2efd88e000 rw-p 00000000 00:00 0                          [stack:27453]
7f2efd88e000-7f2efd88f000 ---p 00000000 00:00 0 
7f2efd88f000-7f2efe08f000 rw-p 00000000 00:00 0                          [stack:27404]
7f2efe08f000-7f2efe090000 ---p 00000000 00:00 0 
7f2efe090000-7f2efe890000 rw-p 00000000 00:00 0                          [stack:27446]
7f2efe890000-7f2efe968000 r-xp 00000000 08:03 1193466                    /usr/lib64/libasound.so.2.0.0
7f2efe968000-7f2efeb67000 ---p 000d8000 08:03 1193466                    /usr/lib64/libasound.so.2.0.0
7f2efeb67000-7f2efeb6d000 r--p 000d7000 08:03 1193466                    /usr/lib64/libasound.so.2.0.0
7f2efeb6d000-7f2efeb6f000 rw-p 000dd000 08:03 1193466                    /usr/lib64/libasound.so.2.0.0
7f2efeb6f000-7f2efeb70000 ---p 00000000 00:00 0 
7f2efeb70000-7f2eff370000 rw-p 00000000 00:00 0                          [stack:27447]
7f2eff370000-7f2eff420000 r--p 00000000 08:03 660372                     /usr/share/fonts/dejavu/DejaVuSans.ttf
7f2eff4e0000-7f2eff4e2000 r-xp 00000000 08:03 1195948                    /usr/lib64/libvdpau.so.1.0.0
7f2eff4e2000-7f2eff6e1000 ---p 00002000 08:03 1195948                    /usr/lib64/libvdpau.so.1.0.0
7f2eff6e1000-7f2eff6e2000 r--p 00001000 08:03 1195948                    /usr/lib64/libvdpau.so.1.0.0
7f2eff6e2000-7f2eff6e3000 rw-p 00002000 08:03 1195948                    /usr/lib64/libvdpau.so.1.0.0
7f2eff6e8000-7f2eff70f000 r-xp 00000000 08:03 1195048                    /usr/lib64/libnssdbm3.so
7f2eff70f000-7f2eff90f000 ---p 00027000 08:03 1195048                    /usr/lib64/libnssdbm3.so
7f2eff90f000-7f2eff910000 r--p 00027000 08:03 1195048                    /usr/lib64/libnssdbm3.so
7f2eff910000-7f2eff911000 rw-p 00028000 08:03 1195048                    /usr/lib64/libnssdbm3.so
7f2eff918000-7f2eff957000 r-xp 00000000 08:03 1195050                    /usr/lib64/libsoftokn3.so
7f2eff957000-7f2effb56000 ---p 0003f000 08:03 1195050                    /usr/lib64/libsoftokn3.so
7f2effb56000-7f2effb57000 r--p 0003e000 08:03 1195050                    /usr/lib64/libsoftokn3.so
7f2effb57000-7f2effb58000 rw-p 0003f000 08:03 1195050                    /usr/lib64/libsoftokn3.so
7f2effb58000-7f2effbb5000 r-xp 00000000 08:03 1179882                    /usr/lib64/libfreebl3.so
7f2effbb5000-7f2effdb5000 ---p 0005d000 08:03 1179882                    /usr/lib64/libfreebl3.so
7f2effdb5000-7f2effdb6000 r--p 0005d000 08:03 1179882                    /usr/lib64/libfreebl3.so
7f2effdb6000-7f2effdb7000 rw-p 0005e000 08:03 1179882                    /usr/lib64/libfreebl3.so
7f2effdb7000-7f2effdbb000 rw-p 00000000 00:00 0 
7f2effdc0000-7f2effdc8000 r-xp 00000000 08:03 1191496                    /usr/lib64/libcrypt-2.15.so
7f2effdc8000-7f2efffc7000 ---p 00008000 08:03 1191496                    /usr/lib64/libcrypt-2.15.so
7f2efffc7000-7f2efffc8000 r--p 00007000 08:03 1191496                    /usr/lib64/libcrypt-2.15.so
