Bug 127072 – Don't autorelease wrapper object (WebProcessPlugInScriptWorld) for InjectedBundleScriptWorld::normalWorld().

• Status: RESOLVED
• Resolution: FIXED
• Component: WebKit2

[Yongjun Zhang]

InjectedBundleScriptWorld::normalWorld() returns a static InjectedBundleScriptWorld,  autoreleasing its wrapper object could cause dangling pointer to InjectedBundleScriptWorld and crash.

[Yongjun Zhang]

This is referring to the method [WKWebProcessPlugInScriptWorld normalWorld]:

+ (WKWebProcessPlugInScriptWorld *)normalWorld
{
    return [wrapper(*InjectedBundleScriptWorld::normalWorld()) autorelease];
}

[Yongjun Zhang]

Created attachment 221313 [details]
Patch.

[Geoffrey Garen]

Comment on attachment 221313 [details]
Patch.

What about all the other uses of the "[wrapper(X) autorelease]" idiom, like the "world" selector in the same file, and a bunch of others?

[Geoffrey Garen]

(In reply to comment #3)
> (From update of attachment 221313 [details])
> What about all the other uses of the "[wrapper(X) autorelease]" idiom, like the "world" selector in the same file, and a bunch of others?

I see. In all other cases, we only autorelease after allocating or ref-ing.

[Geoffrey Garen]

Comment on attachment 221313 [details]
Patch.

r=me

Sadly, I am not a WK2 owner :(.

r=me too

[WebKit Commit Bot]

Comment on attachment 221313 [details]
Patch.

Clearing flags on attachment: 221313

Committed r162106: <http://trac.webkit.org/changeset/162106>

[WebKit Commit Bot]

All reviewed patches have been landed.  Closing bug.