ChangeLog

2018-08-03  Ryosuke Niwa  <rniwa@webkit.org>

        Properties set on window.customElements can disappear due to GC

        https://bugs.webkit.org/show_bug.cgi?id=172575

        <rdar://problem/32440668>

        Reviewed by NOBODY (OOPS!).

        Fixed the bug that JS wrapper of CustomElementsRegistry can erroneously get collected during GC

        by keeping it alive as long as the global object is alive.

        Test: fast/custom-elements/custom-element-registry-wrapper-should-stay-alive.html

        * dom/CustomElementRegistry.cpp:

        (WebCore::CustomElementRegistry::create):

        (WebCore::CustomElementRegistry::CustomElementRegistry):

        * dom/CustomElementRegistry.h:

        (WebCore::CustomElementRegistry): Make this inherited from ContextDestructionObserver.

        * dom/CustomElementRegistry.idl: Set GenerateIsReachable=ImplScriptExecutionContext in IDL. This will

        make CustomElementRegistry reachable from the global object.

        * page/DOMWindow.cpp:

        (WebCore::DOMWindow::ensureCustomElementRegistry):

2018-08-03  Ben Richards  <benton_richards@apple.com>

        We should cache the compiled sandbox profile in a data vault

234575

Source/WebCore/dom/CustomElementRegistry.cpp

namespace WebCore {

44 Ref<CustomElementRegistry> CustomElementRegistry::create(DOMWindow& window)

44Ref<CustomElementRegistry> CustomElementRegistry::create(DOMWindow& window, ScriptExecutionContext* scriptExecutionContext)

4545{

46 return adoptRef(*new CustomElementRegistry(window));

46 return adoptRef(*new CustomElementRegistry(window, scriptExecutionContext));

4747}

4848

49 CustomElementRegistry::CustomElementRegistry(DOMWindow& window)

50 : m_window(window)

CustomElementRegistry::CustomElementRegistry(DOMWindow& window, ScriptExecutionContext* scriptExecutionContext)

    : ContextDestructionObserver(scriptExecutionContext)

    , m_window(window)

{

}

234575

Source/WebCore/dom/CustomElementRegistry.h

#pragma once

28#include "ContextDestructionObserver.h"

#include "QualifiedName.h"

#include <wtf/HashMap.h>

#include <wtf/text/AtomicString.h>

@@class JSCustomElementInterface;

class Node;

class QualifiedName;

50 class CustomElementRegistry : public RefCounted<CustomElementRegistry> {

51class CustomElementRegistry : public RefCounted<CustomElementRegistry>, public ContextDestructionObserver {

5152public:

52 static Ref<CustomElementRegistry> create(DOMWindow&);

53 static Ref<CustomElementRegistry> create(DOMWindow&, ScriptExecutionContext*);

    ~CustomElementRegistry();

    void addElementDefinition(Ref<JSCustomElementInterface>&&);

@@public:

    HashMap<AtomicString, Ref<DeferredPromise>>& promiseMap() { return m_promiseMap; }

private:

71 CustomElementRegistry(DOMWindow&);

72 CustomElementRegistry(DOMWindow&, ScriptExecutionContext*);

    DOMWindow& m_window;

    HashMap<AtomicString, Ref<JSCustomElementInterface>> m_nameMap;

234575

Source/WebCore/dom/CustomElementRegistry.idl

[

    EnabledAtRuntime=CustomElements,

28 ImplementationLacksVTable,

2928 JSGenerateToNativeObject,

29 GenerateIsReachable=ImplScriptExecutionContext

] interface CustomElementRegistry {

    [CEReactions, Custom] void define(DOMString name, Function constructor);

    any get(DOMString name);

234575

Source/WebCore/page/DOMWindow.cpp

@@bool DOMWindow::isCurrentlyDisplayedInFr

CustomElementRegistry& DOMWindow::ensureCustomElementRegistry()

{

    if (!m_customElementRegistry)

613 m_customElementRegistry = CustomElementRegistry::create(*this);

613 m_customElementRegistry = CustomElementRegistry::create(*this, scriptExecutionContext());

    return *m_customElementRegistry;

}

234575

LayoutTests/ChangeLog

2018-08-03  Ryosuke Niwa  <rniwa@webkit.org>

        Properties set on window.customElements can disappear due to GC

        https://bugs.webkit.org/show_bug.cgi?id=172575

        <rdar://problem/32440668>

        Reviewed by NOBODY (OOPS!).

        Added a regression test.

        * fast/custom-elements/custom-element-registry-wrapper-should-stay-alive-expected.txt: Added.

        * fast/custom-elements/custom-element-registry-wrapper-should-stay-alive.html: Added.

2018-08-03  Justin Fan  <justin_fan@apple.com>

        WebGL 2 conformance: vertex_arrays/vertex_array_object.html

234575

LayoutTests/fast/custom-elements/custom-element-registry-wrapper-should-stay-alive-expected.txt

This tests that the property added on window.customElements persist after a lot of memory allocation

On success, you will see a series of "PASS" messages, followed by "TEST COMPLETE".

PASS The property was present - the JS wrapper of customElements was not collected

PASS The property was present - the JS wrapper of customElements was not collected

PASS The property was present - the JS wrapper of customElements was not collected

PASS The property was present - the JS wrapper of customElements was not collected

PASS The property was present - the JS wrapper of customElements was not collected

PASS The property was present - the JS wrapper of customElements was not collected

PASS The property was present - the JS wrapper of customElements was not collected

PASS The property was present - the JS wrapper of customElements was not collected

PASS The property was present - the JS wrapper of customElements was not collected

PASS The property was present - the JS wrapper of customElements was not collected

PASS successfullyParsed is true

TEST COMPLETE

nonexistent

LayoutTests/fast/custom-elements/custom-element-registry-wrapper-should-stay-alive.html

<!DOCTYPE html>

<html>

<body>

<script src="../../resources/js-test.js"></script>

<script>

description('This tests that the property added on window.customElements persist after a lot of memory allocation');

for (let i = 0; i < 10; i++) {

    // Using iframe makes this test more reliable.

    const iframe = document.createElement('iframe');

    document.body.appendChild(iframe);

    iframe.contentWindow.eval(`

        window.customElements.someProperty = 'storedValue';

        const a = [];

        for (let i = 0; i < 1000000; i++)

            a.push({});

        if (window.GCController)

            GCController.collect();

        top.check(window.customElements.someProperty);`);

    iframe.remove();

}

function check(value) {

    if (value == 'storedValue')

        testPassed('The property was present - the JS wrapper of customElements was not collected');

    else

        testFailed('The property was not present - the JS wrapper of customElements was erroneously collected');

}

</script>

</body>

</html>

nonexistent