Bug 104921 – [V8] Regression causing DOM objects to have unstable NPObject* references with v8 bindings

• Component: WebCore Misc.
• Status: RESOLVED FIXED

[Matthew Dempsky]

Created attachment 179282 [details]
Fix for NPV8Object regression

For details, see crbug.com/165307.

I've identified this WebKit patch as the issue: http://trac.webkit.org/changeset?format=diff&new=135804&old=135803&new_path=%2Ftrunk&old_path=%2Ftrunk

In particular, in the "iter != v8NPObjectMap->end()" case, if the 'for' loop terminates without returning, then objectVector will not be set, and the created NPObject pointer will not be saved and the newly created NPObject will not be saved for future reuse.

I also notice that v8NPObjectMap is keyed off Object::GetIdentityHash(), but the V8 Object documentation explicitly states that identity hashes are not unique: http://code.google.com/p/v8/source/browse/trunk/include/v8.h#1702

So I believe this code:

    if (v8npObject->rootObject == root) {
        ASSERT(v8npObject->v8Object == object);

should also be changed to:

    if (v8npObject->v8Object == object && v8npObject->rootObject == root) {

See attached patch.

[Matthew Dempsky]

Created attachment 179782 [details]
Patch

[Matthew Dempsky]

haraken@ or japhet@ - can you r? cq?

Thanks!

[Matthew Dempsky]

Comment on attachment 179782 [details]
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=179782&action=review

> Source/WebCore/ChangeLog:17
> +        No tests.  Testing requires a custom plugin to compare NPObject* for

FWIW, I've manually tested that this fix works for Chromium with the GWT Developer Mode plugin.  However, I don't know how to build a custom NPAPI plugin just for the WebKit LayoutTests.  If someone can give me clear instructions on how to do that, I'm happy to try that.

[Matthew Dempsky]

Created attachment 179807 [details]
Patch

[WebKit Review Bot]

Comment on attachment 179807 [details]
Patch

Attachment 179807 [details] did not pass chromium-ews (chromium-xvfb):
Output: http://queues.webkit.org/results/15364940

New failing tests:
plugins/npruntime/embed-property-equality.html

[Matthew Dempsky]

Sorry, I'm still working on fixing the patch.  There's a whitespace issue that caused it to fail, but more egregiously, it doesn't actually test the bug here since it passes even without my fix.

I'm currently working on a new patch to add another method to TestNetscapePlugIn that will let me actually exercise the bug.

[Kentaro Hara]

Comment on attachment 179807 [details]
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=179807&action=review

The change looks reasonable to me. I'll r+ it once you fixed the test result.

> LayoutTests/ChangeLog:11
> +        * plugins/npruntime/embed-property-equality.html: Test two plugin instances.

You need to update the test result.

You can update the test result by:

$ ./webkit/tools/layout_tests/run_webkit_tests.py --reset-results --debug plugins/npruntime/embed-property-equality.html

(--debug is not needed if you're building in the Release mode.)

[Matthew Dempsky]

Created attachment 179826 [details]
Patch

[Kentaro Hara]

Comment on attachment 179826 [details]
Patch

Looks OK

[Matthew Dempsky]

Created attachment 179827 [details]
Patch

[Matthew Dempsky]

Comment on attachment 179827 [details]
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=179827&action=review

> LayoutTests/plugins/npruntime/embed-property-iframe-equality.html:4
> +<iframe srcdoc="<script>parent.plugin.remember(parent.document)</script>"></iframe>

Sorry, made one minor fix to here.  Only need one argument for remember(), not two.

[WebKit Review Bot]

Comment on attachment 179827 [details]
Patch

Clearing flags on attachment: 179827

Committed r137964: <http://trac.webkit.org/changeset/137964>

[WebKit Review Bot]

All reviewed patches have been landed.  Closing bug.

[Csaba Osztrogonác]

(In reply to comment #12)
> (From update of attachment 179827 [details])
> Clearing flags on attachment: 179827
> 
> Committed r137964: <http://trac.webkit.org/changeset/137964>

The new test fails on WK2 platforms - see https://bugs.webkit.org/show_bug.cgi?id=105266 for details.

[Matthew Dempsky]

What's the proper process to request this patch be considered for merging into branches/chromium/1312 and branches/chromium/1359?  The regression was introduced in r135804, which was merged into branches/chromium/1312 as r136064, and was also included in the base version for branches/chromium/1359 (which branched from r137490).

[Kentaro Hara]

(In reply to comment #15)
> What's the proper process to request this patch be considered for merging into branches/chromium/1312 and branches/chromium/1359?  The regression was introduced in r135804, which was merged into branches/chromium/1312 as r136064, and was also included in the base version for branches/chromium/1359 (which branched from r137490).

Sent you a private email.

[Matthew Dempsky]

FYI, I've filed https://bugs.webkit.org/show_bug.cgi?id=105495 with more variations on this issue.  I've already written LayoutTests to demonstrate the bugs, but I don't have fixes for them yet.