JavaScriptCore:

        Reviewed by Darin Adler.

        - fix http://bugs.webkit.org/show_bug.cgi?id=16782
          <rdar://problem/5675331> REGRESSION(r29266): Reproducible crash in fast/replaced/image-map.html

        The crash resulted from a native object (DumpRenderTree's
        EventSender) causing its wrapper to be invalidated (by clicking a
        link that replaced the document in the window) and consequently
        deallocated. The fix is to use RefPtrs to protect the native object
        from deletion by self-invalidation.

        * bindings/runtime_method.cpp:
        (RuntimeMethod::callAsFunction):
        * bindings/runtime_object.cpp:
        (RuntimeObjectImp::fallbackObjectGetter):
        (RuntimeObjectImp::fieldGetter):
        (RuntimeObjectImp::methodGetter):
        (RuntimeObjectImp::put):
        (RuntimeObjectImp::defaultValue):
        (RuntimeObjectImp::callAsFunction):

LayoutTests:

        Reviewed by Darin Adler.

        - re-enable crashing test after fixing http://bugs.webkit.org/show_bug.cgi?id=16782
          <rdar://problem/5675331> REGRESSION(r29266): Reproducible crash in fast/replaced/image-map.html

        * fast/replaced/image-map-expected.txt: Updated results for the new
        behavior, which is to replace the document with the success message.
        * fast/replaced/image-map.html: Copied from LayoutTests/fast/replaced/image-map.html-disabled.
        * fast/replaced/image-map.html-disabled: Removed.

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@29362 268f45cc-cd09-0410-ab3c-d52691b4dbfc

diff --git a/JavaScriptCore/ChangeLog b/JavaScriptCore/ChangeLog
index bf03a8ffa60724716a5cc46be7c9263a92a7f0e1..0c81aa62710685653420e345ce8e70d764521df5 100644 (file)
--- a/JavaScriptCore/ChangeLog
+++ b/JavaScriptCore/ChangeLog
@@ -1,3 +1,26 @@
+2008-01-10  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Darin Adler.
+
+        - fix http://bugs.webkit.org/show_bug.cgi?id=16782
+          <rdar://problem/5675331> REGRESSION(r29266): Reproducible crash in fast/replaced/image-map.html
+
+        The crash resulted from a native object (DumpRenderTree's
+        EventSender) causing its wrapper to be invalidated (by clicking a
+        link that replaced the document in the window) and consequently
+        deallocated. The fix is to use RefPtrs to protect the native object
+        from deletion by self-invalidation.
+
+        * bindings/runtime_method.cpp:
+        (RuntimeMethod::callAsFunction):
+        * bindings/runtime_object.cpp:
+        (RuntimeObjectImp::fallbackObjectGetter):
+        (RuntimeObjectImp::fieldGetter):
+        (RuntimeObjectImp::methodGetter):
+        (RuntimeObjectImp::put):
+        (RuntimeObjectImp::defaultValue):
+        (RuntimeObjectImp::callAsFunction):
+
 2008-01-07  Mark Rowe  <mrowe@apple.com>
 
         Reviewed by Maciej Stachowiak.

diff --git a/JavaScriptCore/bindings/runtime_method.cpp b/JavaScriptCore/bindings/runtime_method.cpp
index c3c69001174cb9603c4e05a7e5a1f29151e41c5f..4430f2529f297780c06ff1d8a1c9d7809ca9b99a 100644 (file)
--- a/JavaScriptCore/bindings/runtime_method.cpp
+++ b/JavaScriptCore/bindings/runtime_method.cpp
@@ -83,7 +83,7 @@ JSValue *RuntimeMethod::callAsFunction(ExecState *exec, JSObject *thisObj, const
     if (!imp)
         return throwError(exec, TypeError);
 
-    Instance *instance = imp->getInternalInstance();
+    RefPtr<Instance> instance = imp->getInternalInstance();
     if (!instance) 
         return RuntimeObjectImp::throwInvalidAccessError(exec);
         

diff --git a/JavaScriptCore/bindings/runtime_object.cpp b/JavaScriptCore/bindings/runtime_object.cpp
index 3e92e167bcd97a5ebaaa65a07ae20fe0c1b6ed71..c2cb3e86b8a06f5bf85575fe21cc73a9e8798d27 100644 (file)
--- a/JavaScriptCore/bindings/runtime_object.cpp
+++ b/JavaScriptCore/bindings/runtime_object.cpp
@@ -57,7 +57,7 @@ void RuntimeObjectImp::invalidate()
 JSValue *RuntimeObjectImp::fallbackObjectGetter(ExecState* exec, JSObject*, const Identifier& propertyName, const PropertySlot& slot)
 {
     RuntimeObjectImp *thisObj = static_cast<RuntimeObjectImp *>(slot.slotBase());
-    Bindings::Instance *instance = thisObj->instance.get();
+    RefPtr<Bindings::Instance> instance = thisObj->instance;
 
     if (!instance)
         return throwInvalidAccessError(exec);
@@ -65,7 +65,7 @@ JSValue *RuntimeObjectImp::fallbackObjectGetter(ExecState* exec, JSObject*, cons
     instance->begin();
 
