Changeset 84749 in webkit

Timestamp:

Apr 23, 2011 6:31:23 PM (13 years ago)

Author:

morrita@google.com

Message:

2011-04-23 Dominic Cooney <​dominicc@chromium.org>

Reviewed by Dimitri Glazkov.

[V8] Nodes in shadow DOM should not be GCed while their hosts are alive
​https://bugs.webkit.org/show_bug.cgi?id=59284

• fast/dom/shadow/gc-shadow-expected.txt: Added.
• fast/dom/shadow/gc-shadow.html: Added.

2011-04-23 Dominic Cooney <​dominicc@chromium.org>

Reviewed by Dimitri Glazkov.

[V8] Nodes in shadow DOM should not be GCed while their hosts are alive
​https://bugs.webkit.org/show_bug.cgi?id=59284

Test: fast/dom/shadow/gc-shadow.html

• bindings/v8/V8GCController.cpp: (WebCore::calculateGroupId): group shadow nodes with their hosts

2011-04-23 Dominic Cooney <​dominicc@chromium.org>

Reviewed by Dimitri Glazkov.

[V8] Nodes in shadow DOM should not be GCed while their hosts are alive
​https://bugs.webkit.org/show_bug.cgi?id=59284

Chromium DRT over-refcounted the NPObject wrappers it used to
marshal shadowRoot nodes back to tests (WebBindings::makeNode
births NPObjects with referenceCount == 1). This masked the GC bug
59284 in tests by making shadowRoot nodes live forever.

• DumpRenderTree/chromium/LayoutTestController.cpp: (LayoutTestController::shadowRoot): (LayoutTestController::ensureShadowRoot):

Location:

trunk

Files:

• LayoutTests/ChangeLog (modified) (1 diff)
• LayoutTests/fast/dom/shadow/gc-shadow-expected.txt (added)
• LayoutTests/fast/dom/shadow/gc-shadow.html (added)
• Source/WebCore/ChangeLog (modified) (1 diff)
• Source/WebCore/bindings/v8/V8GCController.cpp (modified) (1 diff)
• Tools/ChangeLog (modified) (1 diff)
• Tools/DumpRenderTree/chromium/LayoutTestController.cpp (modified) (2 diffs)

trunk/LayoutTests/ChangeLog

@@ +1 @@
+2011-04-23  Dominic Cooney  <dominicc@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        [V8] Nodes in shadow DOM should not be GCed while their hosts are alive
+        https://bugs.webkit.org/show_bug.cgi?id=59284
+
+        * fast/dom/shadow/gc-shadow-expected.txt: Added.
+        * fast/dom/shadow/gc-shadow.html: Added.
+
 2011-04-23  MORITA Hajime <morrita@google.com>
 

trunk/Source/WebCore/ChangeLog

@@ +1 @@
+2011-04-23  Dominic Cooney  <dominicc@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        [V8] Nodes in shadow DOM should not be GCed while their hosts are alive
+        https://bugs.webkit.org/show_bug.cgi?id=59284
+
+        Test: fast/dom/shadow/gc-shadow.html
+
+        * bindings/v8/V8GCController.cpp:
+        (WebCore::calculateGroupId): group shadow nodes with their hosts
+
 2011-04-23  MORITA Hajime <morrita@google.com>
 

trunk/Source/WebCore/bindings/v8/V8GCController.cpp

@@ -280 +280 @@
             return GroupId();
     } else {
-        while (Node* parent = root->parentNode())
+        while (Node* parent = root->parentOrHostNode())
             root = parent;
     }

trunk/Tools/ChangeLog

@@ +1 @@
+2011-04-23  Dominic Cooney  <dominicc@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        [V8] Nodes in shadow DOM should not be GCed while their hosts are alive
+        https://bugs.webkit.org/show_bug.cgi?id=59284
+
+        Chromium DRT over-refcounted the NPObject wrappers it used to
+        marshal shadowRoot nodes back to tests (WebBindings::makeNode
+        births NPObjects with referenceCount == 1). This masked the GC bug
+        59284 in tests by making shadowRoot nodes live forever.
+
+        * DumpRenderTree/chromium/LayoutTestController.cpp:
+        (LayoutTestController::shadowRoot):
+        (LayoutTestController::ensureShadowRoot):
+
 2011-04-23  Kevin Ollivier  <kevino@theolliviers.com>
 

trunk/Tools/DumpRenderTree/chromium/LayoutTestController.cpp

@@ -666 +666 @@
     }
 
-    WebNode shadowRoot = element.shadowRoot();
-    if (shadowRoot.isNull()) {
+    NPObject* shadowRoot = WebBindings::makeNode(element.shadowRoot());
+    if (!shadowRoot) {
         result->setNull();
         return;
     }
 
-    result->set(WebBindings::makeNode(shadowRoot));
+    result->set(shadowRoot);
+    WebBindings::releaseObject(shadowRoot);
 }
 
@@ -688 +689 @@
     }
 
-    result->set(WebBindings::makeNode(element.ensureShadowRoot()));
+    NPObject* shadowRoot = WebBindings::makeNode(element.ensureShadowRoot());
+    if (!shadowRoot) {
+        result->setNull();
+        return;
+    }
+
+    result->set(shadowRoot);
+    WebBindings::releaseObject(shadowRoot);
 }