Changeset 111754 in webkit


Ignore:
Timestamp:
Mar 22, 2012 1:45:36 PM (12 years ago)
Author:
commit-queue@webkit.org
Message:

HTMLPluginElement is not destroyed on reload or navigation if getNPObject is called
​https://bugs.webkit.org/show_bug.cgi?id=80428

Patch by Dave Michael <​dmichael@chromium.org> on 2012-03-22
Reviewed by Eric Seidel.

.:

Test: plugins/netscape-dom-access-and-reload.html

  • Source/autotools/symbols.filter: Export a symbol for InspectorCounters::counterValue.

Source/WebCore:

Make HTMLPluginElement release its m_NPObject in detach() to break a
reference-counting cycle that happens on reload or navigation. With this
change, HTMLPlugInElement::removedFromDocument is unnecessary, so it
was removed. Note that Releasing m_NPObject does not result in a call to
the plugin; it simply releases a reference count on the wrapper object
for this HTMLPlugInElement. (The plugin's NPP_Deallocate is invoked
when the render tree is destroyed, when PluginView calls
PluginPackage::unload.) Thus, it is safe to release m_NPObject in
detach, because it can not result in layout or style changes.

Also added numberOfLiveNodes() and numberOfLiveDocuments() to
window.internals to enable testing.

Test: plugins/netscape-dom-access-and-reload.html

  • WebCore.exp.in:
  • html/HTMLPlugInElement.cpp:

(WebCore::HTMLPlugInElement::detach):

  • html/HTMLPlugInElement.h:

(HTMLPlugInElement):

  • testing/Internals.cpp:

(WebCore::Internals::numberOfLiveDocuments):
(WebCore::Internals::numberOfLiveNodes):
(WebCore):

  • testing/Internals.h:

(Internals):

  • testing/Internals.idl:

Source/WebKit2:

Test: plugins/netscape-dom-access-and-reload.html

  • win/WebKit2.def: Export a symbol for InspectorCounters::counterValue
  • win/WebKit2CFLite.def: Export a symbol for InspectorCounters::counterValue

LayoutTests:

  • plugins/netscape-dom-access-and-reload-expected.txt: Added.
  • plugins/netscape-dom-access-and-reload.html: Added.
Location:
trunk
Files:
2 added
13 edited

Legend:

Unmodified
Added
Removed

  • trunk/ChangeLog

    r111746 r111754  
     12012-03-22  Dave Michael  <dmichael@chromium.org>
     2
     3        HTMLPluginElement is not destroyed on reload or navigation if getNPObject is called
     4        https://bugs.webkit.org/show_bug.cgi?id=80428
     5
     6        Reviewed by Eric Seidel.
     7
     8        Test: plugins/netscape-dom-access-and-reload.html
     9
     10        * Source/autotools/symbols.filter: Export a symbol for InspectorCounters::counterValue.
     11
    1122012-03-22  Kevin Ollivier  <kevino@theolliviers.com>
    213

  • trunk/LayoutTests/ChangeLog

    r111753 r111754  
     12012-03-22  Dave Michael  <dmichael@chromium.org>
     2
     3        HTMLPluginElement is not destroyed on reload or navigation if getNPObject is called
     4        https://bugs.webkit.org/show_bug.cgi?id=80428
     5
     6        Reviewed by Eric Seidel.
     7
     8        * plugins/netscape-dom-access-and-reload-expected.txt: Added.
     9        * plugins/netscape-dom-access-and-reload.html: Added.
     10
    1112012-03-22  Sudarsana Nagineni  <sudarsana.nagineni@linux.intel.com>
    212

  • trunk/Source/WebCore/ChangeLog

    r111752 r111754  
     12012-03-22  Dave Michael  <dmichael@chromium.org>
     2
     3        HTMLPluginElement is not destroyed on reload or navigation if getNPObject is called
     4        https://bugs.webkit.org/show_bug.cgi?id=80428
     5
     6        Reviewed by Eric Seidel.
     7
     8        Make HTMLPluginElement release its m_NPObject in detach() to break a
     9        reference-counting cycle that happens on reload or navigation. With this
     10        change, HTMLPlugInElement::removedFromDocument is unnecessary, so it
     11        was removed. Note that Releasing m_NPObject does not result in a call to
     12        the plugin; it simply releases a reference count on the wrapper object
     13        for this HTMLPlugInElement. (The plugin's NPP_Deallocate is invoked
     14        when the render tree is destroyed, when PluginView calls
     15        PluginPackage::unload.) Thus, it is safe to release m_NPObject in
     16        detach, because it can not result in layout or style changes.
     17
     18        Also added numberOfLiveNodes() and numberOfLiveDocuments() to
     19        window.internals to enable testing.
     20
     21        Test: plugins/netscape-dom-access-and-reload.html
     22
     23        * WebCore.exp.in:
     24        * html/HTMLPlugInElement.cpp:
     25        (WebCore::HTMLPlugInElement::detach):
     26        * html/HTMLPlugInElement.h:
     27        (HTMLPlugInElement):
     28        * testing/Internals.cpp:
     29        (WebCore::Internals::numberOfLiveDocuments):
     30        (WebCore::Internals::numberOfLiveNodes):
     31        (WebCore):
     32        * testing/Internals.h:
     33        (Internals):
     34        * testing/Internals.idl:
     35
    1362012-03-22  Shawn Singh  <shawnsingh@chromium.org>
    237

