<?xml version="1.0" encoding="UTF-8" standalone="yes" ?>
<!DOCTYPE bugzilla SYSTEM "https://bugs.webkit.org/page.cgi?id=bugzilla.dtd">

<bugzilla version="5.0.4.1"
          urlbase="https://bugs.webkit.org/"
          
          maintainer="admin@webkit.org"
>

    <bug>
          <bug_id>112832</bug_id>
          
          <creation_ts>2013-03-20 13:25:51 -0700</creation_ts>
          <short_desc>Objective-C API: Fix over-releasing in allocateConstructorAndPrototypeWithSuperClassInfo:</short_desc>
          <delta_ts>2013-03-20 14:44:17 -0700</delta_ts>
          <reporter_accessible>1</reporter_accessible>
          <cclist_accessible>1</cclist_accessible>
          <classification_id>1</classification_id>
          <classification>Unclassified</classification>
          <product>WebKit</product>
          <component>JavaScriptCore</component>
          <version>528+ (Nightly build)</version>
          <rep_platform>Unspecified</rep_platform>
          <op_sys>Unspecified</op_sys>
          <bug_status>RESOLVED</bug_status>
          <resolution>FIXED</resolution>
          
          
          <bug_file_loc></bug_file_loc>
          <status_whiteboard></status_whiteboard>
          <keywords></keywords>
          <priority>P2</priority>
          <bug_severity>Normal</bug_severity>
          <target_milestone>---</target_milestone>
          
          
          <everconfirmed>1</everconfirmed>
          <reporter name="Mark Hahnenberg">mhahnenberg</reporter>
          <assigned_to name="Mark Hahnenberg">mhahnenberg</assigned_to>
          
          

      

      

      

          <comment_sort_order>oldest_to_newest</comment_sort_order>  
          <long_desc isprivate="0" >
    <commentid>859647</commentid>
    <comment_count>0</comment_count>
    <who name="Mark Hahnenberg">mhahnenberg</who>
    <bug_when>2013-03-20 13:25:51 -0700</bug_when>
    <thetext>If either the m_constructor or m_prototype (but not both) is collected, we will call allocateConstructorAndPrototypeWithSuperClassInfo, which will create a new object to replace the one that was collected, but at the end of the method we call release on both of them. This is incorrect since we autorelease the JSValue in the case that the object doesn&apos;t need to be reallocated. Thus we&apos;ll end up overreleasing later during the drain of the autorelease pool.</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>859688</commentid>
    <comment_count>1</comment_count>
      <attachid>194111</attachid>
    <who name="Mark Hahnenberg">mhahnenberg</who>
    <bug_when>2013-03-20 13:49:24 -0700</bug_when>
    <thetext>Created attachment 194111
Patch</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>859691</commentid>
    <comment_count>2</comment_count>
    <who name="Mark Hahnenberg">mhahnenberg</who>
    <bug_when>2013-03-20 13:53:12 -0700</bug_when>
    <thetext>&lt;rdar://problem/13465627&gt;</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>859696</commentid>
    <comment_count>3</comment_count>
      <attachid>194111</attachid>
    <who name="Geoffrey Garen">ggaren</who>
    <bug_when>2013-03-20 13:57:53 -0700</bug_when>
    <thetext>Comment on attachment 194111
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=194111&amp;action=review

r=me

&gt; Source/JavaScriptCore/ChangeLog:15
&gt; +        (createObjectWithCustomBrand): We no longer alloc here. We instead call the JSValue valueWithValue class method,

&quot;create&quot; is a term of art for returning a +1 retained object. Since you&apos;re changing this function to return an autoreleased object, you should rename it to &quot;objectWithCustomBrand&quot;.</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>859752</commentid>
    <comment_count>4</comment_count>
    <who name="Mark Hahnenberg">mhahnenberg</who>
    <bug_when>2013-03-20 14:44:17 -0700</bug_when>
    <thetext>Committed r146392: &lt;http://trac.webkit.org/changeset/146392&gt;</thetext>
  </long_desc>
      
