Changeset 86206 in webkit

Timestamp:

May 10, 2011 7:11:56 PM (13 years ago)

Author:

oliver@apple.com

Message:

2011-05-10 Oliver Hunt <​oliver@apple.com>

Reviewed by Geoffrey Garen.

Assertion failure in JSC::Structure::typeInfo when reloading weather.com video page
​https://bugs.webkit.org/show_bug.cgi?id=60580

The plugin object map was incorrect trying to implement a weak map itself using
destructors. Switch to a WeakGCMap and the problem is fixed.

• WebProcess/Plugins/Netscape/JSNPObject.cpp: (WebKit::JSNPObject::~JSNPObject):
• WebProcess/Plugins/Netscape/NPRuntimeObjectMap.cpp: (WebKit::NPRuntimeObjectMap::getOrCreateJSObject): (WebKit::NPRuntimeObjectMap::invalidate):
• WebProcess/Plugins/Netscape/NPRuntimeObjectMap.h:

Location:

trunk/Source/WebKit2

Files:

• ChangeLog (modified) (1 diff)
• WebProcess/Plugins/Netscape/JSNPObject.cpp (modified) (1 diff)
• WebProcess/Plugins/Netscape/NPRuntimeObjectMap.cpp (modified) (2 diffs)
• WebProcess/Plugins/Netscape/NPRuntimeObjectMap.h (modified) (2 diffs)

trunk/Source/WebKit2/ChangeLog

@@ +1 @@
+2011-05-10  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Geoffrey Garen.
+
+        Assertion failure in JSC::Structure::typeInfo when reloading weather.com video page
+        https://bugs.webkit.org/show_bug.cgi?id=60580
+
+        The plugin object map was incorrect trying to implement a weak map itself using
+        destructors.  Switch to a WeakGCMap and the problem is fixed.
+
+        * WebProcess/Plugins/Netscape/JSNPObject.cpp:
+        (WebKit::JSNPObject::~JSNPObject):
+        * WebProcess/Plugins/Netscape/NPRuntimeObjectMap.cpp:
+        (WebKit::NPRuntimeObjectMap::getOrCreateJSObject):
+        (WebKit::NPRuntimeObjectMap::invalidate):
+        * WebProcess/Plugins/Netscape/NPRuntimeObjectMap.h:
+
 2011-05-10  Sam Weinig  <sam@webkit.org>
 

trunk/Source/WebKit2/WebProcess/Plugins/Netscape/JSNPObject.cpp

@@ -67 +67 @@
     if (!m_npObject)
         return;
-
-    m_objectMap->jsNPObjectDestroyed(this);
     releaseNPObject(m_npObject);
 }

trunk/Source/WebKit2/WebProcess/Plugins/Netscape/NPRuntimeObjectMap.cpp

@@ -100 +100 @@
 
     JSNPObject* jsNPObject = new (&globalObject->globalData()) JSNPObject(globalObject, this, npObject);
-    m_jsNPObjects.set(npObject, jsNPObject);
+    m_jsNPObjects.set(globalObject->globalData(), npObject, jsNPObject);
 
     return jsNPObject;
-}
-
-void NPRuntimeObjectMap::jsNPObjectDestroyed(JSNPObject* jsNPObject)
-{
-    // Remove the object from the map.
-    ASSERT(m_jsNPObjects.contains(jsNPObject->npObject()));
-    m_jsNPObjects.remove(jsNPObject->npObject());
 }
 
@@ -225 +218 @@
     ASSERT(m_npJSObjects.isEmpty());
 
-    Vector<JSNPObject*> jsNPObjects;
-    copyValuesToVector(m_jsNPObjects, jsNPObjects);
-
-    // Invalidate all the JSObjects that wrap NPObjects.
-    for (size_t i = 0; i < jsNPObjects.size(); ++i)
-        jsNPObjects[i]->invalidate();
-
+    WeakGCMap<NPObject*, JSNPObject>::iterator end = m_jsNPObjects.end();
+    for (WeakGCMap<NPObject*, JSNPObject>::iterator ptr = m_jsNPObjects.begin(); ptr != end; ++ptr)
+        ptr.get().second->invalidate();
     m_jsNPObjects.clear();
 }

trunk/Source/WebKit2/WebProcess/Plugins/Netscape/NPRuntimeObjectMap.h

@@ -27 +27 @@
 #define NPJSObjectWrapperMap_h
 
+#include <JavaScriptCore/WeakGCMap.h>
 #include <wtf/Forward.h>
 #include <wtf/HashMap.h>
@@ -88 +89 @@
 
     HashMap<JSC::JSObject*, NPJSObject*> m_npJSObjects;
-    HashMap<NPObject*, JSNPObject*> m_jsNPObjects;
+    JSC::WeakGCMap<NPObject*, JSNPObject> m_jsNPObjects;
 };