GNOME Bugzilla – Bug 537456
plugin crashes in webkit browsers
Last modified: 2009-09-15 00:27:34 UTC
Steps to repro: 0) Use totem plugin svn trunk in webkit GtkLauncher 1) Browse through apple.com/trailers Sooner or later, it'll 'crash'. More precisely, dbus calls _exit behind our back: (gdb) where
+ Trace 199959
Try calling dbus_connection_set_exit_on_disconnect() with FALSE in totemPlugin::Init(). Should avoid exiting when a (shared?) connection goes away.
That seems to 'fix' it. However I'm not sure it's the right thing: a) we share the connection with the host browser, which may not expect disappearing dbus connection b) there's got to be a cause for the dbus disconnects just when the plugin viewer starts up...
Is this still a problem?
Yes, this still happens with webkit trunk, using totem + gtk+ trunk, libdbus 1.1.20, dbus-glib 0.76. Trace as in comment 0.
Ok, I figured out what's happening here. I annotated all dbus calls in the plugin to validate strings, and it turns out we're trying to pass invalid UTF-8 over dbus. When that happens, we get disconnected from the bus of course. Example: ** Message: totemNarrowSpacePlayer [0xa0069a8] ** Message: Base URI is 'http://www.apple.com/trailers/fox/australia/small2.htmlIQ\xf2\u0006' [...] CRITICAL **: ATTN! [Line 1058] Trying to pass non-UTF8 string over DBUS! [http://www.apple.com/trailers/fox/australia/small2.htmlIQ\362\006][len=59 pos=57] from totemPlugin.cpp: mViewerPendingCall = dbus_g_proxy_begin_call (mViewerProxy, "OpenStream", ViewerOpenStreamCallback, reinterpret_cast<void*>(this), NULL, G_TYPE_STRING, DO_VALIDATE_UTF8 (requestURI), 1058 G_TYPE_STRING, DO_VALIDATE_UTF8 (baseURI), G_TYPE_INVALID); This is however NOT reproducible at will with always the same trailer, you have to browse around a bit. It seems this is memory corruption going on in webkit... It's the baseURI, which is obtained through NPAPI calls into webkit.
Another possibility to memory corruption is that the assumption that strings passed over NPAPI are always 0-terminated that's used in totemPlugin is wrong.
Now that 2.28 will ship with webkit-based epiphany, I think this is more critical. I'll try to have a stab at fixing it.
Created attachment 143083 [details] [review] possible fix (untested)
Comment on attachment 143083 [details] [review] possible fix (untested) Committed after approval from Bastien on IRC.
Fixed?
I still see things like this: ** (epiphany:16700): DEBUG: 0x2784990: "Base URI is 'http://www.apple.com/trailers/fox/australia/small2.html;1'" Missing a few cases where we need to truncate? I've fixed that one. Let's reopen if we find more...