7f2efffc8000-7f2efffc9000 rw-p 00008000 08:03 1191496                    /usr/lib64/libcrypt-2.15.so
7f2efffc9000-7f2effff7000 rw-p 00000000 00:00 0 
7f2effff8000-7f2f0016c000 r-xp 00000000 08:03 1195323                    /usr/lib64/libcrypto.so.1.0.0j
7f2f0016c000-7f2f0036c000 ---p 00174000 08:03 1195323                    /usr/lib64/libcrypto.so.1.0.0j
7f2f0036c000-7f2f0038e000 rw-p 00174000 08:03 1195323                    /usr/lib64/libcrypto.so.1.0.0j
7f2f0038e000-7f2f00392000 rw-p 00000000 00:00 0 
7f2f00398000-7f2f003ec000 r-xp 00000000 08:03 1195328                    /usr/lib64/libssl.so.1.0.0j
7f2f003ec000-7f2f005eb000 ---p 00054000 08:03 1195328                    /usr/lib64/libssl.so.1.0.0j
7f2f005eb000-7f2f005f3000 rw-p 00053000 08:03 1195328                    /usr/lib64/libssl.so.1.0.0j
7f2f005f8000-7f2f005fb000 r-xp 00000000 08:03 1192748                    /usr/lib64/libkeyutils.so.1.4
7f2f005fb000-7f2f007fa000 ---p 00003000 08:03 1192748                    /usr/lib64/libkeyutils.so.1.4
7f2f007fa000-7f2f007fb000 rw-p 00002000 08:03 1192748                    /usr/lib64/libkeyutils.so.1.4
7f2f00800000-7f2f0080a000 r-xp 00000000 08:03 1189174                    /usr/lib64/libkrb5support.so.0.1
7f2f0080a000-7f2f00a09000 ---p 0000a000 08:03 1189174                    /usr/lib64/libkrb5support.so.0.1
7f2f00a09000-7f2f00a0a000 r--p 00009000 08:03 1189174                    /usr/lib64/libkrb5support.so.0.1
7f2f00a0a000-7f2f00a0b000 rw-p 0000a000 08:03 1189174                    /usr/lib64/libkrb5support.so.0.1
7f2f00a10000-7f2f00a29000 r-xp 00000000 08:03 1193844                    /usr/lib64/libsasl2.so.2.0.23
7f2f00a29000-7f2f00c29000 ---p 00019000 08:03 1193844                    /usr/lib64/libsasl2.so.2.0.23
7f2f00c29000-7f2f00c2a000 r--p 00019000 08:03 1193844                    /usr/lib64/libsasl2.so.2.0.23
7f2f00c2a000-7f2f00c2b000 rw-p 0001a000 08:03 1193844                    /usr/lib64/libsasl2.so.2.0.23
7f2f00c30000-7f2f00c57000 r-xp 00000000 08:03 1195440                    /usr/lib64/libssh2.so.1.0.1
7f2f00c57000-7f2f00e57000 ---p 00027000 08:03 1195440                    /usr/lib64/libssh2.so.1.0.1
7f2f00e57000-7f2f00e58000 r--p 00027000 08:03 1195440                    /usr/lib64/libssh2.so.1.0.1
7f2f00e58000-7f2f00e59000 rw-p 00028000 08:03 1195440                    /usr/lib64/libssh2.so.1.0.1
7f2f00e60000-7f2f00e63000 r-xp 00000000 08:03 1183499                    /usr/lib64/libcom_err.so.2.1
7f2f00e63000-7f2f01062000 ---p 00003000 08:03 1183499                    /usr/lib64/libcom_err.so.2.1
7f2f01062000-7f2f01063000 r--p 00002000 08:03 1183499                    /usr/lib64/libcom_err.so.2.1
7f2f01063000-7f2f01064000 rw-p 00003000 08:03 1183499                    /usr/lib64/libcom_err.so.2.1
7f2f01068000-7f2f01090000 r-xp 00000000 08:03 1188997                    /usr/lib64/libk5crypto.so.3.1
7f2f01090000-7f2f01290000 ---p 00028000 08:03 1188997                    /usr/lib64/libk5crypto.so.3.1
7f2f01290000-7f2f01291000 r--p 00028000 08:03 1188997                    /usr/lib64/libk5crypto.so.3.1