          <attachment
              isobsolete="0"
              ispatch="1"
              isprivate="0"
          >
            <attachid>194111</attachid>
            <date>2013-03-20 13:49:24 -0700</date>
            <delta_ts>2013-03-20 13:57:53 -0700</delta_ts>
            <desc>Patch</desc>
            <filename>bug-112832-20130320134513.patch</filename>
            <type>text/plain</type>
            <size>3608</size>
            <attacher name="Mark Hahnenberg">mhahnenberg</attacher>
            
              <data encoding="base64">SW5kZXg6IFNvdXJjZS9KYXZhU2NyaXB0Q29yZS9DaGFuZ2VMb2cKPT09PT09PT09PT09PT09PT09
PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PQotLS0gU291
cmNlL0phdmFTY3JpcHRDb3JlL0NoYW5nZUxvZwkocmV2aXNpb24gMTQ2MzgzKQorKysgU291cmNl
L0phdmFTY3JpcHRDb3JlL0NoYW5nZUxvZwkod29ya2luZyBjb3B5KQpAQCAtMSwzICsxLDIzIEBA
CisyMDEzLTAzLTIwICBNYXJrIEhhaG5lbmJlcmcgIDxtaGFobmVuYmVyZ0BhcHBsZS5jb20+CisK
KyAgICAgICAgT2JqZWN0aXZlLUMgQVBJOiBGaXggb3Zlci1yZWxlYXNpbmcgaW4gYWxsb2NhdGVD
b25zdHJ1Y3RvckFuZFByb3RvdHlwZVdpdGhTdXBlckNsYXNzSW5mbzoKKyAgICAgICAgaHR0cHM6
Ly9idWdzLndlYmtpdC5vcmcvc2hvd19idWcuY2dpP2lkPTExMjgzMgorCisgICAgICAgIFJldmll
d2VkIGJ5IE5PQk9EWSAoT09QUyEpLgorCisgICAgICAgIElmIGVpdGhlciB0aGUgbV9jb25zdHJ1
Y3RvciBvciBtX3Byb3RvdHlwZSAoYnV0IG5vdCBib3RoKSBpcyBjb2xsZWN0ZWQsIHdlIHdpbGwg
Y2FsbCAKKyAgICAgICAgYWxsb2NhdGVDb25zdHJ1Y3RvckFuZFByb3RvdHlwZVdpdGhTdXBlckNs
YXNzSW5mbywgd2hpY2ggd2lsbCBjcmVhdGUgYSBuZXcgb2JqZWN0IHRvIHJlcGxhY2UgdGhlIG9u
ZSAKKyAgICAgICAgdGhhdCB3YXMgY29sbGVjdGVkLCBidXQgYXQgdGhlIGVuZCBvZiB0aGUgbWV0
aG9kIHdlIGNhbGwgcmVsZWFzZSBvbiBib3RoIG9mIHRoZW0uIAorICAgICAgICBUaGlzIGlzIGlu
Y29ycmVjdCBzaW5jZSB3ZSBhdXRvcmVsZWFzZSB0aGUgSlNWYWx1ZSBpbiB0aGUgY2FzZSB0aGF0
IHRoZSBvYmplY3QgZG9lc24ndCBuZWVkIHRvIGJlIAorICAgICAgICByZWFsbG9jYXRlZC4gVGh1
cyB3ZSdsbCBlbmQgdXAgb3ZlcnJlbGVhc2luZyBsYXRlciBkdXJpbmcgdGhlIGRyYWluIG9mIHRo
