Summary: | v8 DOMWrapperWorld needs virtual dtor | ||||||||
---|---|---|---|---|---|---|---|---|---|
Product: | WebKit | Reporter: | James Robinson <jamesr> | ||||||
Component: | New Bugs | Assignee: | Nobody <webkit-unassigned> | ||||||
Status: | RESOLVED FIXED | ||||||||
Severity: | Normal | ||||||||
Priority: | P2 | ||||||||
Version: | 528+ (Nightly build) | ||||||||
Hardware: | Other | ||||||||
OS: | OS X 10.5 | ||||||||
Attachments: |
|
Description
James Robinson
2010-03-12 16:47:58 PST
Created attachment 50641 [details]
Patch
Comment on attachment 50641 [details]
Patch
Nice find!
+ RefCounted<DOMWrapperWorld
should be
+ RefCounted<DOMWrapperWorld>
Also, we usually wrap ChangeLogs at 80 chars.
Without this patch the following happens: V8Proxy::resetIsolatedWorlds() is calling the destructor of each V8IsolatedContext, which each have a RefPtr<IsolatedWorld> member variable. Since IsolatedWorld inherits from DOMWrapperWorld, which is declared as RefCounted<DOMWrapperWorld>, the deref() call is doing delete static_cast<DOMWrapperWorld*>(m_ptr). Since DOMWrapperWorld has no members and does not have a virtual destructor, it just does a free(). This means the IsolatedWorld's member variable, a DOMDataStoreHandle, is never destroyed and so the associated DOMDataStore is leaked and stays in the DOMDataStoreList. Created attachment 50642 [details]
Patch
Comment on attachment 50642 [details]
Patch
ok
Comment on attachment 50642 [details] Patch Clearing flags on attachment: 50642 Committed r55945: <http://trac.webkit.org/changeset/55945> All reviewed patches have been landed. Closing bug. |