Changeset 48492 in webkit


Ignore:
Timestamp:
Sep 17, 2009 3:23:37 PM (15 years ago)
Author:
andersca@apple.com
Message:

WebCore: <rdar://problem/7007541>
CrashTracer: 4800+ crashes in Safari at com.apple.WebKit • WTF::HashTableIterator...

Reviewed by Oliver Hunt.

Make RuntimeObjectImp more robust against m_instance being a null (which can happen if an OOP plug-in
crashes while we're calling into it).

  • bridge/runtime_object.cpp:

(JSC::RuntimeObjectImp::RuntimeObjectImp):
(JSC::RuntimeObjectImp::~RuntimeObjectImp):
(JSC::RuntimeObjectImp::invalidate):
(JSC::RuntimeObjectImp::fallbackObjectGetter):
(JSC::RuntimeObjectImp::fieldGetter):
(JSC::RuntimeObjectImp::methodGetter):
(JSC::RuntimeObjectImp::getOwnPropertySlot):
(JSC::RuntimeObjectImp::getOwnPropertyDescriptor):
(JSC::RuntimeObjectImp::put):
(JSC::RuntimeObjectImp::defaultValue):
(JSC::RuntimeObjectImp::getCallData):
(JSC::RuntimeObjectImp::getConstructData):
(JSC::RuntimeObjectImp::getPropertyNames):

  • bridge/runtime_object.h:

(JSC::RuntimeObjectImp::getInternalInstance):

WebKit/mac: <rdar://problem/7007541>
CrashTracer: 4800+ crashes in Safari at com.apple.WebKit • WTF::HashTableIterator...

Reviewed by Oliver Hunt.

Add null checks for m_instanceProxy (It will be null when a plug-in has crashed).

  • Plugins/Hosted/ProxyInstance.mm:

(WebKit::ProxyInstance::invoke):
(WebKit::ProxyInstance::supportsInvokeDefaultMethod):
(WebKit::ProxyInstance::supportsConstruct):
(WebKit::ProxyInstance::getPropertyNames):
(WebKit::ProxyInstance::methodsNamed):
(WebKit::ProxyInstance::fieldNamed):
(WebKit::ProxyInstance::fieldValue):
(WebKit::ProxyInstance::setFieldValue):
(WebKit::ProxyInstance::invalidate):

Location:
trunk
Files:
5 edited

Legend:

Unmodified
Added
Removed

  • trunk/WebCore/ChangeLog

    r48491 r48492  
     12009-09-17  Anders Carlsson  <andersca@apple.com>
     2
     3        Reviewed by Oliver Hunt.
     4
     5        <rdar://problem/7007541>
     6        CrashTracer: 4800+ crashes in Safari at com.apple.WebKit • WTF::HashTableIterator...
     7       
     8        Make RuntimeObjectImp more robust against m_instance being a null (which can happen if an OOP plug-in
     9        crashes while we're calling into it).
     10       
     11        * bridge/runtime_object.cpp:
     12        (JSC::RuntimeObjectImp::RuntimeObjectImp):
     13        (JSC::RuntimeObjectImp::~RuntimeObjectImp):
     14        (JSC::RuntimeObjectImp::invalidate):
     15        (JSC::RuntimeObjectImp::fallbackObjectGetter):
     16        (JSC::RuntimeObjectImp::fieldGetter):
     17        (JSC::RuntimeObjectImp::methodGetter):
     18        (JSC::RuntimeObjectImp::getOwnPropertySlot):
     19        (JSC::RuntimeObjectImp::getOwnPropertyDescriptor):
     20        (JSC::RuntimeObjectImp::put):
     21        (JSC::RuntimeObjectImp::defaultValue):
     22        (JSC::RuntimeObjectImp::getCallData):
     23        (JSC::RuntimeObjectImp::getConstructData):
     24        (JSC::RuntimeObjectImp::getPropertyNames):
     25        * bridge/runtime_object.h:
     26        (JSC::RuntimeObjectImp::getInternalInstance):
     27
    1282009-09-17  Yury Semikhatsky  <yurys@chromium.org>
    229

