Bug 16289 – WebKit loses data stored on "reachable" binding objects during garbage collection

• Status: RESOLVED
• Resolution: FIXED
• Component: WebCore JavaScript

[Sjoerd Mulder]

When defining a function for for example namespace resolving it's handy to store this on the XML document Object. 

But webkit loses the function sometimes for strange reasons.

See testcase, it should just continue counting and counting, this does work in Firefox and Opera

[Sjoerd Mulder]

Created attachment 17701 [details]
Testcase

[Alexey Proskuryakov]

Confirmed with r28024. This can be reproduced reliably by forcing garbage collection.

[Alexey Proskuryakov]

Created attachment 17718 [details]
reduced test case

[Alexey Proskuryakov]

Not a regression from Safari 2.

[Sjoerd Mulder]

It also looses the 'documentElement' property

[David Kilzer (:ddkilzer)]

<rdar://problem/5633005>

[Alexey Proskuryakov]

*** Bug 17076 has been marked as a duplicate of this bug. ***

[Alexey Proskuryakov]

Acid3 itself has a larger and more advanced test case that will need to be verified when fixing this.

[Eric Seidel (no email)]

This example does:
- get a dom object (domObjectA)
- get a dom object reachable from that dom object, using dom methods (domObjectB)
- set custom data on domObjectB
- store domObjectA in a local variable
- force a GC
- access domObjectB through the dom methods off of domObjectA
- notice that domObjectB is a fresh binding object, thus has no custom data

When marking, we don't follow builtin dom methods and mark the related binding objects.

One fix would be to mark all DOM objects held in the DOM cache which have custom data set on them.  We would need some way to purge the DOM cache when the page it torn down (but we might do that already).

I wonder how we keep custom prototypes alive... maybe we walk the prototype chain of any object when marking.

[Maciej Stachowiak]

This issue isn't quite the same as Acid3 tests 26 and 27, but I have a fix that addresses both. (Acid3 doesn't rely on custom properties on the node).

[Maciej Stachowiak]

Created attachment 19543 [details]
patch v1

[Sam Weinig]

Comment on attachment 19543 [details]
patch v1

r=me.  Though you could use some braces for outer if-statements as is now our style.

90!!!

[David Kilzer (:ddkilzer)]

Landed in r30790.

<http://trac.webkit.org/changeset/30790>