7f2f01291000-7f2f01292000 rw-p 00029000 08:03 1188997                    /usr/lib64/libk5crypto.so.3.1
7f2f01292000-7f2f01293000 rw-p 00000000 00:00 0 
7f2f01298000-7f2f01371000 r-xp 00000000 08:03 1188999                    /usr/lib64/libkrb5.so.3.3
7f2f01371000-7f2f01571000 ---p 000d9000 08:03 1188999                    /usr/lib64/libkrb5.so.3.3
7f2f01571000-7f2f0157b000 r--p 000d9000 08:03 1188999                    /usr/lib64/libkrb5.so.3.3
7f2f0157b000-7f2f0157d000 rw-p 000e3000 08:03 1188999                    /usr/lib64/libkrb5.so.3.3
7f2f01580000-7f2f015c1000 r-xp 00000000 08:03 1188704                    /usr/lib64/libgssapi_krb5.so.2.2
7f2f015c1000-7f2f017c1000 ---p 00041000 08:03 1188704                    /usr/lib64/libgssapi_krb5.so.2.2
7f2f017c1000-7f2f017c2000 r--p 00041000 08:03 1188704                    /usr/lib64/libgssapi_krb5.so.2.2
7f2f017c2000-7f2f017c4000 rw-p 00042000 08:03 1188704                    /usr/lib64/libgssapi_krb5.so.2.2
7f2f017c8000-7f2f01814000 r-xp 00000000 08:03 1195577                    /usr/lib64/libldap-2.4.so.2.8.3
7f2f01814000-7f2f01a13000 ---p 0004c000 08:03 1195577                    /usr/lib64/libldap-2.4.so.2.8.3
7f2f01a13000-7f2f01a14000 r--p 0004b000 08:03 1195577                    /usr/lib64/libldap-2.4.so.2.8.3
7f2f01a14000-7f2f01a16000 rw-p 0004c000 08:03 1195577                    /usr/lib64/libldap-2.4.so.2.8.3
7f2f01a18000-7f2f01a26000 r-xp 00000000 08:03 1195576                    /usr/lib64/liblber-2.4.so.2.8.3
7f2f01a26000-7f2f01c25000 ---p 0000e000 08:03 1195576                    /usr/lib64/liblber-2.4.so.2.8.3
7f2f01c25000-7f2f01c26000 r--p 0000d000 08:03 1195576                    /usr/lib64/liblber-2.4.so.2.8.3
7f2f01c26000-7f2f01c27000 rw-p 0000e000 08:03 1195576                    /usr/lib64/liblber-2.4.so.2.8.3
7f2f01c28000-7f2f01c5a000 r-xp 00000000 08:03 1194889                    /usr/lib64/libidn.so.11.6.7
7f2f01c5a000-7f2f01e59000 ---p 00032000 08:03 1194889                    /usr/lib64/libidn.so.11.6.7
7f2f01e59000-7f2f01e5a000 r--p 00031000 08:03 1194889                    /usr/lib64/libidn.so.11.6.7
7f2f01e5a000-7f2f01e5b000 rw-p 00032000 08:03 1194889                    /usr/lib64/libidn.so.11.6.7
7f2f01e60000-7f2f01ebe000 r-xp 00000000 08:03 1181081                    /usr/lib64/libcurl.so.4.2.0
7f2f01ebe000-7f2f020be000 ---p 0005e000 08:03 1181081                    /usr/lib64/libcurl.so.4.2.0
7f2f020be000-7f2f020c0000 r--p 0005e000 08:03 1181081                    /usr/lib64/libcurl.so.4.2.0
7f2f020c0000-7f2f020c1000 rw-p 00060000 08:03 1181081                    /usr/lib64/libcurl.so.4.2.0
7f2f021a9000-7f2f023b0000 rw-p 00000000 00:00 0 
7f2f023b0000-7f2f02652000 rw-s 00000000 00:04 23068693                   /SYSV00000000 (deleted)
7f2f02652000-7f2f02653000 ---p 00000000 00:00 0 
7f2f02653000-7f2f02e53000 rw-p 00000000 00:00 0                          [stack:27452]
7f2f02e53000-7f2f02e54000 ---p 00000000 00:00 0 