  • trunk/WebCore/bridge/runtime_object.cpp

    r48336 r48492  
    4141const ClassInfo RuntimeObjectImp::s_info = { "RuntimeObject", 0, 0, 0 };
    4242
    43 RuntimeObjectImp::RuntimeObjectImp(ExecState* exec, PassRefPtr<Instance> i)
     43RuntimeObjectImp::RuntimeObjectImp(ExecState* exec, PassRefPtr<Instance> instance)
    4444    // FIXME: deprecatedGetDOMStructure uses the prototype off of the wrong global object
    4545    // We need to pass in the right global object for "i".
    4646    : JSObject(deprecatedGetDOMStructure<RuntimeObjectImp>(exec))
    47     , instance(i)
    48 {
    49     instance->rootObject()->addRuntimeObject(this);
    50 }
    51    
    52 RuntimeObjectImp::RuntimeObjectImp(ExecState*, PassRefPtr<Structure> structure, PassRefPtr<Instance> i)
     47    , m_instance(instance)
     48{
     49    m_instance->rootObject()->addRuntimeObject(this);
     50}
     51
     52RuntimeObjectImp::RuntimeObjectImp(ExecState*, PassRefPtr<Structure> structure, PassRefPtr<Instance> instance)
    5353    : JSObject(structure)
    54     , instance(i)
    55 {
    56     instance->rootObject()->addRuntimeObject(this);
     54    , m_instance(instance)
     55{
     56    m_instance->rootObject()->addRuntimeObject(this);
    5757}
    5858
    5959RuntimeObjectImp::~RuntimeObjectImp()
    6060{
    61     if (instance)
    62         instance->rootObject()->removeRuntimeObject(this);
     61    if (m_instance)
     62        m_instance->rootObject()->removeRuntimeObject(this);
    6363}
    6464
    6565void RuntimeObjectImp::invalidate()
    6666{
    67     ASSERT(instance);
    68     instance = 0;
     67    ASSERT(m_instance);
     68    m_instance = 0;
    6969}
    7070
    … …  
    7272{
    7373    RuntimeObjectImp* thisObj = static_cast<RuntimeObjectImp*>(asObject(slot.slotBase()));
    74     RefPtr<Instance> instance = thisObj->instance;
     74    RefPtr<Instance> instance = thisObj->m_instance;
    7575
    7676    if (!instance)
    … …  
    9090{   
    9191    RuntimeObjectImp* thisObj = static_cast<RuntimeObjectImp*>(asObject(slot.slotBase()));
    92     RefPtr<Instance> instance = thisObj->instance;
     92    RefPtr<Instance> instance = thisObj->m_instance;
    9393
    9494    if (!instance)
    … …  
    109109{
    110110    RuntimeObjectImp* thisObj = static_cast<RuntimeObjectImp*>(asObject(slot.slotBase()));
    111     RefPtr<Instance> instance = thisObj->instance;
     111    RefPtr<Instance> instance = thisObj->m_instance;
    112112
    113113    if (!instance)
    … …  
    127127bool RuntimeObjectImp::getOwnPropertySlot(ExecState *exec, const Identifier& propertyName, PropertySlot& slot)
    128128{
    129     if (!instance) {
     129    if (!m_instance) {
    130130        throwInvalidAccessError(exec);
    131131        return false;
    132132    }
    133133   
     134    RefPtr<Instance> instance = m_instance;
     135
    134136    instance->begin();
    135137   
    … …  
    170172bool RuntimeObjectImp::getOwnPropertyDescriptor(ExecState *exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
    171173{
    172     if (!instance) {
     174    if (!m_instance) {
    173175        throwInvalidAccessError(exec);
    174176        return false;
    175177    }
    176178   
     179    RefPtr<Instance> instance = m_instance;
    177180    instance->begin();
    178181   
    … …  
    218221void RuntimeObjectImp::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
    219222{
    220     if (!instance) {
     223    if (!m_instance) {
    221224        throwInvalidAccessError(exec);
    222225        return;
    223226    }
    224227   
    225     RefPtr<Instance> protector(instance);
     228    RefPtr<Instance> instance = m_instance;
    226229    instance->begin();
    227230
    … …  
    244247JSValue RuntimeObjectImp::defaultValue(ExecState* exec, PreferredPrimitiveType hint) const
    245248{
    246     if (!instance)
     249    if (!m_instance)
    247250        return throwInvalidAccessError(exec);
    248251   
    249     RefPtr<Instance> protector(instance);
     252    RefPtr<Instance> instance = m_instance;
     253
    250254    instance->begin();
    251255    JSValue result = instance->defaultValue(exec, hint);
    … …  
    265269CallType RuntimeObjectImp::getCallData(CallData& callData)
    266270{
    267     if (!instance || !instance->supportsInvokeDefaultMethod())
     271    if (!m_instance)
    268272        return CallTypeNone;
     273   
     274    RefPtr<Instance> instance = m_instance;
     275    if (!instance->supportsInvokeDefaultMethod())
     276        return CallTypeNone;
     277   
    269278    callData.native.function = callRuntimeObject;
    270279    return CallTypeHost;
    … …  
    284293ConstructType RuntimeObjectImp::getConstructData(ConstructData& constructData)
    285294{
    286     if (!instance || !instance->supportsConstruct())
     295    if (!m_instance)
    287296        return ConstructTypeNone;
     297   
     298    RefPtr<Instance> instance = m_instance;
     299    if (!instance->supportsConstruct())
     300        return ConstructTypeNone;
     301   
    288302    constructData.native.function = callRuntimeConstructor;
    289303    return ConstructTypeHost;
    … …  
    292306void RuntimeObjectImp::getPropertyNames(ExecState* exec, PropertyNameArray& propertyNames)
    293307{
    294     if (!instance) {
     308    if (!m_instance) {
    295309        throwInvalidAccessError(exec);
    296310        return;
    297311    }
    298312
     313    RefPtr<Instance> instance = m_instance;
     314   
    299315    instance->begin();
    300316    instance->getPropertyNames(exec, propertyNames);

