197576 2019-05-03 13:53:46 -0700 Use WeakPtr for JSLazyEventListener::m_originalNode for safety 2019-05-06 10:56:22 -0700 1 1 1 Unclassified WebKit WebCore Misc. WebKit Nightly Build Unspecified Unspecified RESOLVED FIXED https://bugs.webkit.org/show_bug.cgi?id=197617 InRadar P2 Normal --- 1 cdumez cdumez achristensen ap beidson ggaren rniwa webkit-bug-importer oldest_to_newest 1532942 0 cdumez 2019-05-03 13:53:46 -0700 Use WeakPtr for JSLazyEventListener::m_originalNode for safety. 1532944 1 cdumez 2019-05-03 13:54:03 -0700 <rdar://problem/24314027> 1532945 2 368981 cdumez 2019-05-03 13:57:02 -0700 Created attachment 368981 Patch 1533003 3 368981 cdumez 2019-05-03 15:01:23 -0700 Comment on attachment 368981 Patch Clearing flags on attachment: 368981 Committed r244926: <https://trac.webkit.org/changeset/244926> 1533004 4 cdumez 2019-05-03 15:01:24 -0700 All reviewed patches have been landed. Closing bug. 1533285 5 368981 ap 2019-05-05 13:35:50 -0700 Comment on attachment 368981 Patch View in context: https://bugs.webkit.org/attachment.cgi?id=368981&action=review > Source/WebCore/ChangeLog:3 > + Use WeakPtr for JSLazyEventListener::m_originalNode for safety Is this the correct behavior though? Seems like the node needs to be kept alive, and reference cycle needs to be broken in some other way. I think that it warrants a FIXME and assertion at least. 1533389 6 cdumez 2019-05-06 08:58:29 -0700 (In reply to Alexey Proskuryakov from comment #5) > Comment on attachment 368981 [details] > Patch > > View in context: > https://bugs.webkit.org/attachment.cgi?id=368981&action=review > > > Source/WebCore/ChangeLog:3 > > + Use WeakPtr for JSLazyEventListener::m_originalNode for safety > > Is this the correct behavior though? Seems like the node needs to be kept > alive, and reference cycle needs to be broken in some other way. No, I do not think we want to keep the original node alive. When we crash (rdar://problem/24314027), the lazy event listener is for a Window object. Lazy event listener for a Window are supposed to have a m_originalNode that is nullptr. So either a lazy event listener was somehow transferred from an element/document to a Window or something else is going on. > > I think that it warrants a FIXME and assertion at least. I am planning on adding assertions to help find the underlying cause of <rdar://problem/24314027>. I'll add the FIXME with the assertions. 