ZSBhdXRvcmVsZWFzZSBwb29sLgorCisgICAgICAgICogQVBJL0pTV3JhcHBlck1hcC5tbToKKyAg
ICAgICAgKGNyZWF0ZU9iamVjdFdpdGhDdXN0b21CcmFuZCk6IFdlIG5vIGxvbmdlciBhbGxvYyBo
ZXJlLiBXZSBpbnN0ZWFkIGNhbGwgdGhlIEpTVmFsdWUgdmFsdWVXaXRoVmFsdWUgY2xhc3MgbWV0
aG9kLAorICAgICAgICB3aGljaCBhdXRvcmVsZWFzZXMgZm9yIHVzLgorICAgICAgICAoLVtKU09i
akNDbGFzc0luZm8gYWxsb2NhdGVDb25zdHJ1Y3RvckFuZFByb3RvdHlwZVdpdGhTdXBlckNsYXNz
SW5mbzpdKTogV2Ugbm8gbG9uZ2VyIGNhbGwgcmVsZWFzZSBvbiB0aGUgCisgICAgICAgIGNvbnN0
cnVjdG9yIG9yIHByb3RvdHlwZSBKU1ZhbHVlcy4KKyAgICAgICAgKiBBUEkvdGVzdHMvdGVzdGFw
aS5tbTogQWRkZWQgYSBuZXcgdGVzdCB0aGF0IGNyYXNoZXMgb24gVG9UIGR1ZSB0byBvdmVyLXJl
bGVhc2luZy4KKwogMjAxMy0wMy0xOSAgRmlsaXAgUGl6bG8gIDxmcGl6bG9AYXBwbGUuY29tPgog
CiAgICAgICAgIEl0J3MgY2FsbGVkICJIYXNoIENvbnNpbmciIG5vdCAiSGFzaCBDb25zdGluZyIK
SW5kZXg6IFNvdXJjZS9KYXZhU2NyaXB0Q29yZS9BUEkvSlNXcmFwcGVyTWFwLm1tCj09PT09PT09
PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09
PT0KLS0tIFNvdXJjZS9KYXZhU2NyaXB0Q29yZS9BUEkvSlNXcmFwcGVyTWFwLm1tCShyZXZpc2lv
biAxNDYzNzgpCisrKyBTb3VyY2UvSmF2YVNjcmlwdENvcmUvQVBJL0pTV3JhcHBlck1hcC5tbQko
d29ya2luZyBjb3B5KQpAQCAtMTQ0LDcgKzE0NCw3IEBAIHN0YXRpYyBKU1ZhbHVlICpjcmVhdGVP
YmplY3RXaXRoQ3VzdG9tQnIKICAgICBKU0NsYXNzUmVmIGNsYXNzUmVmID0gSlNDbGFzc0NyZWF0
ZSgmZGVmaW5pdGlvbik7CiAgICAgSlNPYmplY3RSZWYgcmVzdWx0ID0gbWFrZVdyYXBwZXIoW2Nv
bnRleHQgZ2xvYmFsQ29udGV4dFJlZl0sIGNsYXNzUmVmLCBjbHMpOwogICAgIEpTQ2xhc3NSZWxl
YXNlKGNsYXNzUmVmKTsKLSAgICByZXR1cm4gW1tKU1ZhbHVlIGFsbG9jXSBpbml0V2l0aFZhbHVl
OnJlc3VsdCBpbkNvbnRleHQ6Y29udGV4dF07CisgICAgcmV0dXJuIFtKU1ZhbHVlIHZhbHVlV2l0
aFZhbHVlOnJlc3VsdCBpbkNvbnRleHQ6Y29udGV4dF07CiB9CiAKIC8vIExvb2sgZm9yIEBvcHRp
b25hbCBwcm9wZXJ0aWVzIGluIHRoZSBwcm90b3R5cGUgY29udGFpbmluZyBhIHNlbGVjdG9yIHRv
IHByb3BlcnR5CkBAIC00MDEsOSArNDAxLDYgQEAgICAgICAgICBmb3JFYWNoUHJvdG9jb2xJbXBs
ZW1lbnRpbmdQcm90bwogCiAgICAgICAgIC8vIFNldCBbUHJvdG90eXBlXS4KICAgICAgICAgSlNP
YmplY3RTZXRQcm90b3R5cGUoW21fY29udGV4dCBnbG9iYWxDb250ZXh0UmVmXSwgdG9SZWYobV9w
