Michael Goddard <michael.goddard@trolltech.com>

Clear stale RuntimeObjectImps.
Since other objects can have refs to the QtInstance,
we can't rely on the QtInstance being deleted when the
RuntimeObjectImp is invalidate or deleted.  This
could result in a stale JSObject being returned for
a valid Instance.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@29756 268f45cc-cd09-0410-ab3c-d52691b4dbfc

diff --git a/JavaScriptCore/ChangeLog b/JavaScriptCore/ChangeLog
index c33ae19..290d430 100644 (file)
--- a/JavaScriptCore/ChangeLog
+++ b/JavaScriptCore/ChangeLog
@@ -1,3 +1,25 @@
+2008-01-24  Michael Goddard  <michael.goddard@trolltech.com>
+
+        Reviewed by Simon.
+
+        Clear stale RuntimeObjectImps.
+        Since other objects can have refs to the QtInstance,
+        we can't rely on the QtInstance being deleted when the
+        RuntimeObjectImp is invalidate or deleted.  This
+        could result in a stale JSObject being returned for
+        a valid Instance.
+        
+
+        * bindings/qt/qt_instance.cpp:
+        (KJS::Bindings::QtRuntimeObjectImp::QtRuntimeObjectImp):
+        (KJS::Bindings::QtRuntimeObjectImp::~QtRuntimeObjectImp):
+        (KJS::Bindings::QtRuntimeObjectImp::invalidate):
+        (KJS::Bindings::QtRuntimeObjectImp::removeFromCache):
+        (KJS::Bindings::QtInstance::getRuntimeObject):
+        * bindings/runtime.cpp:
+        (KJS::Bindings::Instance::createRuntimeObject):
+        * bindings/runtime.h:
+
 2008-01-23  Alp Toker  <alp@atoker.com>
 
         Rubber-stamped by Mark Rowe.

diff --git a/JavaScriptCore/bindings/qt/qt_instance.cpp b/JavaScriptCore/bindings/qt/qt_instance.cpp
index 1ab39d3..3bc7eca 100644 (file)
--- a/JavaScriptCore/bindings/qt/qt_instance.cpp
+++ b/JavaScriptCore/bindings/qt/qt_instance.cpp
@@ -42,6 +42,41 @@ static QObjectInstanceMap cachedInstances;
 typedef QHash<QtInstance*, JSObject*> InstanceJSObjectMap;
 static InstanceJSObjectMap cachedObjects;
 
+// Derived RuntimeObject
+class QtRuntimeObjectImp : public RuntimeObjectImp {
+    public:
+        QtRuntimeObjectImp(Instance *instance);
+        ~QtRuntimeObjectImp();
+        virtual void invalidate();
+    protected:
+        void removeFromCache();
+};
+
+QtRuntimeObjectImp::QtRuntimeObjectImp(Instance *instance)
+    : RuntimeObjectImp(instance)
+{
+}
+
+QtRuntimeObjectImp::~QtRuntimeObjectImp()
+{
+    removeFromCache();
+}
+
+void QtRuntimeObjectImp::invalidate()
+{
+    removeFromCache();
+    RuntimeObjectImp::invalidate();
+}
+
+void QtRuntimeObjectImp::removeFromCache()
+{
+    JSLock lock;
+    QtInstance *key = cachedObjects.key(this);
+    if (key)
+        cachedObjects.remove(key);
+}
+
+// QtInstance
 QtInstance::QtInstance(QObject* o, PassRefPtr<RootObject> rootObject)
     : Instance(rootObject)
     , m_class(0)
@@ -89,7 +124,7 @@ JSObject* QtInstance::getRuntimeObject(QtInstance* instance)
     JSLock lock;
     JSObject* ret = cachedObjects.value(instance);
     if (!ret) {
-        ret = Instance::reallyCreateRuntimeObject(instance);
+        ret = new QtRuntimeObjectImp(instance);
         cachedObjects.insert(instance, ret);
     }
     return ret;

diff --git a/JavaScriptCore/bindings/runtime.cpp b/JavaScriptCore/bindings/runtime.cpp
index 12db05d..cc68fa6 100644 (file)
--- a/JavaScriptCore/bindings/runtime.cpp
+++ b/JavaScriptCore/bindings/runtime.cpp
@@ -129,11 +129,6 @@ JSObject* Instance::createRuntimeObject(Instance* instance)
     if (instance->getBindingLanguage() == QtLanguage)
         return QtInstance::getRuntimeObject(static_cast<QtInstance*>(instance));
 #endif
-    return reallyCreateRuntimeObject(instance);
-}
-
-JSObject* Instance::reallyCreateRuntimeObject(Instance* instance)
-{
     JSLock lock;
 
     return new RuntimeObjectImp(instance);

diff --git a/JavaScriptCore/bindings/runtime.h b/JavaScriptCore/bindings/runtime.h
index c024ba8..dbb324c 100644 (file)
--- a/JavaScriptCore/bindings/runtime.h
+++ b/JavaScriptCore/bindings/runtime.h
@@ -144,8 +144,6 @@ public:
     virtual BindingLanguage getBindingLanguage() const = 0;
 
 protected:
-    static JSObject* reallyCreateRuntimeObject(Instance*);
-
     RefPtr<RootObject> _rootObject;
     unsigned _refCount;
 };