Changeset 262016 in webkit

Timestamp:

May 21, 2020 11:03:36 AM (4 years ago)

Author:

Chris Dumez

Message:

ASSERTION FAILED: m_wrapper on fast/events/scoped/editing-commands.html
​https://bugs.webkit.org/show_bug.cgi?id=209862
<rdar://problem/61164607>

Reviewed by Darin Adler.

Make sure ScopedEventQueue keeps its event targets alive using a GCReachableRef<Node>
so that it keeps alive both the target and its JS wrapper.

No new tests, covered by existing test.

• dom/ScopedEventQueue.cpp:

(WebCore::ScopedEventQueue::enqueueEvent):
(WebCore::ScopedEventQueue::dispatchEvent const):
(WebCore::ScopedEventQueue::dispatchAllEvents):

• dom/ScopedEventQueue.h:

Location:

trunk/Source/WebCore

Files:

• ChangeLog (modified) (1 diff)
• dom/ScopedEventQueue.cpp (modified) (1 diff)
• dom/ScopedEventQueue.h (modified) (2 diffs)

trunk/Source/WebCore/ChangeLog

@@ +1 @@
+2020-05-21  Chris Dumez  <cdumez@apple.com>
+
+        ASSERTION FAILED: m_wrapper on fast/events/scoped/editing-commands.html
+        https://bugs.webkit.org/show_bug.cgi?id=209862
+        <rdar://problem/61164607>
+
+        Reviewed by Darin Adler.
+
+        Make sure ScopedEventQueue keeps its event targets alive using a GCReachableRef<Node>
+        so that it keeps alive both the target and its JS wrapper.
+
+        No new tests, covered by existing test.
+
+        * dom/ScopedEventQueue.cpp:
+        (WebCore::ScopedEventQueue::enqueueEvent):
+        (WebCore::ScopedEventQueue::dispatchEvent const):
+        (WebCore::ScopedEventQueue::dispatchAllEvents):
+        * dom/ScopedEventQueue.h:
+
 2020-05-21  Sihui Liu  <sihui_liu@apple.com>
 

trunk/Source/WebCore/dom/ScopedEventQueue.cpp

@@ -47 +47 @@
 {
     ASSERT(is<Node>(event->target()));
+    auto& target = downcast<Node>(*event->target());
+    ScopedEvent scopedEvent = { WTFMove(event), target };
     if (m_scopingLevel)
-        m_queuedEvents.append(WTFMove(event));
+        m_queuedEvents.append(WTFMove(scopedEvent));
     else
-        dispatchEvent(event);
+        dispatchEvent(scopedEvent);
 }
 
-void ScopedEventQueue::dispatchEvent(Event& event) const
+void ScopedEventQueue::dispatchEvent(const ScopedEvent& event) const
 {
-    downcast<Node>(*event.target()).dispatchEvent(event);
+    event.target->dispatchEvent(event.event);
 }
 
 void ScopedEventQueue::dispatchAllEvents()
 {
-    Vector<Ref<Event>> queuedEvents = WTFMove(m_queuedEvents);
+    auto queuedEvents = std::exchange(m_queuedEvents, { });
     for (auto& queuedEvent : queuedEvents)
         dispatchEvent(queuedEvent);

trunk/Source/WebCore/dom/ScopedEventQueue.h

@@ -31 +31 @@
 #pragma once
 
+#include "GCReachableRef.h"
 #include <wtf/Forward.h>
 #include <wtf/Noncopyable.h>
@@ -51 +52 @@
     ~ScopedEventQueue() = delete;
 
-    void dispatchEvent(Event&) const;
+    struct ScopedEvent {
+        Ref<Event> event;
+        GCReachableRef<Node> target;
+    };
+
+    void dispatchEvent(const ScopedEvent&) const;
     void dispatchAllEvents();
     void incrementScopingLevel();
     void decrementScopingLevel();
 
-    Vector<Ref<Event>> m_queuedEvents;
+    Vector<ScopedEvent> m_queuedEvents;
     unsigned m_scopingLevel { 0 };