Changeset 51572 in webkit

Timestamp:

Dec 1, 2009 5:41:34 PM (14 years ago)

Author:

oliver@apple.com

Message:

Inspector crashes when collecting on every allocation
​https://bugs.webkit.org/show_bug.cgi?id=32044

Reviewed by Maciej Stachowiak.

The crash is caused by the prototype wrapper object getting collected
when allocating the object that is going to use it as a prototype.
Because the only reference to the prototype wrapper is through the
new object's Structure it does not get marked automatically.

Location:

trunk/WebCore

Files:

• ChangeLog (modified) (1 diff)
• bindings/js/JSInspectedObjectWrapper.cpp (modified) (1 diff)
• bindings/js/JSInspectorCallbackWrapper.cpp (modified) (1 diff)

trunk/WebCore/ChangeLog

@@ +1 @@
+2009-12-01  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        Inspector crashes when collecting on every allocation
+        https://bugs.webkit.org/show_bug.cgi?id=32044
+
+        The crash is caused by the prototype wrapper object getting collected
+        when allocating the object that is going to use it as a prototype.
+        Because the only reference to the prototype wrapper is through the
+        new object's Structure it does not get marked automatically.
+
+        * bindings/js/JSInspectedObjectWrapper.cpp:
+        (WebCore::JSInspectedObjectWrapper::wrap):
+        * bindings/js/JSInspectorCallbackWrapper.cpp:
+        (WebCore::JSInspectorCallbackWrapper::wrap):
+
 2009-12-01  Nikolas Zimmermann  <nzimmermann@rim.com>
 

trunk/WebCore/bindings/js/JSInspectedObjectWrapper.cpp

@@ -69 +69 @@
     if (prototype.isNull())
         return new (unwrappedExec) JSInspectedObjectWrapper(unwrappedExec, unwrappedObject, JSQuarantinedObjectWrapper::createStructure(jsNull()));
-    return new (unwrappedExec) JSInspectedObjectWrapper(unwrappedExec, unwrappedObject, JSQuarantinedObjectWrapper::createStructure(asObject(wrap(unwrappedExec, prototype))));
+    ProtectedJSValue wrappedProto = wrap(unwrappedExec, prototype);
+    return new (unwrappedExec) JSInspectedObjectWrapper(unwrappedExec, unwrappedObject, JSQuarantinedObjectWrapper::createStructure(asObject(wrappedProto)));
 }
 

trunk/WebCore/bindings/js/JSInspectorCallbackWrapper.cpp

@@ -76 +76 @@
         return new (unwrappedExec) JSInspectorCallbackWrapper(unwrappedExec, unwrappedObject, structure);
     }
-    return new (unwrappedExec) JSInspectorCallbackWrapper(unwrappedExec, unwrappedObject, createStructure(wrap(unwrappedExec, prototype)));
+    ProtectedJSValue wrappedProto = wrap(unwrappedExec, prototype);
+    return new (unwrappedExec) JSInspectorCallbackWrapper(unwrappedExec, unwrappedObject, createStructure(wrappedProto.get()));
 }