368981 2019-05-03 13:57:02 -0700 2019-05-03 15:01:23 -0700 Patch bug-197576-20190503135702.patch text/plain 6074 cdumez U3VidmVyc2lvbiBSZXZpc2lvbjogMjQ0OTEyCmRpZmYgLS1naXQgYS9Tb3VyY2UvV2ViQ29yZS9D aGFuZ2VMb2cgYi9Tb3VyY2UvV2ViQ29yZS9DaGFuZ2VMb2cKaW5kZXggOWE3NGUwOWY5ZjlhMDE5 MTIwOTc1YjdmMmU3ODQyYTgzZTkwMzEwNC4uZDc5YWY2MzA4NDQ5ZmRhNWNiYmZkNjljYWE0ZWRh YmIxYzZhY2ViNCAxMDA2NDQKLS0tIGEvU291cmNlL1dlYkNvcmUvQ2hhbmdlTG9nCisrKyBiL1Nv dXJjZS9XZWJDb3JlL0NoYW5nZUxvZwpAQCAtMSwzICsxLDE2IEBACisyMDE5LTA1LTAzICBDaHJp cyBEdW1leiAgPGNkdW1lekBhcHBsZS5jb20+CisKKyAgICAgICAgVXNlIFdlYWtQdHIgZm9yIEpT TGF6eUV2ZW50TGlzdGVuZXI6Om1fb3JpZ2luYWxOb2RlIGZvciBzYWZldHkKKyAgICAgICAgaHR0 cHM6Ly9idWdzLndlYmtpdC5vcmcvc2hvd19idWcuY2dpP2lkPTE5NzU3NgorICAgICAgICA8cmRh cjovL3Byb2JsZW0vMjQzMTQwMjc+CisKKyAgICAgICAgUmV2aWV3ZWQgYnkgTk9CT0RZIChPT1BT ISkuCisKKyAgICAgICAgKiBiaW5kaW5ncy9qcy9KU0xhenlFdmVudExpc3RlbmVyLmNwcDoKKyAg ICAgICAgKFdlYkNvcmU6OkpTTGF6eUV2ZW50TGlzdGVuZXI6OkpTTGF6eUV2ZW50TGlzdGVuZXIp OgorICAgICAgICAoV2ViQ29yZTo6SlNMYXp5RXZlbnRMaXN0ZW5lcjo6Y3JlYXRlKToKKyAgICAg ICAgKiBiaW5kaW5ncy9qcy9KU0xhenlFdmVudExpc3RlbmVyLmg6CisKIDIwMTktMDUtMDMgIEFu dHRpIEtvaXZpc3RvICA8YW50dGlAYXBwbGUuY29tPgogCiAgICAgICAgIEFkZCBhIHF1aXJrIHRv IG1ha2UgeW91dHViZSBuYXZpZ2F0aW9uIGJhciBzY3JvbGxhYmxlIHdpdGhvdXQgbW91c2UgaG92 ZXIgb24gaU9TCmRpZmYgLS1naXQgYS9Tb3VyY2UvV2ViQ29yZS9iaW5kaW5ncy9qcy9KU0xhenlF dmVudExpc3RlbmVyLmNwcCBiL1NvdXJjZS9XZWJDb3JlL2JpbmRpbmdzL2pzL0pTTGF6eUV2ZW50 TGlzdGVuZXIuY3BwCmluZGV4IGIzODJiMWY5NDZhN2M1NGVmMzhlYWZhNTI3MjY4ZTBlNzBlMGM5 NjAuLjhjYTEzMzZlZmYzYmY3NmJlM2MzZGQzMzUxZTRiMzg1YmU4MzE0NDAgMTAwNjQ0Ci0tLSBh L1NvdXJjZS9XZWJDb3JlL2JpbmRpbmdzL2pzL0pTTGF6eUV2ZW50TGlzdGVuZXIuY3BwCisrKyBi L1NvdXJjZS9XZWJDb3JlL2JpbmRpbmdzL2pzL0pTTGF6eUV2ZW50TGlzdGVuZXIuY3BwCkBAIC0z Myw2ICszMyw3IEBACiAjaW5jbHVkZSA8d3RmL05ldmVyRGVzdHJveWVkLmg+CiAjaW5jbHVkZSA8 d3RmL1JlZkNvdW50ZWRMZWFrQ291bnRlci5oPgogI2luY2x1ZGUgPHd0Zi9TdGRMaWJFeHRyYXMu