<?xml version="1.0" encoding="UTF-8" standalone="yes" ?>
<!DOCTYPE bugzilla SYSTEM "https://bugs.webkit.org/page.cgi?id=bugzilla.dtd">

<bugzilla version="5.0.4.1"
          urlbase="https://bugs.webkit.org/"
          
          maintainer="admin@webkit.org"
>

    <bug>
          <bug_id>142958</bug_id>
          
          <creation_ts>2015-03-22 23:11:40 -0700</creation_ts>
          <short_desc>unsafety GenericEventQueue operation</short_desc>
          <delta_ts>2015-04-16 19:09:31 -0700</delta_ts>
          <reporter_accessible>1</reporter_accessible>
          <cclist_accessible>1</cclist_accessible>
          <classification_id>1</classification_id>
          <classification>Unclassified</classification>
          <product>WebKit</product>
          <component>New Bugs</component>
          <version>528+ (Nightly build)</version>
          <rep_platform>Unspecified</rep_platform>
          <op_sys>Unspecified</op_sys>
          <bug_status>NEW</bug_status>
          <resolution></resolution>
          
          
          <bug_file_loc></bug_file_loc>
          <status_whiteboard></status_whiteboard>
          <keywords></keywords>
          <priority>P2</priority>
          <bug_severity>Normal</bug_severity>
          <target_milestone>---</target_milestone>
          
          
          <everconfirmed>1</everconfirmed>
          <reporter name="Peng Xinchao">xinchao.peng</reporter>
          <assigned_to name="Nobody">webkit-unassigned</assigned_to>
          <cc>ap</cc>
    
    <cc>cdumez</cc>
    
    <cc>commit-queue</cc>
    
    <cc>esprehn+autocc</cc>
    
    <cc>jer.noble</cc>
    
    <cc>kangil.han</cc>
          

      

      

      

          <comment_sort_order>oldest_to_newest</comment_sort_order>  
          <long_desc isprivate="0" >
    <commentid>1079223</commentid>
    <comment_count>0</comment_count>
    <who name="Peng Xinchao">xinchao.peng</who>
    <bug_when>2015-03-22 23:11:40 -0700</bug_when>
    <thetext>In GenericEventQueue class, enqueueEvent function to append event to pendingQueues() and sharedTimerFired function to fire and remove event .
In fact ， the better method is that the close function is called in destruction function ,to remove event .
It is more safety than the closed is called by external class.</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>1079227</commentid>
    <comment_count>1</comment_count>
      <attachid>249221</attachid>
    <who name="Peng Xinchao">xinchao.peng</who>
    <bug_when>2015-03-22 23:40:20 -0700</bug_when>
    <thetext>Created attachment 249221
Patch</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>1079228</commentid>
    <comment_count>2</comment_count>
    <who name="WebKit Commit Bot">commit-queue</who>
    <bug_when>2015-03-22 23:42:56 -0700</bug_when>
    <thetext>Attachment 249221 did not pass style-queue:


ERROR: Source/WebCore/ChangeLog:8:  You should remove the &apos;No new tests&apos; and either add and list tests, or explain why no new tests were possible.  [changelog/nonewtests] [5]
Total errors found: 1 in 2 files


If any of these errors are false positives, please file a bug against check-webkit-style.</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>1079230</commentid>
    <comment_count>3</comment_count>
      <attachid>249222</attachid>
    <who name="Peng Xinchao">xinchao.peng</who>
    <bug_when>2015-03-22 23:52:29 -0700</bug_when>
    <thetext>Created attachment 249222
Patch</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>1079235</commentid>
    <comment_count>4</comment_count>
      <attachid>249222</attachid>
    <who name="Alexey Proskuryakov">ap</who>
    <bug_when>2015-03-23 00:16:43 -0700</bug_when>
    <thetext>Comment on attachment 249222
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=249222&amp;action=review

&gt; Source/WebCore/dom/GenericEventQueue.cpp:47
&gt; +    if (!m_isClosed)
&gt; +        close();

What bug does this fix?

