| Summary: | Use WeakPtr for JSLazyEventListener::m_originalNode for safety | ||||||
|---|---|---|---|---|---|---|---|
| Product: | WebKit | Reporter: | Chris Dumez <cdumez> | ||||
| Component: | WebCore Misc. | Assignee: | Chris Dumez <cdumez> | ||||
| Status: | RESOLVED FIXED | ||||||
| Severity: | Normal | CC: | achristensen, ap, beidson, ggaren, rniwa, webkit-bug-importer | ||||
| Priority: | P2 | Keywords: | InRadar | ||||
| Version: | WebKit Nightly Build | ||||||
| Hardware: | Unspecified | ||||||
| OS: | Unspecified | ||||||
| See Also: | https://bugs.webkit.org/show_bug.cgi?id=197617 | ||||||
| Attachments: |
|
||||||
|
Description
Chris Dumez
2019-05-03 13:53:46 PDT
Created attachment 368981 [details]
Patch
Comment on attachment 368981 [details] Patch Clearing flags on attachment: 368981 Committed r244926: <https://trac.webkit.org/changeset/244926> All reviewed patches have been landed. Closing bug. Comment on attachment 368981 [details] Patch View in context: https://bugs.webkit.org/attachment.cgi?id=368981&action=review > Source/WebCore/ChangeLog:3 > + Use WeakPtr for JSLazyEventListener::m_originalNode for safety Is this the correct behavior though? Seems like the node needs to be kept alive, and reference cycle needs to be broken in some other way. I think that it warrants a FIXME and assertion at least. (In reply to Alexey Proskuryakov from comment #5) > Comment on attachment 368981 [details] > Patch > > View in context: > https://bugs.webkit.org/attachment.cgi?id=368981&action=review > > > Source/WebCore/ChangeLog:3 > > + Use WeakPtr for JSLazyEventListener::m_originalNode for safety > > Is this the correct behavior though? Seems like the node needs to be kept > alive, and reference cycle needs to be broken in some other way. No, I do not think we want to keep the original node alive. When we crash (rdar://problem/24314027), the lazy event listener is for a Window object. Lazy event listener for a Window are supposed to have a m_originalNode that is nullptr. So either a lazy event listener was somehow transferred from an element/document to a Window or something else is going on. > > I think that it warrants a FIXME and assertion at least. I am planning on adding assertions to help find the underlying cause of <rdar://problem/24314027>. I'll add the FIXME with the assertions. |