Changeset 257482 in webkit


Ignore:
Timestamp:
Feb 26, 2020 10:58:28 AM (4 years ago)
Author:
Chris Dumez
Message:

Unreviewed, rolling out r257389.

Reverted changeset:

"Make sure a client cannot cause a whole DOM tree to get
leaked by simply holding on to a WKBundleNodeHandle"
​https://bugs.webkit.org/show_bug.cgi?id=208218
​https://trac.webkit.org/changeset/257389

Location:
trunk/Source/WebKit
Files:
3 edited

Legend:

Unmodified
Added
Removed

  • trunk/Source/WebKit/ChangeLog

    r257479 r257482  
     12020-02-26  Chris Dumez  <cdumez@apple.com>
     2
     3        Unreviewed, rolling out r257389.
     4
     5        Reverted changeset:
     6
     7        "Make sure a client cannot cause a whole DOM tree to get
     8        leaked by simply holding on to a WKBundleNodeHandle"
     9        https://bugs.webkit.org/show_bug.cgi?id=208218
     10        https://trac.webkit.org/changeset/257389
     11
    1122020-02-26  Jacob Uphoff  <jacob_uphoff@apple.com>
    213

  • trunk/Source/WebKit/WebProcess/InjectedBundle/DOM/InjectedBundleNodeHandle.cpp

    r257471 r257482  
    102102
    103103InjectedBundleNodeHandle::InjectedBundleNodeHandle(Node& node)
    104     : ActiveDOMObject(node.document())
    105     , m_node(&node)
     104    : m_node(node)
    106105{
    107106}
    … …  
    109108InjectedBundleNodeHandle::~InjectedBundleNodeHandle()
    110109{
    111     if (m_node)
    112         domNodeHandleCache().remove(m_node.get());
     110    domNodeHandleCache().remove(m_node.ptr());
    113111}
    114112
    115113Node* InjectedBundleNodeHandle::coreNode()
    116114{
    117     return m_node.get();
    118 }
    119 
    120 RefPtr<InjectedBundleNodeHandle> InjectedBundleNodeHandle::document()
    121 {
    122     if (!m_node)
    123         return nullptr;
    124 
     115    return m_node.ptr();
     116}
     117
     118Ref<InjectedBundleNodeHandle> InjectedBundleNodeHandle::document()
     119{
    125120    return getOrCreate(m_node->document());
    126121}
    … …  
    134129        return IntRect();
    135130
    136     return downcast<Element>(*m_node).boundsInRootViewSpace();
     131    return downcast<Element>(m_node.get()).boundsInRootViewSpace();
    137132}
    138133   
    139134IntRect InjectedBundleNodeHandle::renderRect(bool* isReplaced)
    140135{
    141     if (!m_node)
    142         return { };
    143 
    144136    return m_node->pixelSnappedRenderRect(isReplaced);
    145137}
    … …  
    199191RefPtr<WebImage> InjectedBundleNodeHandle::renderedImage(SnapshotOptions options, bool shouldExcludeOverflow, const Optional<float>& bitmapWidth)
    200192{
    201     if (!m_node)
    202         return nullptr;
    203 
    204193    Frame* frame = m_node->document().frame();
    205194    if (!frame)
    … …  
    224213    }
    225214
    226     frameView->setNodeToDraw(m_node.get());
     215    frameView->setNodeToDraw(m_node.ptr());
    227216    auto image = imageForRect(frameView, paintingRect, bitmapWidth, options);
    228217    frameView->setNodeToDraw(0);
    … …  
    233222RefPtr<InjectedBundleRangeHandle> InjectedBundleNodeHandle::visibleRange()
    234223{
    235     if (!m_node)
    236         return nullptr;
    237 
    238     VisiblePosition start = firstPositionInNode(m_node.get());
    239     VisiblePosition end = lastPositionInNode(m_node.get());
     224    VisiblePosition start = firstPositionInNode(m_node.ptr());
     225    VisiblePosition end = lastPositionInNode(m_node.ptr());
    240226
    241227    RefPtr<Range> range = makeRange(start, end);
    … …  
    248234        return;
    249235
    250     downcast<HTMLInputElement>(*m_node).setValueForUser(value);
     236    downcast<HTMLInputElement>(m_node.get()).setValueForUser(value);
    251237}
    252238
    … …  
    256242        return;
    257243
    258     downcast<HTMLInputElement>(*m_node).setSpellcheckDisabledExceptTextReplacement(!enabled);
     244    downcast<HTMLInputElement>(m_node.get()).setSpellcheckDisabledExceptTextReplacement(!enabled);
    259245}
    260246
    … …  
    264250        return false;
    265251   
    266     return downcast<HTMLInputElement>(*m_node).isAutoFilled();
     252    return downcast<HTMLInputElement>(m_node.get()).isAutoFilled();
    267253}
    268254
    … …  
    272258        return false;
    273259
    274     return downcast<HTMLInputElement>(*m_node).isAutoFilledAndViewable();
     260    return downcast<HTMLInputElement>(m_node.get()).isAutoFilledAndViewable();
    275261}
    276262
    … …  
    280266        return;
    281267
    282     downcast<HTMLInputElement>(*m_node).setAutoFilled(filled);
     268    downcast<HTMLInputElement>(m_node.get()).setAutoFilled(filled);