As far as I can tell, close() doesn&apos;t have any effects that would be observable after object destruction, so this proposed change doesn&apos;t fix anything.</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>1086077</commentid>
    <comment_count>5</comment_count>
      <attachid>249222</attachid>
    <who name="Chris Dumez">cdumez</who>
    <bug_when>2015-04-16 14:43:21 -0700</bug_when>
    <thetext>Comment on attachment 249222
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=249222&amp;action=review

&gt; Source/WebCore/ChangeLog:8
&gt; +

This changelog does not explain what you are trying to fix. Also you have no layout test to confirm you are fixing something.

(I also read the comment on the bug but it is not clear at all)

&gt;&gt; Source/WebCore/dom/GenericEventQueue.cpp:47
&gt;&gt; +        close();
&gt; 
&gt; What bug does this fix?
&gt; 
&gt; As far as I can tell, close() doesn&apos;t have any effects that would be observable after object destruction, so this proposed change doesn&apos;t fix anything.

I agree with ap here, calling close() in the destructor is not helpful. All it does is:
m_weakPtrFactory.revokeAll();
m_pendingEvents.clear();

Both are already happening during the regular destruction process when those 2 data members are destroyed.</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>1086219</commentid>
    <comment_count>6</comment_count>
    <who name="Peng Xinchao">xinchao.peng</who>
    <bug_when>2015-04-16 18:56:36 -0700</bug_when>
    <thetext>Let us to analysis Class SourceBuffer .
m_asyncEventQueue is a member of SourceBuffer . When SourceBuffer is constructed , m_asyncEventQueue is created .
When SourceBuffer::scheduleEvent is called , event is appened into m_pendingEvents and m_weakPtrFactory is appended into GenericEventQueue::pendingQueues().
When SourceBuffer  is  destructor, GenericEventQueue is also destructor.
But if  event may be not fired , i think the event should be  Invaild . 
I think these evnet should be deleted .</thetext>
  </long_desc><long_desc isprivate="0" >
    <commentid>1086221</commentid>
    <comment_count>7</comment_count>
    <who name="Chris Dumez">cdumez</who>
    <bug_when>2015-04-16 19:09:31 -0700</bug_when>
    <thetext>(In reply to comment #6)
&gt; Let us to analysis Class SourceBuffer .
&gt; m_asyncEventQueue is a member of SourceBuffer . When SourceBuffer is
&gt; constructed , m_asyncEventQueue is created .
&gt; When SourceBuffer::scheduleEvent is called , event is appened into
&gt; m_pendingEvents and m_weakPtrFactory is appended into
&gt; GenericEventQueue::pendingQueues().
&gt; When SourceBuffer  is  destructor, GenericEventQueue is also destructor.
&gt; But if  event may be not fired , i think the event should be  Invaild . 
&gt; I think these evnet should be deleted .

As you said, the GenericEventQueue is destroyed. When it is destroyed, its &quot;Deque&lt;RefPtr&lt;Event&gt;&gt; m_pendingEvents&quot; member is also destroyed. When the Dequeue is destroyed, all the events in it will be unref&apos;d (and destroyed if no one else is holding a reference to them).</thetext>
  </long_desc>
      
          <attachment
              isobsolete="1"
              ispatch="1"
              isprivate="0"
          >
            <attachid>249221</attachid>
            <date>2015-03-22 23:40:20 -0700</date>
            <delta_ts>2015-03-22 23:52:19 -0700</delta_ts>
            <desc>Patch</desc>
            <filename>bug-142958-20150323143943.patch</filename>
            <type>text/plain</type>
            <size>1254</size>
            <attacher name="Peng Xinchao">xinchao.peng</attacher>
            