     Class *aClass = instance->getClass();
-    JSValue *result = aClass->fallbackObject(exec, instance, propertyName);
+    JSValue* result = aClass->fallbackObject(exec, instance.get(), propertyName);
 
     instance->end();
             
@@ -75,7 +75,7 @@ JSValue *RuntimeObjectImp::fallbackObjectGetter(ExecState* exec, JSObject*, cons
 JSValue *RuntimeObjectImp::fieldGetter(ExecState* exec, JSObject*, const Identifier& propertyName, const PropertySlot& slot)
 {    
     RuntimeObjectImp *thisObj = static_cast<RuntimeObjectImp *>(slot.slotBase());
-    Bindings::Instance *instance = thisObj->instance.get();
+    RefPtr<Bindings::Instance> instance = thisObj->instance;
 
     if (!instance)
         return throwInvalidAccessError(exec);
@@ -83,7 +83,7 @@ JSValue *RuntimeObjectImp::fieldGetter(ExecState* exec, JSObject*, const Identif
     instance->begin();
 
     Class *aClass = instance->getClass();
-    Field *aField = aClass->fieldNamed(propertyName, instance);
+    Field* aField = aClass->fieldNamed(propertyName, instance.get());
     JSValue *result = instance->getValueOfField(exec, aField); 
     
     instance->end();
@@ -94,7 +94,7 @@ JSValue *RuntimeObjectImp::fieldGetter(ExecState* exec, JSObject*, const Identif
 JSValue *RuntimeObjectImp::methodGetter(ExecState* exec, JSObject*, const Identifier& propertyName, const PropertySlot& slot)
 {
     RuntimeObjectImp *thisObj = static_cast<RuntimeObjectImp *>(slot.slotBase());
-    Bindings::Instance *instance = thisObj->instance.get();
+    RefPtr<Bindings::Instance> instance = thisObj->instance;
 
     if (!instance)
         return throwInvalidAccessError(exec);
@@ -102,7 +102,7 @@ JSValue *RuntimeObjectImp::methodGetter(ExecState* exec, JSObject*, const Identi
     instance->begin();
 
     Class *aClass = instance->getClass();
-    MethodList methodList = aClass->methodsNamed(propertyName, instance);
+    MethodList methodList = aClass->methodsNamed(propertyName, instance.get());
     JSValue *result = new RuntimeMethod(exec, propertyName, methodList);
 
     instance->end();
@@ -161,6 +161,7 @@ void RuntimeObjectImp::put(ExecState* exec, const Identifier& propertyName, JSVa
         return;
     }
     
+    RefPtr<Bindings::Instance> protector(instance);
     instance->begin();
 
     // Set the value of the property.
@@ -202,6 +203,7 @@ JSValue *RuntimeObjectImp::defaultValue(ExecState* exec, JSType hint) const
     
     JSValue *result;
     
+    RefPtr<Bindings::Instance> protector(instance);
     instance->begin();
 
     result = instance->defaultValue(hint);
@@ -224,6 +226,7 @@ JSValue *RuntimeObjectImp::callAsFunction(ExecState* exec, JSObject*, const List
     if (!instance)
         return throwInvalidAccessError(exec);
 
+    RefPtr<Bindings::Instance> protector(instance);
     instance->begin();
 
     JSValue *aValue = instance->invokeDefaultMethod(exec, args);

diff --git a/LayoutTests/ChangeLog b/LayoutTests/ChangeLog
index 6b1d89a9e7b8a05e5986ecc7ba5e69e7d73fa2c7..4118d8a951bfd8c3966f15f9f3761fe4fceddd09 100644 (file)
--- a/LayoutTests/ChangeLog
+++ b/LayoutTests/ChangeLog
@@ -1,3 +1,15 @@
+2008-01-10  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Darin Adler.
+
+        - re-enable crashing test after fixing http://bugs.webkit.org/show_bug.cgi?id=16782
+          <rdar://problem/5675331> REGRESSION(r29266): Reproducible crash in fast/replaced/image-map.html
+
+        * fast/replaced/image-map-expected.txt: Updated results for the new
+        behavior, which is to replace the document with the success message.
+        * fast/replaced/image-map.html: Copied from LayoutTests/fast/replaced/image-map.html-disabled.
+        * fast/replaced/image-map.html-disabled: Removed.
+
 2008-01-10  Dan Bernstein  <mitz@apple.com>
 
         Reviewed by John Sullivan.

diff --git a/LayoutTests/fast/replaced/image-map-expected.txt b/LayoutTests/fast/replaced/image-map-expected.txt
index 8ced11ab33d61c5d42dfe50e219ffb4de6de53f4..c2b888c7e5f1829a97ef4ad06214f973dc019d3d 100644 (file)
--- a/LayoutTests/fast/replaced/image-map-expected.txt
+++ b/LayoutTests/fast/replaced/image-map-expected.txt
@@ -1,2 +1 @@
-
 area clicked

diff --git a/LayoutTests/fast/replaced/image-map.html-disabled b/LayoutTests/fast/replaced/image-map.html
similarity index 100%
rename from LayoutTests/fast/replaced/image-map.html-disabled
rename to LayoutTests/fast/replaced/image-map.html