Version-Release number of selected component (if applicable):

icedtea-web-1.2-2.fc17.x86_64
webkitgtk-1.8.1-2.fc17.x86_64
gtk2-2.24.11-1.fc17.x86_64
glib2-2.32.4-1.fc17.x86_64

How reproducible:

Always.

Steps to Reproduce:
1.
2.
3.
  
Actual results:

Crash in gtk_widget_destroy(GTK_WIDGET(web_view)), where web_view is a pointer to WebKitWebView that currently displays a page with both Flash and Java applets.

Expected results:

No crash.

Additional info:

Comment 1 Zoltan Boszormenyi 2012-08-04 09:34:13 UTC
Created attachment 602232 [details]
Use g_mutex_free() instead of g_free() on the GMutex

IcedTea-web uses the deprecated API for GMutex, this is the shorter fix.
According to http://developer.gnome.org/glib/2.31/glib-Deprecated-Thread-APIs.html g_mutex_free() must be used on the GMutex pointer that was allocated using g_mutex_new(). g_free() on the GMutex pointer caused the crash.

Comment 2 Zoltan Boszormenyi 2012-08-04 09:43:17 UTC
Created attachment 602233 [details]
Use the new GMutex API

This refreshes IcedTea-web to the latest GLIB 2.32.x GMutex API.
ITNPPluginData.appletviewer_mutex is not a pointer any more, it is initialized with g_mutex_init(), destroyed with g_mutex_clear().

Comment 3 Zoltan Boszormenyi 2012-08-04 16:43:03 UTC
The upstream mercurial tree for icedtea-web-1.2.x already fixed this issue and at least another one, whose symptom is

/home/zozo/rpmbuild/BUILD/icedtea-web-1.2/plugin/icedteanp/IcedTeaNPPlugin.cc:2061: thread 0x1671d50: Error: Invalid plugin function table.

and prohibits loading further web plugins initiated from a Java applet. Please, upgrade Fedora's icedtea-web using

hg clone http://icedtea.classpath.org/hg/release/icedtea-web-1.2/

Comment 4 Deepak Bhole 2012-08-07 14:42:37 UTC
Fixed in pending release:

https://admin.fedoraproject.org/updates/icedtea-web-1.2.1-1.fc17

Comment 5 Fedora End Of Life 2013-07-04 06:59:15 UTC
This message is a reminder that Fedora 17 is nearing its end of life.
Approximately 4 (four) weeks from now Fedora will stop maintaining
and issuing updates for Fedora 17. It is Fedora's policy to close all
bug reports from releases that are no longer maintained. At that time
this bug will be closed as WONTFIX if it remains open with a Fedora 
'version' of '17'.

Package Maintainer: If you wish for this bug to remain open because you
plan to fix it in a currently maintained version, simply change the 'version' 
to a later Fedora version prior to Fedora 17's end of life.

Bug Reporter:  Thank you for reporting this issue and we are sorry that 
we may not be able to fix it before Fedora 17 is end of life. If you 
would still like  to see this bug fixed and are able to reproduce it 
against a later version  of Fedora, you are encouraged  change the 
'version' to a later Fedora version prior to Fedora 17's end of life.

Although we aim to fix as many bugs as possible during every release's 
lifetime, sometimes those efforts are overtaken by events. Often a 
more recent Fedora release includes newer upstream software that fixes 
bugs or makes them obsolete.

Comment 6 Fedora End Of Life 2013-08-01 18:40:51 UTC
Fedora 17 changed to end-of-life (EOL) status on 2013-07-30. Fedora 17 is 
no longer maintained, which means that it will not receive any further 
security or bug fix updates. As a result we are closing this bug.

If you can reproduce this bug against a currently maintained version of 
Fedora please feel free to reopen this bug against that version.

Thank you for reporting this bug and we are sorry it could not be fixed.