⚠ Archived content — this site is no longer maintained.   Current WebKit documentation is at docs.webkit.org.

Changeset 96991 in webkit


Ignore:
Timestamp:
Oct 7, 2011, 4:58:42 PM (15 years ago)
Author:
commit-queue@webkit.org
Message:

​https://bugs.webkit.org/show_bug.cgi?id=69471

We now wrap the window script NPObject which is requested by NPAPI plugins for
scripting. The wrapped NPObject pointer maintains a weak reference to the
window script NPObject and is cleared out when the window script object is destroyed.
The NPObject wrapper is destroyed when the last outstanding reference is released.

Reviewed by Nate Chapin.

No tests added as there is no change in functionality.

Patch by Anantanarayanan G Iyengar <​ananta@chromium.org> on 2011-10-07

  • WebCore.gypi:
  • bindings/v8/NPObjectWrapper.cpp: Added.

(WebCore::NPObjectWrapper::NPObjectWrapper):
(WebCore::NPObjectWrapper::create):
(WebCore::NPObjectWrapper::clear):
(WebCore::NPObjectWrapper::getWrapper):
(WebCore::NPObjectWrapper::getUnderlyingNPObject):
(WebCore::NPObjectWrapper::getObjectForCall):
(WebCore::NPObjectWrapper::NPAllocate):
(WebCore::NPObjectWrapper::NPDeallocate):
(WebCore::NPObjectWrapper::NPPInvalidate):
(WebCore::NPObjectWrapper::NPHasMethod):
(WebCore::NPObjectWrapper::NPInvoke):
(WebCore::NPObjectWrapper::NPInvokeDefault):
(WebCore::NPObjectWrapper::NPHasProperty):
(WebCore::NPObjectWrapper::NPGetProperty):
(WebCore::NPObjectWrapper::NPSetProperty):
(WebCore::NPObjectWrapper::NPRemoveProperty):
(WebCore::NPObjectWrapper::NPNEnumerate):
(WebCore::NPObjectWrapper::NPNConstruct):
(WebCore::NPObjectWrapper::NPInvokePrivate):

  • bindings/v8/NPObjectWrapper.h: Added.
  • bindings/v8/NPV8Object.cpp:

(_NPN_EvaluateHelper):

  • bindings/v8/ScriptController.cpp:

(WebCore::ScriptController::ScriptController):
(WebCore::ScriptController::clearScriptObjects):
(WebCore::ScriptController::windowScriptNPObject):

  • bindings/v8/ScriptController.h:
Location:
trunk/Source/WebCore
Files:
2 added
5 edited

Legend:

Unmodified
Added
Removed

  • trunk/Source/WebCore/ChangeLog

    r96990 r96991  
     12011-10-07  Anantanarayanan G Iyengar  <ananta@chromium.org>
     2
     3         https://bugs.webkit.org/show_bug.cgi?id=69471
     4
     5         We now wrap the window script NPObject which is requested by NPAPI plugins for
     6         scripting. The wrapped NPObject pointer maintains a weak reference to the
     7         window script NPObject and is cleared out when the window script object is destroyed.
     8         The NPObject wrapper is destroyed when the last outstanding reference is released.
     9
     10         Reviewed by Nate Chapin.
     11
     12         No tests added as there is no change in functionality.
     13
     14        * WebCore.gypi:
     15        * bindings/v8/NPObjectWrapper.cpp: Added.
     16        (WebCore::NPObjectWrapper::NPObjectWrapper):
     17        (WebCore::NPObjectWrapper::create):
     18        (WebCore::NPObjectWrapper::clear):
     19        (WebCore::NPObjectWrapper::getWrapper):
     20        (WebCore::NPObjectWrapper::getUnderlyingNPObject):
     21        (WebCore::NPObjectWrapper::getObjectForCall):
     22        (WebCore::NPObjectWrapper::NPAllocate):
     23        (WebCore::NPObjectWrapper::NPDeallocate):
     24        (WebCore::NPObjectWrapper::NPPInvalidate):
     25        (WebCore::NPObjectWrapper::NPHasMethod):
     26        (WebCore::NPObjectWrapper::NPInvoke):
     27        (WebCore::NPObjectWrapper::NPInvokeDefault):
     28        (WebCore::NPObjectWrapper::NPHasProperty):
     29        (WebCore::NPObjectWrapper::NPGetProperty):
     30        (WebCore::NPObjectWrapper::NPSetProperty):
     31        (WebCore::NPObjectWrapper::NPRemoveProperty):
     32        (WebCore::NPObjectWrapper::NPNEnumerate):
     33        (WebCore::NPObjectWrapper::NPNConstruct):
     34        (WebCore::NPObjectWrapper::NPInvokePrivate):
     35        * bindings/v8/NPObjectWrapper.h: Added.
     36        * bindings/v8/NPV8Object.cpp:
     37        (_NPN_EvaluateHelper):
     38        * bindings/v8/ScriptController.cpp:
     39        (WebCore::ScriptController::ScriptController):
     40        (WebCore::ScriptController::clearScriptObjects):
     41        (WebCore::ScriptController::windowScriptNPObject):
     42        * bindings/v8/ScriptController.h:
     43
    1442011-10-07  Antoine Labour  <piman@chromium.org>
    245