aD4KKyNpbmNsdWRlIDx3dGYvV2Vha1B0ci5oPgogCiBuYW1lc3BhY2UgV2ViQ29yZSB7CiB1c2lu ZyBuYW1lc3BhY2UgSlNDOwpAQCAtNDMsNyArNDQsNyBAQCBzdHJ1Y3QgSlNMYXp5RXZlbnRMaXN0 ZW5lcjo6Q3JlYXRpb25Bcmd1bWVudHMgewogICAgIGNvbnN0IFF1YWxpZmllZE5hbWUmIGF0dHJp YnV0ZU5hbWU7CiAgICAgY29uc3QgQXRvbWljU3RyaW5nJiBhdHRyaWJ1dGVWYWx1ZTsKICAgICBE b2N1bWVudCYgZG9jdW1lbnQ7Ci0gICAgQ29udGFpbmVyTm9kZSogbm9kZTsKKyAgICBXZWFrUHRy PENvbnRhaW5lck5vZGU+IG5vZGU7CiAgICAgSlNPYmplY3QqIHdyYXBwZXI7CiAgICAgYm9vbCBz aG91bGRVc2VTVkdFdmVudE5hbWU7CiB9OwpAQCAtNjQsMjEgKzY1LDE1IEBAIHN0YXRpYyBUZXh0 UG9zaXRpb24gY29udmVydFplcm9Ub09uZShjb25zdCBUZXh0UG9zaXRpb24mIHBvc2l0aW9uKQog ICAgIHJldHVybiBwb3NpdGlvbjsKIH0KIAotSlNMYXp5RXZlbnRMaXN0ZW5lcjo6SlNMYXp5RXZl bnRMaXN0ZW5lcihjb25zdCBDcmVhdGlvbkFyZ3VtZW50cyYgYXJndW1lbnRzLCBjb25zdCBTdHJp bmcmIHNvdXJjZVVSTCwgY29uc3QgVGV4dFBvc2l0aW9uJiBzb3VyY2VQb3NpdGlvbikKK0pTTGF6 eUV2ZW50TGlzdGVuZXI6OkpTTGF6eUV2ZW50TGlzdGVuZXIoQ3JlYXRpb25Bcmd1bWVudHMmJiBh cmd1bWVudHMsIGNvbnN0IFN0cmluZyYgc291cmNlVVJMLCBjb25zdCBUZXh0UG9zaXRpb24mIHNv dXJjZVBvc2l0aW9uKQogICAgIDogSlNFdmVudExpc3RlbmVyKG51bGxwdHIsIGFyZ3VtZW50cy53 cmFwcGVyLCB0cnVlLCBtYWluVGhyZWFkTm9ybWFsV29ybGQoKSkKICAgICAsIG1fZnVuY3Rpb25O YW1lKGFyZ3VtZW50cy5hdHRyaWJ1dGVOYW1lLmxvY2FsTmFtZSgpLnN0cmluZygpKQogICAgICwg bV9ldmVudFBhcmFtZXRlck5hbWUoZXZlbnRQYXJhbWV0ZXJOYW1lKGFyZ3VtZW50cy5zaG91bGRV c2VTVkdFdmVudE5hbWUpKQogICAgICwgbV9jb2RlKGFyZ3VtZW50cy5hdHRyaWJ1dGVWYWx1ZSkK ICAgICAsIG1fc291cmNlVVJMKHNvdXJjZVVSTCkKICAgICAsIG1fc291cmNlUG9zaXRpb24oY29u dmVydFplcm9Ub09uZShzb3VyY2VQb3NpdGlvbikpCi0gICAgLCBtX29yaWdpbmFsTm9kZShhcmd1 bWVudHMubm9kZSkKKyAgICAsIG1fb3JpZ2luYWxOb2RlKFdURk1vdmUoYXJndW1lbnRzLm5vZGUp KQogewotICAgIC8vIFdlIGRvbid0IHJlZiBtX29yaWdpbmFsTm9kZSBiZWNhdXNlIHdlIGFzc3Vt ZSBpdCB3aWxsIHN0YXkgYWxpdmUgYXMgbG9uZyBhcyB0aGlzCi0gICAgLy8gaGFuZGxlciBvYmpl Y3QgaXMgYXJvdW5kIGFuZCB3ZSBuZWVkIHRvIGF2b2lkIGEgcmVmZXJlbmNlIGN5Y2xlLiBJZiBK UyB0cmFuc2ZlcnMKLSAgICAvLyB0aGlzIGhhbmRsZXIgdG8gYW5vdGhlciBub2RlLCBpbml0aWFs aXplSlNGdW5jdGlvbiB3aWxsIGJlIGNhbGxlZCBhbmQgYWZ0ZXIgdGhhdAotICAgIC8vIG1fb3Jp Z2luYWxOb2RlIHdpbGwgbmV2ZXIgYmUgbG9va2VkIGF0IGFnYWluLgotICAgIC8vIEZJWE1FOiBE b2Vzbid0IHNlZW0gY2xlYXIgdGhhdCBpcyBndWFyYW50ZWVkIHRvIGJlIHRydWUgaW4gdGhlIGdl