Bug 198037 – [GLIB] Crash when instantiating a js object registered with jsc_context_register_class on window object cleared

• Status: RESOLVED
• Resolution: FIXED
• Component: JavaScriptCore

[Carlos Garcia Campos]

This happens because JSCClass is keeping a pointer to the JSCContext used when the class is registered, and the context can be destroyed before the class.

[Carlos Garcia Campos]

Created attachment 370249 [details]
Patch

[Michael Catanzaro]

Comment on attachment 370249 [details]
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=370249&action=review

> Source/JavaScriptCore/API/glib/JSCClass.cpp:346
> -            static_cast<GParamFlags>(WEBKIT_PARAM_READWRITE | G_PARAM_CONSTRUCT_ONLY)));
> +            static_cast<GParamFlags>(WEBKIT_PARAM_WRITABLE | G_PARAM_CONSTRUCT_ONLY)));

Nothing like a good API break to make a change exciting.

I think we can get away with this, though.

[Carlos Garcia Campos]

Committed r245514: <https://trac.webkit.org/changeset/245514>

[Radar WebKit Bug Importer]

<rdar://problem/50944708>

[Adrian Perez]

(In reply to Michael Catanzaro from comment #2)
> Comment on attachment 370249 [details]
> Patch
> 
> View in context:
> https://bugs.webkit.org/attachment.cgi?id=370249&action=review
> 
> > Source/JavaScriptCore/API/glib/JSCClass.cpp:346
> > -            static_cast<GParamFlags>(WEBKIT_PARAM_READWRITE | G_PARAM_CONSTRUCT_ONLY)));
> > +            static_cast<GParamFlags>(WEBKIT_PARAM_WRITABLE | G_PARAM_CONSTRUCT_ONLY)));
> 
> Nothing like a good API break to make a change exciting.
> 
> I think we can get away with this, though.

Well, if people were using the API that allows registering JS
classes in the wild, we would have had a bug report for this
much earlier. So not many people are using this *for now*, and
I also think this change won't bite anybody ;-]