Bug 270610
| Summary: | [IPCTestingAPI] JSGlobalObject may be destroyed when sending IPC messages during page teardown | ||
|---|---|---|---|
| Product: | WebKit | Reporter: | Charlie Wolfe <charliew> |
| Component: | Tools / Tests | Assignee: | Charlie Wolfe <charliew> |
| Status: | RESOLVED FIXED | ||
| Severity: | Normal | CC: | webkit-bug-importer |
| Priority: | P2 | Keywords: | InRadar |
| Version: | WebKit Nightly Build | ||
| Hardware: | Unspecified | ||
| OS: | Unspecified | ||
Charlie Wolfe
Some objects send IPC messages in their destructor. So, when the page is being torn down, it is possible that the JSGlobalObject associated with the JSContextRef we are storing has already been destroyed. To fix this, we should instead hold a weak reference to the global object and early return when it has been destroyed.
| Attachments | ||
|---|---|---|
| Add attachment proposed patch, testcase, etc. |
Charlie Wolfe
rdar://114871193
Charlie Wolfe
Pull request: https://github.com/WebKit/WebKit/pull/25560
EWS
Committed 275792@main (de54ecba6b59): <https://commits.webkit.org/275792@main>
Reviewed commits have been landed. Closing PR #25560 and removing active labels.