    283269}
    284270
    … …  
    288274        return;
    289275
    290     downcast<HTMLInputElement>(*m_node).setAutoFilledAndViewable(autoFilledAndViewable);
     276    downcast<HTMLInputElement>(m_node.get()).setAutoFilledAndViewable(autoFilledAndViewable);
    291277}
    292278
    … …  
    296282        return false;
    297283   
    298     return downcast<HTMLInputElement>(*m_node).autoFillButtonType() != AutoFillButtonType::None;
     284    return downcast<HTMLInputElement>(m_node.get()).autoFillButtonType() != AutoFillButtonType::None;
    299285}
    300286
    … …  
    304290        return;
    305291
    306     downcast<HTMLInputElement>(*m_node).setShowAutoFillButton(autoFillButtonType);
     292    downcast<HTMLInputElement>(m_node.get()).setShowAutoFillButton(autoFillButtonType);
    307293}
    308294
    … …  
    311297    if (!is<HTMLInputElement>(m_node))
    312298        return AutoFillButtonType::None;
    313     return downcast<HTMLInputElement>(*m_node).autoFillButtonType();
     299    return downcast<HTMLInputElement>(m_node.get()).autoFillButtonType();
    314300}
    315301
    … …  
    318304    if (!is<HTMLInputElement>(m_node))
    319305        return AutoFillButtonType::None;
    320     return downcast<HTMLInputElement>(*m_node).lastAutoFillButtonType();
     306    return downcast<HTMLInputElement>(m_node.get()).lastAutoFillButtonType();
    321307}
    322308
    … …  
    326312        return false;
    327313
    328     return downcast<HTMLInputElement>(*m_node).isAutoFillAvailable();
     314    return downcast<HTMLInputElement>(m_node.get()).isAutoFillAvailable();
    329315}
    330316
    … …  
    334320        return;
    335321
    336     downcast<HTMLInputElement>(*m_node).setAutoFillAvailable(autoFillAvailable);
     322    downcast<HTMLInputElement>(m_node.get()).setAutoFillAvailable(autoFillAvailable);
    337323}
    338324
    … …  
    342328        return IntRect();
    343329
    344     auto autoFillButton = downcast<HTMLInputElement>(*m_node).autoFillButtonElement();
     330    auto autoFillButton = downcast<HTMLInputElement>(m_node.get()).autoFillButtonElement();
    345331    if (!autoFillButton)
    346332        return IntRect();
    … …  
    354340        return false;
    355341
    356     return downcast<HTMLInputElement>(*m_node).lastChangeWasUserEdit();
     342    return downcast<HTMLInputElement>(m_node.get()).lastChangeWasUserEdit();
    357343}
    358344
    … …  
    362348        return false;
    363349
    364     return downcast<HTMLTextAreaElement>(*m_node).lastChangeWasUserEdit();
     350    return downcast<HTMLTextAreaElement>(m_node.get()).lastChangeWasUserEdit();
    365351}
    366352
    … …  
    370356        return false;
    371357
    372     return downcast<HTMLInputElement>(*m_node).isTextField();
     358    return downcast<HTMLInputElement>(m_node.get()).isTextField();
    373359}
    374360
    … …  
    383369        return nullptr;
    384370
    385     return getOrCreate(downcast<HTMLTableCellElement>(*m_node).cellAbove());
     371    return getOrCreate(downcast<HTMLTableCellElement>(m_node.get()).cellAbove());
    386372}
    387373
    388374RefPtr<WebFrame> InjectedBundleNodeHandle::documentFrame()
    389375{
    390     if (!m_node || !m_node->isDocumentNode())
    391         return nullptr;
    392 
    393     Frame* frame = downcast<Document>(*m_node).frame();
     376    if (!m_node->isDocumentNode())
     377        return nullptr;
     378
     379    Frame* frame = downcast<Document>(m_node.get()).frame();
    394380    if (!frame)
    395381        return nullptr;
    … …  
    403389        return nullptr;
    404390
    405     Frame* frame = downcast<HTMLFrameElement>(*m_node).contentFrame();
     391    Frame* frame = downcast<HTMLFrameElement>(m_node.get()).contentFrame();
    406392    if (!frame)
    407393        return nullptr;
    … …  
    415401        return nullptr;
    416402
    417     Frame* frame = downcast<HTMLIFrameElement>(*m_node).contentFrame();
     403    Frame* frame = downcast<HTMLIFrameElement>(m_node.get()).contentFrame();
    418404    if (!frame)
    419405        return nullptr;
    … …  
    422408}
    423409
    424 void InjectedBundleNodeHandle::stop()
    425 {
    426     // Invalidate handles to nodes inside documents that are about to be destroyed in order to prevent leaks.
    427     if (m_node) {
    428         domNodeHandleCache().remove(m_node.get());
    429         m_node = nullptr;
    430     }
    431 }
    432 
    433 const char* InjectedBundleNodeHandle::activeDOMObjectName() const
    434 {
    435     return "InjectedBundleNodeHandle";
    436 }
    437 
    438410} // namespace WebKit

