| Summary: | [V8] Out-of-memory crash in isolated worlds | ||||||||
|---|---|---|---|---|---|---|---|---|---|
| Product: | WebKit | Reporter: | Adam Barth <abarth> | ||||||
| Component: | WebCore JavaScript | Assignee: | Nobody <webkit-unassigned> | ||||||
| Status: | RESOLVED FIXED | ||||||||
| Severity: | Normal | CC: | commit-queue | ||||||
| Priority: | P2 | ||||||||
| Version: | 528+ (Nightly build) | ||||||||
| Hardware: | All | ||||||||
| OS: | All | ||||||||
| Attachments: |
|
||||||||
Created attachment 42099 [details]
Patch v1
Comment on attachment 42099 [details]
Patch v1
This patch leaks the isolated world object.
Created attachment 42103 [details]
Patch v1
Comment on attachment 42103 [details]
Patch v1
r=me.
Comment on attachment 42103 [details]
Patch v1
Time to break the build!
Comment on attachment 42103 [details]
Patch v1
Can we make world a smart pointer (like OwnPtr) instead of using manual delete?
(In reply to comment #6) > (From update of attachment 42103 [details]) > Can we make world a smart pointer (like OwnPtr) instead of using manual delete? The problem is that it's lifetime is managed by the V8 GC. We manually delete it here because if we never create the context, we can't transfer ownership to V8. Comment on attachment 42103 [details] Patch v1 Clearing flags on attachment: 42103 Committed r50296: <http://trac.webkit.org/changeset/50296> All reviewed patches have been landed. Closing bug. Committed r50299: <http://trac.webkit.org/changeset/50299> |
---------------------------- * Crash Trace * ---------------------------- [api.cc:435] - v8::Context::Enter() [v8isolatedworld.cpp:63] - WebCore::V8IsolatedWorld::V8IsolatedWorld(WebCore::V8Proxy *,int) [v8proxy.cpp:286] - WebCore::V8Proxy::evaluateInIsolatedWorld(int,WTF::Vector const &,int) [webframe_impl.cc:644] - WebFrameImpl::executeScriptInIsolatedWorld(int,WebKit::WebScriptSource const *,unsigned int,int) [user_script_slave.cc:192] - UserScriptSlave::InjectScripts(WebKit::WebFrame *,UserScript::RunLocation) [render_view.cc:2232] - RenderView::didFinishDocumentLoad(WebKit::WebFrame *) [webframeloaderclient_impl.cc:312] - WebFrameLoaderClient::dispatchDidFinishDocumentLoad() [frameloader.cpp:1044] - WebCore::FrameLoader::finishedParsing() [frameloader.cpp:544] - WebCore::FrameLoader::stopLoading(WebCore::UnloadEventPolicy,WebCore::DatabasePolicy) [documentloader.cpp:276] - WebCore::DocumentLoader::stopLoading(WebCore::DatabasePolicy) [frameloader.cpp:2235] - WebCore::FrameLoader::stopAllLoaders(WebCore::DatabasePolicy) [frameloader.cpp:3069] - WebCore::FrameLoader::frameDetached() [htmlframeownerelement.cpp:45] - WebCore::HTMLFrameOwnerElement::willRemove() [containernode.cpp:282] - WebCore::ContainerNode::willRemove() [containernode.cpp:296] - WebCore::willRemoveChild [containernode.cpp:323] - WebCore::ContainerNode::removeChild(WebCore::Node *,int &) [containernode.cpp:192] - WebCore::ContainerNode::replaceChild(WTF::PassRefPtr,WebCore::Node *,int &,bool) [v8htmlelement.cpp:214] - WebCore::HTMLElementInternal::outerHTMLAttrSetter