  • trunk/Source/WebCore/WebCore.exp.in

    r111600 r111754  
    17491749#if ENABLE(INSPECTOR)
    17501750__ZN7WebCore15InspectorClient31doDispatchMessageOnFrontendPageEPNS_4PageERKN3WTF6StringE
     1751__ZN7WebCore17InspectorCounters12counterValueENS0_11CounterTypeE
    17511752__ZN7WebCore19InspectorController14enableProfilerEv
    17521753__ZN7WebCore19InspectorController15disableProfilerEv

  • trunk/Source/WebCore/html/HTMLPlugInElement.cpp

    r109149 r111754  
    7979    }
    8080
    81     HTMLFrameOwnerElement::detach();
    82 }
    83 
    84 void HTMLPlugInElement::removedFromDocument()
    85 {
    8681#if ENABLE(NETSCAPE_PLUGIN_API)
    8782    if (m_NPObject) {
    … …  
    9186#endif
    9287
    93     HTMLFrameOwnerElement::removedFromDocument();
     88    HTMLFrameOwnerElement::detach();
    9489}
    9590

  • trunk/Source/WebCore/html/HTMLPlugInElement.h

    r109149 r111754  
    5858
    5959    virtual void detach();
    60     virtual void removedFromDocument();
    6160    virtual bool isPresentationAttribute(const QualifiedName&) const OVERRIDE;
    6261    virtual void collectStyleForAttribute(Attribute*, StylePropertySet*) OVERRIDE;

  • trunk/Source/WebCore/testing/Internals.cpp

    r111405 r111754  
    4343#include "HTMLTextAreaElement.h"
    4444#include "InspectorController.h"
     45#include "InspectorCounters.h"
    4546#include "InspectorInstrumentation.h"
    4647#include "InternalSettings.h"
    … …  
    771772}
    772773
    773 }
     774#if ENABLE(INSPECTOR)
     775unsigned Internals::numberOfLiveNodes() const
     776{
     777    return InspectorCounters::counterValue(InspectorCounters::NodeCounter);
     778}
     779
     780unsigned Internals::numberOfLiveDocuments() const
     781{
     782    return InspectorCounters::counterValue(InspectorCounters::DocumentCounter);
     783}
     784#endif // ENABLE(INSPECTOR)
     785
     786}

  • trunk/Source/WebCore/testing/Internals.h

    r111405 r111754  
    146146    void setBatteryStatus(Document*, const String& eventType, bool charging, double chargingTime, double dischargingTime, double level, ExceptionCode&);
    147147
     148#if ENABLE(INSPECTOR)
     149    unsigned numberOfLiveNodes() const;
     150    unsigned numberOfLiveDocuments() const;
     151#endif
     152
    148153private:
    149154    explicit Internals(Document*);

  • trunk/Source/WebCore/testing/Internals.idl

    r111405 r111754  
    120120#if defined(ENABLE_BATTERY_STATUS) && ENABLE_BATTERY_STATUS
    121121        void setBatteryStatus(in Document document, in DOMString eventType, in boolean charging, in double chargingTime, in double dischargingTime, in double level) raises (DOMException);
    122 #endif
     122#endif
     123
     124        [Conditional=INSPECTOR] unsigned long numberOfLiveNodes();
     125        [Conditional=INSPECTOR] unsigned long numberOfLiveDocuments();
    123126    };
    124127}

  • trunk/Source/WebKit2/ChangeLog

    r111738 r111754  
     12012-03-22  Dave Michael  <dmichael@chromium.org>
     2
     3        HTMLPluginElement is not destroyed on reload or navigation if getNPObject is called
     4        https://bugs.webkit.org/show_bug.cgi?id=80428
     5
     6        Reviewed by Eric Seidel.
     7
     8        Test: plugins/netscape-dom-access-and-reload.html
     9
     10        * win/WebKit2.def: Export a symbol for InspectorCounters::counterValue
     11        * win/WebKit2CFLite.def: Export a symbol for InspectorCounters::counterValue
     12
    1132012-03-22  Pierre Rossi  <pierre.rossi@gmail.com>
    214

  • trunk/Source/WebKit2/win/WebKit2.def

    r111405 r111754  
    116116        ?broadcast@ThreadCondition@WTF@@QAEXXZ
    117117        ?callOnMainThread@WTF@@YAXP6AXPAX@Z0@Z
     118        ?counterValue@InspectorCounters@WebCore@@SAHW4CounterType@12@@Z
    118119        ?createThread@WTF@@YAIP6APAXPAX@Z0PBD@Z
    119120        ?createThread@WTF@@YAIP6AXPAX@Z0PBD@Z

  • trunk/Source/WebKit2/win/WebKit2CFLite.def

    r110897 r111754  
    109109        ?broadcast@ThreadCondition@WTF@@QAEXXZ
    110110        ?callOnMainThread@WTF@@YAXP6AXPAX@Z0@Z
     111        ?counterValue@InspectorCounters@WebCore@@SAHW4CounterType@12@@Z
    111112        ?createThread@WTF@@YAIP6APAXPAX@Z0PBD@Z
    112113        ?createThread@WTF@@YAIP6AXPAX@Z0PBD@Z

  • trunk/Source/autotools/symbols.filter

    r111405 r111754  
    6060_ZN7WebCore16scriptNameToCodeERKN3WTF6StringE;
    6161_ZN7WebCore17cacheDOMStructureEPNS_17JSDOMGlobalObjectEPN3JSC9StructureEPKNS2_9ClassInfoE;
     62_ZN7WebCore17InspectorCounters12counterValueENS0_11CounterTypeE;
    6263_ZN7WebCore18HTMLContentElement6createEPNS_8DocumentE;
    6364_ZN7WebCore19InspectorController39setResourcesDataSizeLimitsFromInternalsEii;
Note: See TracChangeset for help on using the changeset viewer.