cm90b3R5cGUuZ2V0KCkpLCB0b1JlZihzdXBlckNsYXNzSW5mby0+bV9wcm90b3R5cGUuZ2V0KCkp
KTsKLQotICAgICAgICBbY29uc3RydWN0b3IgcmVsZWFzZV07Ci0gICAgICAgIFtwcm90b3R5cGUg
cmVsZWFzZV07CiAgICAgfQogfQogCkluZGV4OiBTb3VyY2UvSmF2YVNjcmlwdENvcmUvQVBJL3Rl
c3RzL3Rlc3RhcGkubW0KPT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09PT09
PT09PT09PT09PT09PT09PT09PT09PT09PQotLS0gU291cmNlL0phdmFTY3JpcHRDb3JlL0FQSS90
ZXN0cy90ZXN0YXBpLm1tCShyZXZpc2lvbiAxNDYzNzgpCisrKyBTb3VyY2UvSmF2YVNjcmlwdENv
cmUvQVBJL3Rlc3RzL3Rlc3RhcGkubW0JKHdvcmtpbmcgY29weSkKQEAgLTU2Miw2ICs1NjIsMjIg
QEAgdm9pZCB0ZXN0T2JqZWN0aXZlQ0FQSSgpCiAKICAgICBAYXV0b3JlbGVhc2Vwb29sIHsKICAg
ICAgICAgSlNDb250ZXh0ICpjb250ZXh0ID0gW1tKU0NvbnRleHQgYWxsb2NdIGluaXRdOworICAg
ICAgICBUZXN0T2JqZWN0ICp0ZXN0T2JqZWN0ID0gW1Rlc3RPYmplY3QgdGVzdE9iamVjdF07Cisg
ICAgICAgIEBhdXRvcmVsZWFzZXBvb2wgeworICAgICAgICAgICAgY29udGV4dFtAInRlc3RPYmpl
Y3QiXSA9IHRlc3RPYmplY3Q7CisgICAgICAgICAgICBbY29udGV4dCBldmFsdWF0ZVNjcmlwdDpA
InZhciBjb25zdHJ1Y3RvciA9IE9iamVjdC5nZXRQcm90b3R5cGVPZih0ZXN0T2JqZWN0KS5jb25z
dHJ1Y3RvcjsgY29uc3RydWN0b3IucHJvdG90eXBlID0gdW5kZWZpbmVkOyJdOworICAgICAgICAg
ICAgW2NvbnRleHQgZXZhbHVhdGVTY3JpcHQ6QCJ0ZXN0T2JqZWN0ID0gdW5kZWZpbmVkIl07Cisg
ICAgICAgIH0KKyAgICAgICAgCisgICAgICAgIEpTU3luY2hyb25vdXNHYXJiYWdlQ29sbGVjdEZv
ckRlYnVnZ2luZyhbY29udGV4dCBnbG9iYWxDb250ZXh0UmVmXSk7CisKKyAgICAgICAgQGF1dG9y
ZWxlYXNlcG9vbCB7CisgICAgICAgICAgICBjb250ZXh0W0AidGVzdE9iamVjdCJdID0gdGVzdE9i
amVjdDsKKyAgICAgICAgfQorICAgIH0KKworICAgIEBhdXRvcmVsZWFzZXBvb2wgeworICAgICAg
ICBKU0NvbnRleHQgKmNvbnRleHQgPSBbW0pTQ29udGV4dCBhbGxvY10gaW5pdF07CiAgICAgICAg
IFRleHRYWVogKnRlc3RYWVogPSBbW1RleHRYWVogYWxsb2NdIGluaXRdOwogCiAgICAgICAgIEBh
dXRvcmVsZWFzZXBvb2wgewo=
</data>
<flag name="review"
          id="215830"
          type_id="1"
          status="+"
          setter="ggaren"
    />
          </attachment>
      

    </bug>

</bugzilla>