|Summary:||v8 DOMWrapperWorld needs virtual dtor|
|Product:||WebKit||Reporter:||James Robinson <jamesr>|
|Component:||New Bugs||Assignee:||Nobody <webkit-unassigned>|
|Version:||528+ (Nightly build)|
|OS:||OS X 10.5|
Description James Robinson 2010-03-12 16:47:58 PST
v8 DOMWrapperWorld needs virtual dtor
Comment 2 Adam Barth 2010-03-12 16:52:54 PST
Comment on attachment 50641 [details] Patch Nice find! + RefCounted<DOMWrapperWorld should be + RefCounted<DOMWrapperWorld> Also, we usually wrap ChangeLogs at 80 chars.
Comment 3 James Robinson 2010-03-12 16:54:53 PST
Without this patch the following happens: V8Proxy::resetIsolatedWorlds() is calling the destructor of each V8IsolatedContext, which each have a RefPtr<IsolatedWorld> member variable. Since IsolatedWorld inherits from DOMWrapperWorld, which is declared as RefCounted<DOMWrapperWorld>, the deref() call is doing delete static_cast<DOMWrapperWorld*>(m_ptr). Since DOMWrapperWorld has no members and does not have a virtual destructor, it just does a free(). This means the IsolatedWorld's member variable, a DOMDataStoreHandle, is never destroyed and so the associated DOMDataStore is leaked and stays in the DOMDataStoreList.
Comment 6 James Robinson 2010-03-12 17:03:03 PST
Comment on attachment 50642 [details] Patch Clearing flags on attachment: 50642 Committed r55945: <http://trac.webkit.org/changeset/55945>
Comment 7 James Robinson 2010-03-12 17:03:07 PST
All reviewed patches have been landed. Closing bug.