              <data encoding="base64">U3VidmVyc2lvbiBSZXZpc2lvbjogMTgxODQ1CmRpZmYgLS1naXQgYS9Tb3VyY2UvV2ViQ29yZS9D
aGFuZ2VMb2cgYi9Tb3VyY2UvV2ViQ29yZS9DaGFuZ2VMb2cKaW5kZXggYWQ3MjlhZjYyNmMxMGVk
MzNiZWQ1ODNlNjg0NWE3ZjJlZWRlNGZkNC4uODQzNzc4OWMxNjIzMzQ5NTY1Mzk5NmU1YjQ5NTI1
ZDMxYTQ3Y2U0ZCAxMDA2NDQKLS0tIGEvU291cmNlL1dlYkNvcmUvQ2hhbmdlTG9nCisrKyBiL1Nv
dXJjZS9XZWJDb3JlL0NoYW5nZUxvZwpAQCAtMSwzICsxLDE1IEBACisyMDE1LTAzLTIyICBYaW5j
aGFvIFBlbmcgIDx4aW5jaGFvLnBlbmdAc2Ftc3VuZy5jb20+CisKKyAgICAgICAgdW5zYWZldHkg
R2VuZXJpY0V2ZW50UXVldWUgb3BlcmF0aW9uCisgICAgICAgIGh0dHBzOi8vYnVncy53ZWJraXQu
b3JnL3Nob3dfYnVnLmNnaT9pZD0xNDI5NTgKKworICAgICAgICBSZXZpZXdlZCBieSBOT0JPRFkg
KE9PUFMhKS4KKworICAgICAgICBObyBuZXcgdGVzdHMgKE9PUFMhKS4KKworICAgICAgICAqIGRv
bS9HZW5lcmljRXZlbnRRdWV1ZS5jcHA6CisgICAgICAgIChXZWJDb3JlOjpHZW5lcmljRXZlbnRR
dWV1ZTo6fkdlbmVyaWNFdmVudFF1ZXVlKToKKwogMjAxNS0wMy0yMiAgQmVuamFtaW4gUG91bGFp
biAgPGJlbmphbWluQHdlYmtpdC5vcmc+CiAKICAgICAgICAgQ1NTIFNlbGVjdG9yczogZml4IGF0
dHJpYnV0ZSBjYXNlLWluc2Vuc2l0aXZlIG1hdGNoaW5nIG9mIENvbnRhaW4gYW5kIExpc3QKZGlm
ZiAtLWdpdCBhL1NvdXJjZS9XZWJDb3JlL2RvbS9HZW5lcmljRXZlbnRRdWV1ZS5jcHAgYi9Tb3Vy
Y2UvV2ViQ29yZS9kb20vR2VuZXJpY0V2ZW50UXVldWUuY3BwCmluZGV4IDEwYzAzNGNjZTdiZGY1
ZGVkOWMzNzJkYTE2NWIwZGZkMjdiMmRkM2QuLjIwY2RkM2IzNTQxZmFiNGIwOTUzZGNmZDY0YjA4
YjkyMzAyMDBiMTYgMTAwNjQ0Ci0tLSBhL1NvdXJjZS9XZWJDb3JlL2RvbS9HZW5lcmljRXZlbnRR
dWV1ZS5jcHAKKysrIGIvU291cmNlL1dlYkNvcmUvZG9tL0dlbmVyaWNFdmVudFF1ZXVlLmNwcApA
QCAtNDMsNiArNDMsOCBAQCBHZW5lcmljRXZlbnRRdWV1ZTo6R2VuZXJpY0V2ZW50UXVldWUoRXZl
bnRUYXJnZXQmIG93bmVyKQogCiBHZW5lcmljRXZlbnRRdWV1ZTo6fkdlbmVyaWNFdmVudFF1ZXVl
KCkKIHsKKyAgICBpZiAoIW1faXNDbG9zZWQpCisgICAgICAgIGNsb3NlKCk7CiB9CiAKIGJvb2wg
R2VuZXJpY0V2ZW50UXVldWU6OmVucXVldWVFdmVudChQYXNzUmVmUHRyPEV2ZW50PiBldmVudCkK
</data>

          </attachment>
          <attachment
              isobsolete="0"
              ispatch="1"
              isprivate="0"
          >
            <attachid>249222</attachid>
            <date>2015-03-22 23:52:29 -0700</date>
            <delta_ts>2015-04-16 14:43:21 -0700</delta_ts>
            <desc>Patch</desc>
            <filename>bug-142958-20150323145152.patch</filename>
            <type>text/plain</type>
            <size>1223</size>
            <attacher name="Peng Xinchao">xinchao.peng</attacher>
            
