Changeset 125656 in webkit

Timestamp:

Aug 15, 2012 1:26:06 AM (12 years ago)

Author:

abarth@webkit.org

Message:

[Chromium] fast/dom/Window/dom-access-from-closure-window.html is flaky on Linux
​https://bugs.webkit.org/show_bug.cgi?id=94060

Reviewed by Kentaro Hara.

Source/WebCore:

Previously, the V8 garbage collector might have collected the Document
wrapper before the DOMWindow wrapper because we overwrite the
"document" property of the DOMWindow during navigation.

This patch adds a hidden document property on the global object to
ensure that the Document wrapper lives at least as long as the
DOMWindow wrapper, ensuring that DOMWindows that we obtain from V8
always have non-null Document objects.

The JavaScriptCore bindings already have this behavior.

Test: fast/dom/Window/dom-access-from-closure-window-with-gc.html

• bindings/v8/V8DOMWindowShell.cpp:

(WebCore::V8DOMWindowShell::updateDocumentWrapperCache):

• bindings/v8/V8HiddenPropertyName.h:

(WebCore):

LayoutTests:

Ensure that collecting garbage doesn't change the behavior of this test
(compared with dom-access-from-closure-window.html).

• fast/dom/Window/dom-access-from-closure-window-with-gc-expected.txt: Added.
• fast/dom/Window/dom-access-from-closure-window-with-gc.html: Added.

Location:

trunk

Files:

• LayoutTests/ChangeLog (modified) (1 diff)
• LayoutTests/fast/dom/Window/dom-access-from-closure-window-with-gc-expected.txt (added)
• LayoutTests/fast/dom/Window/dom-access-from-closure-window-with-gc.html (added)
• Source/WebCore/ChangeLog (modified) (1 diff)
• Source/WebCore/bindings/v8/V8DOMWindowShell.cpp (modified) (1 diff)
• Source/WebCore/bindings/v8/V8HiddenPropertyName.h (modified) (1 diff)

trunk/LayoutTests/ChangeLog

@@ +1 @@
+2012-08-15  Adam Barth  <abarth@webkit.org>
+
+        [Chromium] fast/dom/Window/dom-access-from-closure-window.html is flaky on Linux
+        https://bugs.webkit.org/show_bug.cgi?id=94060
+
+        Reviewed by Kentaro Hara.
+
+        Ensure that collecting garbage doesn't change the behavior of this test
+        (compared with dom-access-from-closure-window.html).
+
+        * fast/dom/Window/dom-access-from-closure-window-with-gc-expected.txt: Added.
+        * fast/dom/Window/dom-access-from-closure-window-with-gc.html: Added.
+
 2012-08-15  Yuta Kitamura  <yutak@google.com>
 

trunk/Source/WebCore/ChangeLog

@@ +1 @@
+2012-08-15  Adam Barth  <abarth@webkit.org>
+
+        [Chromium] fast/dom/Window/dom-access-from-closure-window.html is flaky on Linux
+        https://bugs.webkit.org/show_bug.cgi?id=94060
+
+        Reviewed by Kentaro Hara.
+
+        Previously, the V8 garbage collector might have collected the Document
+        wrapper before the DOMWindow wrapper because we overwrite the
+        "document" property of the DOMWindow during navigation.
+
+        This patch adds a hidden document property on the global object to
+        ensure that the Document wrapper lives at least as long as the
+        DOMWindow wrapper, ensuring that DOMWindows that we obtain from V8
+        always have non-null Document objects.
+
+        The JavaScriptCore bindings already have this behavior.
+
+        Test: fast/dom/Window/dom-access-from-closure-window-with-gc.html
+
+        * bindings/v8/V8DOMWindowShell.cpp:
+        (WebCore::V8DOMWindowShell::updateDocumentWrapperCache):
+        * bindings/v8/V8HiddenPropertyName.h:
+        (WebCore):
+
 2012-08-14  Andrey Kosyakov  <caseq@chromium.org>
 

trunk/Source/WebCore/bindings/v8/V8DOMWindowShell.cpp

@@ -489 +489 @@
     ASSERT(documentWrapper->IsObject());
     m_context->Global()->ForceSet(v8::String::New("document"), documentWrapper, static_cast<v8::PropertyAttribute>(v8::ReadOnly | v8::DontDelete));
+
+    // We also stash a reference to the document on the real global object so that
+    // DOMWindow objects we obtain from JavaScript references are guaranteed to have
+    // live Document objects.
+    v8::Handle<v8::Object> v8RealGlobal = v8::Handle<v8::Object>::Cast(m_context->Global()->GetPrototype());
+    v8RealGlobal->SetHiddenValue(V8HiddenPropertyName::document(), documentWrapper);
 }
 

trunk/Source/WebCore/bindings/v8/V8HiddenPropertyName.h

@@ -37 +37 @@
 
 #define V8_HIDDEN_PROPERTIES(V) \
+    V(attributeListener) \
+    V(document) \
+    V(domStringMap) \
+    V(domTokenList) \
+    V(event) \
     V(listener) \
-    V(attributeListener) \
+    V(ownerNode) \
     V(scriptState) \
     V(sleepFunction) \
-    V(toStringString) \
-    V(event) \
     V(state) \
-    V(domStringMap) \
-    V(domTokenList) \
-    V(ownerNode) \
-    V(textTracks)
+    V(textTracks) \
+    V(toStringString)
 
     class V8HiddenPropertyName {