bmVyYWwgY2FzZS4KLQogI2lmbmRlZiBOREVCVUcKICAgICBldmVudExpc3RlbmVyQ291bnRlci5p bmNyZW1lbnQoKTsKICNlbmRpZgpAQCAtMTU5LDcgKzE1NCw3IEBAIEpTT2JqZWN0KiBKU0xhenlF dmVudExpc3RlbmVyOjppbml0aWFsaXplSlNGdW5jdGlvbihTY3JpcHRFeGVjdXRpb25Db250ZXh0 JiBleGVjCiAgICAgcmV0dXJuIGpzRnVuY3Rpb247CiB9CiAKLVJlZlB0cjxKU0xhenlFdmVudExp c3RlbmVyPiBKU0xhenlFdmVudExpc3RlbmVyOjpjcmVhdGUoY29uc3QgQ3JlYXRpb25Bcmd1bWVu dHMmIGFyZ3VtZW50cykKK1JlZlB0cjxKU0xhenlFdmVudExpc3RlbmVyPiBKU0xhenlFdmVudExp c3RlbmVyOjpjcmVhdGUoQ3JlYXRpb25Bcmd1bWVudHMmJiBhcmd1bWVudHMpCiB7CiAgICAgaWYg KGFyZ3VtZW50cy5hdHRyaWJ1dGVWYWx1ZS5pc051bGwoKSkKICAgICAgICAgcmV0dXJuIG51bGxw dHI7CkBAIC0xNzQsMTkgKzE2OSwxOSBAQCBSZWZQdHI8SlNMYXp5RXZlbnRMaXN0ZW5lcj4gSlNM YXp5RXZlbnRMaXN0ZW5lcjo6Y3JlYXRlKGNvbnN0IENyZWF0aW9uQXJndW1lbnRzJgogICAgICAg ICBzb3VyY2VVUkwgPSBhcmd1bWVudHMuZG9jdW1lbnQudXJsKCkuc3RyaW5nKCk7CiAgICAgfQog Ci0gICAgcmV0dXJuIGFkb3B0UmVmKCpuZXcgSlNMYXp5RXZlbnRMaXN0ZW5lcihhcmd1bWVudHMs IHNvdXJjZVVSTCwgcG9zaXRpb24pKTsKKyAgICByZXR1cm4gYWRvcHRSZWYoKm5ldyBKU0xhenlF dmVudExpc3RlbmVyKFdURk1vdmUoYXJndW1lbnRzKSwgc291cmNlVVJMLCBwb3NpdGlvbikpOwog fQogCiBSZWZQdHI8SlNMYXp5RXZlbnRMaXN0ZW5lcj4gSlNMYXp5RXZlbnRMaXN0ZW5lcjo6Y3Jl YXRlKEVsZW1lbnQmIGVsZW1lbnQsIGNvbnN0IFF1YWxpZmllZE5hbWUmIGF0dHJpYnV0ZU5hbWUs IGNvbnN0IEF0b21pY1N0cmluZyYgYXR0cmlidXRlVmFsdWUpCiB7Ci0gICAgcmV0dXJuIGNyZWF0 ZSh7IGF0dHJpYnV0ZU5hbWUsIGF0dHJpYnV0ZVZhbHVlLCBlbGVtZW50LmRvY3VtZW50KCksICZl bGVtZW50LCBudWxscHRyLCBlbGVtZW50LmlzU1ZHRWxlbWVudCgpIH0pOworICAgIHJldHVybiBj cmVhdGUoeyBhdHRyaWJ1dGVOYW1lLCBhdHRyaWJ1dGVWYWx1ZSwgZWxlbWVudC5kb2N1bWVudCgp LCBtYWtlV2Vha1B0cihlbGVtZW50KSwgbnVsbHB0ciwgZWxlbWVudC5pc1NWR0VsZW1lbnQoKSB9 KTsKIH0KIAogUmVmUHRyPEpTTGF6eUV2ZW50TGlzdGVuZXI+IEpTTGF6eUV2ZW50TGlzdGVuZXI6 OmNyZWF0ZShEb2N1bWVudCYgZG9jdW1lbnQsIGNvbnN0IFF1YWxpZmllZE5hbWUmIGF0dHJpYnV0 ZU5hbWUsIGNvbnN0IEF0b21pY1N0cmluZyYgYXR0cmlidXRlVmFsdWUpCiB7CiAgICAgLy8gRklY TUU6IFRoaXMgYWx3YXlzIHBhc3NlcyBmYWxzZSBmb3IgInNob3VsZFVzZVNWR0V2ZW50TmFtZSIu IElzIHRoYXQgY29ycmVjdCBmb3IgZXZlbnRzIGRpc3BhdGNoZWQgdG8gU1ZHIGRvY3VtZW50cz8K ICAgICAvLyBUaGlzIGhhcyBiZWVuIHRoaXMgd2F5IGZvciBhIGxvbmcgdGltZSwgYnV0IGJlY2Ft ZSBtb3JlIG9idmlvdXMgd2hlbiByZWZhY3RvcmluZyB0byBzZXBhcmF0ZSB0aGUgRWxlbWVudCBh