              <data encoding="base64">U3VidmVyc2lvbiBSZXZpc2lvbjogMTgxODQ1CmRpZmYgLS1naXQgYS9Tb3VyY2UvV2ViQ29yZS9D
aGFuZ2VMb2cgYi9Tb3VyY2UvV2ViQ29yZS9DaGFuZ2VMb2cKaW5kZXggYWQ3MjlhZjYyNmMxMGVk
MzNiZWQ1ODNlNjg0NWE3ZjJlZWRlNGZkNC4uODBkNGE4ZjFkMjdjNTUxYjBlMTgzNmFkN2FlYTQw
NzkzMmI4Mzc2OCAxMDA2NDQKLS0tIGEvU291cmNlL1dlYkNvcmUvQ2hhbmdlTG9nCisrKyBiL1Nv
dXJjZS9XZWJDb3JlL0NoYW5nZUxvZwpAQCAtMSwzICsxLDE0IEBACisyMDE1LTAzLTIyICBYaW5j
aGFvIFBlbmcgIDx4aW5jaGFvLnBlbmdAc2Ftc3VuZy5jb20+CisKKyAgICAgICAgdW5zYWZldHkg
R2VuZXJpY0V2ZW50UXVldWUgb3BlcmF0aW9uCisgICAgICAgIGh0dHBzOi8vYnVncy53ZWJraXQu
b3JnL3Nob3dfYnVnLmNnaT9pZD0xNDI5NTgKKworICAgICAgICBSZXZpZXdlZCBieSBOT0JPRFkg
KE9PUFMhKS4KKworCisgICAgICAgICogZG9tL0dlbmVyaWNFdmVudFF1ZXVlLmNwcDoKKyAgICAg
ICAgKFdlYkNvcmU6OkdlbmVyaWNFdmVudFF1ZXVlOjp+R2VuZXJpY0V2ZW50UXVldWUpOgorCiAy
MDE1LTAzLTIyICBCZW5qYW1pbiBQb3VsYWluICA8YmVuamFtaW5Ad2Via2l0Lm9yZz4KIAogICAg
ICAgICBDU1MgU2VsZWN0b3JzOiBmaXggYXR0cmlidXRlIGNhc2UtaW5zZW5zaXRpdmUgbWF0Y2hp
bmcgb2YgQ29udGFpbiBhbmQgTGlzdApkaWZmIC0tZ2l0IGEvU291cmNlL1dlYkNvcmUvZG9tL0dl
bmVyaWNFdmVudFF1ZXVlLmNwcCBiL1NvdXJjZS9XZWJDb3JlL2RvbS9HZW5lcmljRXZlbnRRdWV1
ZS5jcHAKaW5kZXggMTBjMDM0Y2NlN2JkZjVkZWQ5YzM3MmRhMTY1YjBkZmQyN2IyZGQzZC4uMjBj
ZGQzYjM1NDFmYWI0YjA5NTNkY2ZkNjRiMDhiOTIzMDIwMGIxNiAxMDA2NDQKLS0tIGEvU291cmNl
L1dlYkNvcmUvZG9tL0dlbmVyaWNFdmVudFF1ZXVlLmNwcAorKysgYi9Tb3VyY2UvV2ViQ29yZS9k
b20vR2VuZXJpY0V2ZW50UXVldWUuY3BwCkBAIC00Myw2ICs0Myw4IEBAIEdlbmVyaWNFdmVudFF1
ZXVlOjpHZW5lcmljRXZlbnRRdWV1ZShFdmVudFRhcmdldCYgb3duZXIpCiAKIEdlbmVyaWNFdmVu
dFF1ZXVlOjp+R2VuZXJpY0V2ZW50UXVldWUoKQogeworICAgIGlmICghbV9pc0Nsb3NlZCkKKyAg
ICAgICAgY2xvc2UoKTsKIH0KIAogYm9vbCBHZW5lcmljRXZlbnRRdWV1ZTo6ZW5xdWV1ZUV2ZW50
KFBhc3NSZWZQdHI8RXZlbnQ+IGV2ZW50KQo=
</data>
<flag name="review"
          id="274041"
          type_id="1"
          status="-"
          setter="cdumez"
    />
          </attachment>
      

    </bug>

</bugzilla>