Changeset 29362 in webkit


Ignore:
Timestamp:
Jan 10, 2008 9:39:03 AM (16 years ago)
Author:
mitz@apple.com
Message:

JavaScriptCore:

Reviewed by Darin Adler.

The crash resulted from a native object (DumpRenderTree's
EventSender) causing its wrapper to be invalidated (by clicking a
link that replaced the document in the window) and consequently
deallocated. The fix is to use RefPtrs to protect the native object
from deletion by self-invalidation.

  • bindings/runtime_method.cpp: (RuntimeMethod::callAsFunction):
  • bindings/runtime_object.cpp: (RuntimeObjectImp::fallbackObjectGetter): (RuntimeObjectImp::fieldGetter): (RuntimeObjectImp::methodGetter): (RuntimeObjectImp::put): (RuntimeObjectImp::defaultValue): (RuntimeObjectImp::callAsFunction):

LayoutTests:

Reviewed by Darin Adler.

  • fast/replaced/image-map-expected.txt: Updated results for the new behavior, which is to replace the document with the success message.
  • fast/replaced/image-map.html: Copied from LayoutTests/fast/replaced/image-map.html-disabled.
  • fast/replaced/image-map.html-disabled: Removed.
Location:
trunk
Files:
5 edited
1 moved

Legend:

Unmodified
Added
Removed

  • trunk/JavaScriptCore/ChangeLog

    r29293 r29362  
     12008-01-10  Dan Bernstein  <mitz@apple.com>
     2
     3        Reviewed by Darin Adler.
     4
     5        - fix http://bugs.webkit.org/show_bug.cgi?id=16782
     6          <rdar://problem/5675331> REGRESSION(r29266): Reproducible crash in fast/replaced/image-map.html
     7
     8        The crash resulted from a native object (DumpRenderTree's
     9        EventSender) causing its wrapper to be invalidated (by clicking a
     10        link that replaced the document in the window) and consequently
     11        deallocated. The fix is to use RefPtrs to protect the native object
     12        from deletion by self-invalidation.
     13
     14        * bindings/runtime_method.cpp:
     15        (RuntimeMethod::callAsFunction):
     16        * bindings/runtime_object.cpp:
     17        (RuntimeObjectImp::fallbackObjectGetter):
     18        (RuntimeObjectImp::fieldGetter):
     19        (RuntimeObjectImp::methodGetter):
     20        (RuntimeObjectImp::put):
     21        (RuntimeObjectImp::defaultValue):
     22        (RuntimeObjectImp::callAsFunction):
     23
    1242008-01-07  Mark Rowe  <mrowe@apple.com>
    225

  • trunk/JavaScriptCore/bindings/runtime_method.cpp

    r28907 r29362  
    8484        return throwError(exec, TypeError);
    8585
    86     Instance *instance = imp->getInternalInstance();
     86    RefPtr<Instance> instance = imp->getInternalInstance();
    8787    if (!instance)
    8888        return RuntimeObjectImp::throwInvalidAccessError(exec);

  • trunk/JavaScriptCore/bindings/runtime_object.cpp

    r27413 r29362  
    5858{
    5959    RuntimeObjectImp *thisObj = static_cast<RuntimeObjectImp *>(slot.slotBase());
    60     Bindings::Instance *instance = thisObj->instance.get();
    61 
    62     if (!instance)
    63         return throwInvalidAccessError(exec);
    64    
    65     instance->begin();
    66 
    67     Class *aClass = instance->getClass();
    68     JSValue *result = aClass->fallbackObject(exec, instance, propertyName);
     60    RefPtr<Bindings::Instance> instance = thisObj->instance;
     61
     62    if (!instance)
     63        return throwInvalidAccessError(exec);
     64   
     65    instance->begin();
     66
     67    Class *aClass = instance->getClass();
     68    JSValue* result = aClass->fallbackObject(exec, instance.get(), propertyName);
    6969
    7070    instance->end();
    … …  
    7676{   
    7777    RuntimeObjectImp *thisObj = static_cast<RuntimeObjectImp *>(slot.slotBase());
    78     Bindings::Instance *instance = thisObj->instance.get();
    79 
    80     if (!instance)
    81         return throwInvalidAccessError(exec);
    82    
    83     instance->begin();
    84 
    85     Class *aClass = instance->getClass();
    86     Field *aField = aClass->fieldNamed(propertyName, instance);
     78    RefPtr<Bindings::Instance> instance = thisObj->instance;
     79
     80    if (!instance)
     81        return throwInvalidAccessError(exec);
     82   
     83    instance->begin();
     84
     85    Class *aClass = instance->getClass();
     86    Field* aField = aClass->fieldNamed(propertyName, instance.get());
    8787    JSValue *result = instance->getValueOfField(exec, aField);
    8888   
    … …  
    9595{
    9696    RuntimeObjectImp *thisObj = static_cast<RuntimeObjectImp *>(slot.slotBase());
    97     Bindings::Instance *instance = thisObj->instance.get();
    98 
    99     if (!instance)
    100         return throwInvalidAccessError(exec);
    101    
    102     instance->begin();
    103 
    104     Class *aClass = instance->getClass();
    105     MethodList methodList = aClass->methodsNamed(propertyName, instance);
     97    RefPtr<Bindings::Instance> instance = thisObj->instance;
     98
     99    if (!instance)
     100        return throwInvalidAccessError(exec);
     101   
     102    instance->begin();
     103
     104    Class *aClass = instance->getClass();
     105    MethodList methodList = aClass->methodsNamed(propertyName, instance.get());
    106106    JSValue *result = new RuntimeMethod(exec, propertyName, methodList);
    107107
    … …  
    162162    }
    163163   
     164    RefPtr<Bindings::Instance> protector(instance);
    164165    instance->begin();
    165166
    … …  
    203204    JSValue *result;
    204205   
     206    RefPtr<Bindings::Instance> protector(instance);
    205207    instance->begin();
    206208
    … …  
    225227        return throwInvalidAccessError(exec);
    226228
     229    RefPtr<Bindings::Instance> protector(instance);
    227230    instance->begin();
    228231

  • trunk/LayoutTests/ChangeLog

    r29351 r29362  
     12008-01-10  Dan Bernstein  <mitz@apple.com>
     2
     3        Reviewed by Darin Adler.
     4
     5        - re-enable crashing test after fixing http://bugs.webkit.org/show_bug.cgi?id=16782
     6          <rdar://problem/5675331> REGRESSION(r29266): Reproducible crash in fast/replaced/image-map.html
     7
     8        * fast/replaced/image-map-expected.txt: Updated results for the new
     9        behavior, which is to replace the document with the success message.
     10        * fast/replaced/image-map.html: Copied from LayoutTests/fast/replaced/image-map.html-disabled.
     11        * fast/replaced/image-map.html-disabled: Removed.
     12
    1132008-01-10  Dan Bernstein  <mitz@apple.com>
    214

  • trunk/LayoutTests/fast/replaced/image-map-expected.txt

    r21687 r29362  
    1 
    21area clicked
Note: See TracChangeset for help on using the changeset viewer.