Bug 127072

Summary: Don't autorelease wrapper object (WebProcessPlugInScriptWorld) for InjectedBundleScriptWorld::normalWorld().
Product: WebKit Reporter: Yongjun Zhang <yongjun_zhang>
Component: WebKit2Assignee: Nobody <webkit-unassigned>
Status: RESOLVED FIXED    
Severity: Normal CC: andersca, commit-queue, ggaren, mitz, sam
Priority: P2    
Version: 528+ (Nightly build)   
Hardware: Unspecified   
OS: Unspecified   
Attachments:
Description Flags
Patch. none

Description Yongjun Zhang 2014-01-15 16:07:16 PST 
InjectedBundleScriptWorld::normalWorld() returns a static InjectedBundleScriptWorld,  autoreleasing its wrapper object could cause dangling pointer to InjectedBundleScriptWorld and crash.
Comment 1 Yongjun Zhang 2014-01-15 16:08:33 PST 
This is referring to the method [WKWebProcessPlugInScriptWorld normalWorld]:

+ (WKWebProcessPlugInScriptWorld *)normalWorld
{
    return [wrapper(*InjectedBundleScriptWorld::normalWorld()) autorelease];
}
Comment 2 Yongjun Zhang 2014-01-15 16:14:45 PST 
Created attachment 221313 [details]
Patch.
Comment 3 Geoffrey Garen 2014-01-15 17:18:40 PST 
Comment on attachment 221313 [details]
Patch.

What about all the other uses of the "[wrapper(X) autorelease]" idiom, like the "world" selector in the same file, and a bunch of others?
Comment 4 Geoffrey Garen 2014-01-15 17:21:26 PST 
(In reply to comment #3)
> (From update of attachment 221313 [details])
> What about all the other uses of the "[wrapper(X) autorelease]" idiom, like the "world" selector in the same file, and a bunch of others?

I see. In all other cases, we only autorelease after allocating or ref-ing.
Comment 5 Geoffrey Garen 2014-01-15 17:21:42 PST 
Comment on attachment 221313 [details]
Patch.

r=me

Sadly, I am not a WK2 owner :(.
Comment 6 mitz 2014-01-15 17:23:26 PST 
r=me too
Comment 7 WebKit Commit Bot 2014-01-15 18:00:16 PST 
Comment on attachment 221313 [details]
Patch.

Clearing flags on attachment: 221313

Committed r162106: <http://trac.webkit.org/changeset/162106>
Comment 8 WebKit Commit Bot 2014-01-15 18:00:18 PST 
All reviewed patches have been landed.  Closing bug.