  • trunk/WebCore/bridge/runtime_object.h

    r48336 r48492  
    5050
    5151    virtual void invalidate();
    52     Bindings::Instance* getInternalInstance() const { return instance.get(); }
     52    Bindings::Instance* getInternalInstance() const { return m_instance.get(); }
    5353
    5454    static JSObject* throwInvalidAccessError(ExecState*);
    … …  
    7676    static JSValue methodGetter(ExecState*, const Identifier&, const PropertySlot&);
    7777
    78     RefPtr<Bindings::Instance> instance;
     78    RefPtr<Bindings::Instance> m_instance;
    7979};
    8080   

  • trunk/WebKit/mac/ChangeLog

    r48471 r48492  
     12009-09-17  Anders Carlsson  <andersca@apple.com>
     2
     3        Reviewed by Oliver Hunt.
     4
     5        <rdar://problem/7007541>
     6        CrashTracer: 4800+ crashes in Safari at com.apple.WebKit • WTF::HashTableIterator...
     7
     8        Add null checks for m_instanceProxy (It will be null when a plug-in has crashed).
     9       
     10        * Plugins/Hosted/ProxyInstance.mm:
     11        (WebKit::ProxyInstance::invoke):
     12        (WebKit::ProxyInstance::supportsInvokeDefaultMethod):
     13        (WebKit::ProxyInstance::supportsConstruct):
     14        (WebKit::ProxyInstance::getPropertyNames):
     15        (WebKit::ProxyInstance::methodsNamed):
     16        (WebKit::ProxyInstance::fieldNamed):
     17        (WebKit::ProxyInstance::fieldValue):
     18        (WebKit::ProxyInstance::setFieldValue):
     19        (WebKit::ProxyInstance::invalidate):
     20
    1212009-09-16  Simon Fraser  <simon.fraser@apple.com>
    222

  • trunk/WebKit/mac/Plugins/Hosted/ProxyInstance.mm

    r45607 r48492  
    137137JSValue ProxyInstance::invoke(JSC::ExecState* exec, InvokeType type, uint64_t identifier, const JSC::ArgList& args)
    138138{
     139    if (!m_instanceProxy)
     140        return jsUndefined();
     141   
    139142    RetainPtr<NSData*> arguments(m_instanceProxy->marshalValues(exec, args));
    140143
    … …  
    163166bool ProxyInstance::supportsInvokeDefaultMethod() const
    164167{
     168    if (!m_instanceProxy)
     169        return false;
     170   
    165171    uint32_t requestID = m_instanceProxy->nextRequestID();
    166172   
    … …  
    184190bool ProxyInstance::supportsConstruct() const
    185191{
     192    if (!m_instanceProxy)
     193        return false;
     194   
    186195    uint32_t requestID = m_instanceProxy->nextRequestID();
    187196   
    … …  
    237246void ProxyInstance::getPropertyNames(ExecState* exec, PropertyNameArray& nameArray)
    238247{
     248    if (!m_instanceProxy)
     249        return;
     250   
    239251    uint32_t requestID = m_instanceProxy->nextRequestID();
    240252   
    … …  
    267279MethodList ProxyInstance::methodsNamed(const Identifier& identifier)
    268280{
     281    if (!m_instanceProxy)
     282        return MethodList();
     283   
    269284    // If we already have an entry in the map, use it.
    270285    MethodMap::iterator existingMapEntry = m_methods.find(identifier.ustring().rep());
    … …  
    304319Field* ProxyInstance::fieldNamed(const Identifier& identifier)
    305320{
     321    if (!m_instanceProxy)
     322        return 0;
     323   
    306324    // If we already have an entry in the map, use it.
    307325    FieldMap::iterator existingMapEntry = m_fields.find(identifier.ustring().rep());
    … …  
    333351JSC::JSValue ProxyInstance::fieldValue(ExecState* exec, const Field* field) const
    334352{
     353    if (!m_instanceProxy)
     354        return jsUndefined();
     355   
    335356    uint64_t serverIdentifier = static_cast<const ProxyField*>(field)->serverIdentifier();
    336357    uint32_t requestID = m_instanceProxy->nextRequestID();
    … …  
    350371void ProxyInstance::setFieldValue(ExecState* exec, const Field* field, JSValue value) const
    351372{
     373    if (m_instanceProxy)
     374        return;
     375   
    352376    uint64_t serverIdentifier = static_cast<const ProxyField*>(field)->serverIdentifier();
    353377    uint32_t requestID = m_instanceProxy->nextRequestID();
    … …  
    369393void ProxyInstance::invalidate()
    370394{
     395    ASSERT(m_instanceProxy);
     396   
    371397    if (NetscapePluginHostProxy* hostProxy = m_instanceProxy->hostProxy())
    372398        _WKPHNPObjectRelease(hostProxy->port(),
Note: See TracChangeset for help on using the changeset viewer.