  • trunk/Source/WebCore/WebCore.gypi

    r96966 r96991  
    20172017            'bindings/v8/JavaScriptCallFrame.cpp',
    20182018            'bindings/v8/JavaScriptCallFrame.h',
     2019            'bindings/v8/NPObjectWrapper.cpp',
     2020            'bindings/v8/NPObjectWrapper.h',
    20192021            'bindings/v8/NPV8Object.cpp',
    20202022            'bindings/v8/NPV8Object.h',

  • trunk/Source/WebCore/bindings/v8/NPV8Object.cpp

    r95901 r96991  
    3232#include "DOMWindow.h"
    3333#include "Frame.h"
     34#include "NPObjectWrapper.h"
    3435#include "OwnArrayPtr.h"
    3536#include "PlatformString.h"
    … …  
    284285        return false;
    285286
    286     if (npObject->_class != npScriptObjectClass)
    287         return false;
     287    if (npObject->_class != npScriptObjectClass) {
     288        // Check if the object passed in is wrapped. If yes, then we need to invoke on the underlying object.
     289        NPObject* actualObject = NPObjectWrapper::getUnderlyingNPObject(npObject);
     290        if (!actualObject)
     291            return false;
     292        npObject = actualObject;
     293    }
    288294
    289295    v8::HandleScope handleScope;

  • trunk/Source/WebCore/bindings/v8/ScriptController.cpp

    r95901 r96991  
    4646#include "Node.h"
    4747#include "NotImplemented.h"
     48#include "NPObjectWrapper.h"
    4849#include "npruntime_impl.h"
    4950#include "npruntime_priv.h"
    … …  
    114115    , m_proxy(adoptPtr(new V8Proxy(frame)))
    115116#if ENABLE(NETSCAPE_PLUGIN_API)
    116     , m_windowScriptNPObject(0)
     117    , m_wrappedWindowScriptNPObject(0)
    117118#endif
    118119{
    … …  
    133134
    134135#if ENABLE(NETSCAPE_PLUGIN_API)
    135     if (m_windowScriptNPObject) {
     136    if (m_wrappedWindowScriptNPObject) {
     137        NPObjectWrapper* windowScriptObjectWrapper = NPObjectWrapper::getWrapper(m_wrappedWindowScriptNPObject);
     138        ASSERT(windowScriptObjectWrapper);
     139
     140        NPObject* windowScriptNPObject = NPObjectWrapper::getUnderlyingNPObject(m_wrappedWindowScriptNPObject);
     141        ASSERT(windowScriptNPObject);
    136142        // Call _NPN_DeallocateObject() instead of _NPN_ReleaseObject() so that we don't leak if a plugin fails to release the window
    137143        // script object properly.
    138144        // This shouldn't cause any problems for plugins since they should have already been stopped and destroyed at this point.
    139         _NPN_DeallocateObject(m_windowScriptNPObject);
    140         m_windowScriptNPObject = 0;
     145        _NPN_DeallocateObject(windowScriptNPObject);
     146
     147        // Clear out the wrapped window script object pointer held by the wrapper.
     148        windowScriptObjectWrapper->clear();
     149        _NPN_ReleaseObject(m_wrappedWindowScriptNPObject);
     150        m_wrappedWindowScriptNPObject = 0;
    141151    }
    142152#endif
    … …  
    360370NPObject* ScriptController::windowScriptNPObject()
    361371{
    362     if (m_windowScriptNPObject)
    363         return m_windowScriptNPObject;
    364 
     372    if (m_wrappedWindowScriptNPObject)
     373        return m_wrappedWindowScriptNPObject;
     374
     375    NPObject* windowScriptNPObject = 0;
    365376    if (canExecuteScripts(NotAboutToExecuteScript)) {
    366377        // JavaScript is enabled, so there is a JavaScript window object.
    367378        // Return an NPObject bound to the window object.
    368         m_windowScriptNPObject = createScriptObject(m_frame);
    369         _NPN_RegisterObject(m_windowScriptNPObject, 0);
     379        windowScriptNPObject = createScriptObject(m_frame);
     380        _NPN_RegisterObject(windowScriptNPObject, 0);
    370381    } else {
    371382        // JavaScript is not enabled, so we cannot bind the NPObject to the
    372383        // JavaScript window object. Instead, we create an NPObject of a
    373384        // different class, one which is not bound to a JavaScript object.
    374         m_windowScriptNPObject = createNoScriptObject();
     385        windowScriptNPObject = createNoScriptObject();
    375386    }
    376     return m_windowScriptNPObject;
     387
     388    m_wrappedWindowScriptNPObject = NPObjectWrapper::create(windowScriptNPObject);
     389    return m_wrappedWindowScriptNPObject;
    377390}
    378391

  • trunk/Source/WebCore/bindings/v8/ScriptController.h

    r95901 r96991  
    209209    PluginObjectMap m_pluginObjects;
    210210#if ENABLE(NETSCAPE_PLUGIN_API)
    211     NPObject* m_windowScriptNPObject;
     211    // The window script object can get destroyed while there are outstanding
     212    // references to it. Please refer to ScriptController::clearScriptObjects
     213    // for more information as to why this is necessary. To avoid crashes due
     214    // to calls on the destroyed window object, we return a proxy NPObject
     215    // which wraps the underlying window object. The wrapped window object
     216    // pointer in this object is cleared out when the window object is
     217    // destroyed.
     218    NPObject* m_wrappedWindowScriptNPObject;
    212219#endif
    213220};
Note: See TracChangeset for help on using the changeset viewer.