Bug 45704
| Summary: | Potential leak in JSSVGDynamicPODTypeWrapper | ||
|---|---|---|---|
| Product: | WebKit | Reporter: | Alexey Proskuryakov <ap> |
| Component: | SVG | Assignee: | Nobody <webkit-unassigned> |
| Status: | RESOLVED CONFIGURATION CHANGED | ||
| Severity: | Normal | CC: | ahmad.saleem792, ggaren, zimmermann |
| Priority: | P2 | ||
| Version: | 528+ (Nightly build) | ||
| Hardware: | All | ||
| OS: | All | ||
Alexey Proskuryakov
JSSVGDynamicPODTypeWrapper inherits from RefCounted (via JSSVGPODTypeWrapper), but RefCounted will not call its virtual destructor. So, data members of JSSVGDynamicPODTypeWrapper will not be destructed in the normal course of RefCounted lifetime.
I think the original issue is that JSSVGPODTypeWrapper should not have inherited from RefCounted, and then someone fell into the trap of actually doing meaningful work in the destructor.
| Attachments | ||
|---|---|---|
| Add attachment proposed patch, testcase, etc. |
Ahmad Saleem
@Alexey - Is this applicable anymore? I couldn't find any references to this in our code base?
It seems this commit removed it - https://github.com/WebKit/WebKit/commit/4d739154052f4dda48b5cd06e09c0d896955c568