bmQgRG9jdW1lbnQgY29kZSBwYXRocy4KLSAgICByZXR1cm4gY3JlYXRlKHsgYXR0cmlidXRlTmFt ZSwgYXR0cmlidXRlVmFsdWUsIGRvY3VtZW50LCAmZG9jdW1lbnQsIG51bGxwdHIsIGZhbHNlIH0p OworICAgIHJldHVybiBjcmVhdGUoeyBhdHRyaWJ1dGVOYW1lLCBhdHRyaWJ1dGVWYWx1ZSwgZG9j dW1lbnQsIG1ha2VXZWFrUHRyKGRvY3VtZW50KSwgbnVsbHB0ciwgZmFsc2UgfSk7CiB9CiAKIFJl ZlB0cjxKU0xhenlFdmVudExpc3RlbmVyPiBKU0xhenlFdmVudExpc3RlbmVyOjpjcmVhdGUoRE9N V2luZG93JiB3aW5kb3csIGNvbnN0IFF1YWxpZmllZE5hbWUmIGF0dHJpYnV0ZU5hbWUsIGNvbnN0 IEF0b21pY1N0cmluZyYgYXR0cmlidXRlVmFsdWUpCmRpZmYgLS1naXQgYS9Tb3VyY2UvV2ViQ29y ZS9iaW5kaW5ncy9qcy9KU0xhenlFdmVudExpc3RlbmVyLmggYi9Tb3VyY2UvV2ViQ29yZS9iaW5k aW5ncy9qcy9KU0xhenlFdmVudExpc3RlbmVyLmgKaW5kZXggYmRlZTQyYTg0NWY5ZmUyOGE0ZmZj YjIyY2Q0NzA0Y2FiYmY5MTkxMC4uNTUyZDA3NzkzMDVlZmYwMTUwZTA4ODFjMGIyYWI3NjlhZDAx NWI3MSAxMDA2NDQKLS0tIGEvU291cmNlL1dlYkNvcmUvYmluZGluZ3MvanMvSlNMYXp5RXZlbnRM aXN0ZW5lci5oCisrKyBiL1NvdXJjZS9XZWJDb3JlL2JpbmRpbmdzL2pzL0pTTGF6eUV2ZW50TGlz dGVuZXIuaApAQCAtMjAsNiArMjAsNyBAQAogI3ByYWdtYSBvbmNlCiAKICNpbmNsdWRlICJKU0V2 ZW50TGlzdGVuZXIuaCIKKyNpbmNsdWRlIDx3dGYvRm9yd2FyZC5oPgogCiBuYW1lc3BhY2UgV2Vi Q29yZSB7CiAKQEAgLTQyLDggKzQzLDggQEAgcHVibGljOgogCiBwcml2YXRlOgogICAgIHN0cnVj dCBDcmVhdGlvbkFyZ3VtZW50czsKLSAgICBzdGF0aWMgUmVmUHRyPEpTTGF6eUV2ZW50TGlzdGVu ZXI+IGNyZWF0ZShjb25zdCBDcmVhdGlvbkFyZ3VtZW50cyYpOwotICAgIEpTTGF6eUV2ZW50TGlz dGVuZXIoY29uc3QgQ3JlYXRpb25Bcmd1bWVudHMmLCBjb25zdCBTdHJpbmcmIHNvdXJjZVVSTCwg Y29uc3QgVGV4dFBvc2l0aW9uJik7CisgICAgc3RhdGljIFJlZlB0cjxKU0xhenlFdmVudExpc3Rl bmVyPiBjcmVhdGUoQ3JlYXRpb25Bcmd1bWVudHMmJik7CisgICAgSlNMYXp5RXZlbnRMaXN0ZW5l cihDcmVhdGlvbkFyZ3VtZW50cyYmLCBjb25zdCBTdHJpbmcmIHNvdXJjZVVSTCwgY29uc3QgVGV4 dFBvc2l0aW9uJik7CiAKICAgICBKU0M6OkpTT2JqZWN0KiBpbml0aWFsaXplSlNGdW5jdGlvbihT Y3JpcHRFeGVjdXRpb25Db250ZXh0JikgY29uc3QgZmluYWw7CiAgICAgYm9vbCB3YXNDcmVhdGVk RnJvbU1hcmt1cCgpIGNvbnN0IGZpbmFsIHsgcmV0dXJuIHRydWU7IH0KQEAgLTUzLDcgKzU0LDcg QEAgcHJpdmF0ZToKICAgICBTdHJpbmcgbV9jb2RlOwogICAgIFN0cmluZyBtX3NvdXJjZVVSTDsK ICAgICBUZXh0UG9zaXRpb24gbV9zb3VyY2VQb3NpdGlvbjsKLSAgICBDb250YWluZXJOb2RlKiBt X29yaWdpbmFsTm9kZTsKKyAgICBXZWFrUHRyPENvbnRhaW5lck5vZGU+IG1fb3JpZ2luYWxOb2Rl OwogfTsKIAogfSAvLyBuYW1lc3BhY2UgV2ViQ29yZQo=