30137 2009-10-06 13:09:23 -0700 [V8] Protect JS listener object from GC while clearing a property on it. 2009-10-07 10:25:17 -0700 1 1 1 Unclassified WebKit WebCore Misc. 528+ (Nightly build) All All RESOLVED FIXED P2 Normal --- 0 vitalyr webkit-unassigned abarth commit-queue dglazkov eric oldest_to_newest 152835 0 vitalyr 2009-10-06 13:09:23 -0700 [V8] Protect JS listener object from GC while clearing a property on it. 152861 1 40745 vitalyr 2009-10-06 14:26:17 -0700 Created attachment 40745 patch 153072 2 40745 abarth 2009-10-07 09:33:10 -0700 Comment on attachment 40745 patch I don't see how this is possible to test. We'd need to force GC during the clearWrapper call, but I don't think that re-enters JavaScript.... Thoughts? 153104 3 40745 commit-queue 2009-10-07 10:25:13 -0700 Comment on attachment 40745 patch Clearing flags on attachment: 40745 Committed r49252: <http://trac.webkit.org/changeset/49252> 153105 4 commit-queue 2009-10-07 10:25:17 -0700 All reviewed patches have been landed. Closing bug. 40745 2009-10-06 14:26:17 -0700 2009-10-07 10:25:13 -0700 patch listener_protect.patch text/plain 1440 vitalyr ZGlmZiAtLWdpdCBhL1dlYkNvcmUvQ2hhbmdlTG9nIGIvV2ViQ29yZS9DaGFuZ2VMb2cKaW5kZXgg ZWNhMWZjNC4uY2FjZjRiMyAxMDA2NDQKLS0tIGEvV2ViQ29yZS9DaGFuZ2VMb2cKKysrIGIvV2Vi Q29yZS9DaGFuZ2VMb2cKQEAgLTEsMyArMSwxNCBAQAorMjAwOS0xMC0wNiAgVml0YWx5IFJlcGVz aGtvICA8dml0YWx5ckBjaHJvbWl1bS5vcmc+CisKKyAgICAgICAgUmV2aWV3ZWQgYnkgTk9CT0RZ IChPT1BTISkuCisKKyAgICAgICAgW1Y4XSBQcm90ZWN0IEpTIGxpc3RlbmVyIG9iamVjdCBmcm9t IEdDIHdoaWxlIGNsZWFyaW5nIGEgcHJvcGVydHkgb24gaXQuCisgICAgICAgIFNlZSBodHRwOi8v Y3JidWcuY29tLzIzNzgwLgorICAgICAgICBodHRwczovL2J1Z3Mud2Via2l0Lm9yZy9zaG93X2J1 Zy5jZ2k/aWQ9MzAxMzcKKworICAgICAgICAqIGJpbmRpbmdzL3Y4L1Y4QWJzdHJhY3RFdmVudExp c3RlbmVyLmNwcDoKKyAgICAgICAgKFdlYkNvcmU6OlY4QWJzdHJhY3RFdmVudExpc3RlbmVyOjp+ VjhBYnN0cmFjdEV2ZW50TGlzdGVuZXIpOgorCiAyMDA5LTEwLTA1ICBKdWxpZSBQYXJlbnQgIDxq cGFyZW50QGNocm9taXVtLm9yZz4KIAogICAgICAgICBVbnJldmlld2VkLCBsYXN0IENocm9taXVt IGJ1aWxkIGZpeCBjb3JyZXNwb25kaW5nIHRvIHJldmlzaW9uIDQ5MTEzLgpkaWZmIC0tZ2l0IGEv V2ViQ29yZS9iaW5kaW5ncy92OC9WOEFic3RyYWN0RXZlbnRMaXN0ZW5lci5jcHAgYi9XZWJDb3Jl L2JpbmRpbmdzL3Y4L1Y4QWJzdHJhY3RFdmVudExpc3RlbmVyLmNwcAppbmRleCAxMmEyY2Q5Li43 OTUzNThlIDEwMDY0NAotLS0gYS9XZWJDb3JlL2JpbmRpbmdzL3Y4L1Y4QWJzdHJhY3RFdmVudExp c3RlbmVyLmNwcAorKysgYi9XZWJDb3JlL2JpbmRpbmdzL3Y4L1Y4QWJzdHJhY3RFdmVudExpc3Rl bmVyLmNwcApAQCAtNzUsOCArNzUsMTEgQEAgVjhBYnN0cmFjdEV2ZW50TGlzdGVuZXI6OlY4QWJz dHJhY3RFdmVudExpc3RlbmVyKEZyYW1lKiBmcmFtZSwgUGFzc1JlZlB0cjxWOExpc3QKIAogVjhB YnN0cmFjdEV2ZW50TGlzdGVuZXI6On5WOEFic3RyYWN0RXZlbnRMaXN0ZW5lcigpCiB7Ci0gICAg aWYgKCFtX2xpc3RlbmVyLklzRW1wdHkoKSkKLSAgICAgICAgVjhFdmVudExpc3RlbmVyTGlzdDo6 Y2xlYXJXcmFwcGVyKG1fbGlzdGVuZXIsIG1faXNBdHRyaWJ1dGUpOworICAgIGlmICghbV9saXN0 ZW5lci5Jc0VtcHR5KCkpIHsKKyAgICAgICAgdjg6OkhhbmRsZVNjb3BlIHNjb3BlOworICAgICAg ICB2ODo6TG9jYWw8djg6Ok9iamVjdD4gbGlzdGVuZXIgPSB2ODo6TG9jYWw8djg6Ok9iamVjdD46 Ok5ldyhtX2xpc3RlbmVyKTsKKyAgICAgICAgVjhFdmVudExpc3RlbmVyTGlzdDo6Y2xlYXJXcmFw cGVyKGxpc3RlbmVyLCBtX2lzQXR0cmlidXRlKTsKKyAgICB9CiAgICAgZGlzcG9zZUxpc3RlbmVy T2JqZWN0KCk7CiB9CiAK