  • trunk/Source/WebKit/WebProcess/InjectedBundle/DOM/InjectedBundleNodeHandle.h

    r257389 r257482  
    2929#include "ImageOptions.h"
    3030#include <JavaScriptCore/JSBase.h>
    31 #include <WebCore/ActiveDOMObject.h>
    3231#include <wtf/Forward.h>
    3332#include <wtf/Optional.h>
    … …  
    4746class WebImage;
    4847
    49 class InjectedBundleNodeHandle : public API::ObjectImpl<API::Object::Type::BundleNodeHandle>, public WebCore::ActiveDOMObject {
     48class InjectedBundleNodeHandle : public API::ObjectImpl<API::Object::Type::BundleNodeHandle> {
    5049public:
    5150    static RefPtr<InjectedBundleNodeHandle> getOrCreate(JSContextRef, JSObjectRef);
    … …  
    5857
    5958    // Convenience DOM Operations
    60     RefPtr<InjectedBundleNodeHandle> document();
     59    Ref<InjectedBundleNodeHandle> document();
    6160
    6261    // Additional DOM Operations
    … …  
    9493    InjectedBundleNodeHandle(WebCore::Node&);
    9594
    96     // ActiveDOMObject.
    97     void stop() final;
    98     const char* activeDOMObjectName() const final;
    99 
    100     RefPtr<WebCore::Node> m_node;
     95    Ref<WebCore::Node> m_node;
    10196};
    10297
Note: See TracChangeset for help on using the changeset viewer.