Created attachment 179282 [details] Fix for NPV8Object regression For details, see crbug.com/165307. I've identified this WebKit patch as the issue: http://trac.webkit.org/changeset?format=diff&new=135804&old=135803&new_path=%2Ftrunk&old_path=%2Ftrunk In particular, in the "iter != v8NPObjectMap->end()" case, if the 'for' loop terminates without returning, then objectVector will not be set, and the created NPObject pointer will not be saved and the newly created NPObject will not be saved for future reuse. I also notice that v8NPObjectMap is keyed off Object::GetIdentityHash(), but the V8 Object documentation explicitly states that identity hashes are not unique: http://code.google.com/p/v8/source/browse/trunk/include/v8.h#1702 So I believe this code: if (v8npObject->rootObject == root) { ASSERT(v8npObject->v8Object == object); should also be changed to: if (v8npObject->v8Object == object && v8npObject->rootObject == root) { See attached patch.
Created attachment 179782 [details] Patch
haraken@ or japhet@ - can you r? cq? Thanks!
Comment on attachment 179782 [details] Patch View in context: https://bugs.webkit.org/attachment.cgi?id=179782&action=review > Source/WebCore/ChangeLog:17 > + No tests. Testing requires a custom plugin to compare NPObject* for FWIW, I've manually tested that this fix works for Chromium with the GWT Developer Mode plugin. However, I don't know how to build a custom NPAPI plugin just for the WebKit LayoutTests. If someone can give me clear instructions on how to do that, I'm happy to try that.
Created attachment 179807 [details] Patch
Comment on attachment 179807 [details] Patch Attachment 179807 [details] did not pass chromium-ews (chromium-xvfb): Output: http://queues.webkit.org/results/15364940 New failing tests: plugins/npruntime/embed-property-equality.html
Sorry, I'm still working on fixing the patch. There's a whitespace issue that caused it to fail, but more egregiously, it doesn't actually test the bug here since it passes even without my fix. I'm currently working on a new patch to add another method to TestNetscapePlugIn that will let me actually exercise the bug.
Comment on attachment 179807 [details] Patch View in context: https://bugs.webkit.org/attachment.cgi?id=179807&action=review The change looks reasonable to me. I'll r+ it once you fixed the test result. > LayoutTests/ChangeLog:11 > + * plugins/npruntime/embed-property-equality.html: Test two plugin instances. You need to update the test result. You can update the test result by: $ ./webkit/tools/layout_tests/run_webkit_tests.py --reset-results --debug plugins/npruntime/embed-property-equality.html (--debug is not needed if you're building in the Release mode.)
Created attachment 179826 [details] Patch
Comment on attachment 179826 [details] Patch Looks OK
Created attachment 179827 [details] Patch
Comment on attachment 179827 [details] Patch View in context: https://bugs.webkit.org/attachment.cgi?id=179827&action=review > LayoutTests/plugins/npruntime/embed-property-iframe-equality.html:4 > +<iframe srcdoc="<script>parent.plugin.remember(parent.document)</script>"></iframe> Sorry, made one minor fix to here. Only need one argument for remember(), not two.
Comment on attachment 179827 [details] Patch Clearing flags on attachment: 179827 Committed r137964: <http://trac.webkit.org/changeset/137964>
All reviewed patches have been landed. Closing bug.
(In reply to comment #12) > (From update of attachment 179827 [details]) > Clearing flags on attachment: 179827 > > Committed r137964: <http://trac.webkit.org/changeset/137964> The new test fails on WK2 platforms - see https://bugs.webkit.org/show_bug.cgi?id=105266 for details.
What's the proper process to request this patch be considered for merging into branches/chromium/1312 and branches/chromium/1359? The regression was introduced in r135804, which was merged into branches/chromium/1312 as r136064, and was also included in the base version for branches/chromium/1359 (which branched from r137490).
(In reply to comment #15) > What's the proper process to request this patch be considered for merging into branches/chromium/1312 and branches/chromium/1359? The regression was introduced in r135804, which was merged into branches/chromium/1312 as r136064, and was also included in the base version for branches/chromium/1359 (which branched from r137490). Sent you a private email.
FYI, I've filed https://bugs.webkit.org/show_bug.cgi?id=105495 with more variations on this issue. I've already written LayoutTests to demonstrate the bugs, but I don't have fixes for them yet.