Bug 21213 – MessagePort crash when GC collects an object with a pending close event

• Status: RESOLVED
• Resolution: FIXED
• Component: WebCore Misc.

[Alexey Proskuryakov]

CloseMessagePortTimer retains MessagePort, but not its wrapper. As a result, event listeners can be garbage collected, and the close event will be dispatched using a stale listener object pointer.

Patch forthcoming.

[Alexey Proskuryakov]

Created attachment 23908 [details]
proposed fix

It seems really ugly to control JS garbage collection from DOM code (if anything, this will fail when we enable non-JS bindings for MessageChannel/MessagePort), but looks like we don't have another mechanism.

[Darin Adler]

(In reply to comment #1)
> It seems really ugly to control JS garbage collection from DOM code (if
> anything, this will fail when we enable non-JS bindings for
> MessageChannel/MessagePort), but looks like we don't have another mechanism.

I think we need to come up with a general way to tell the bindings that an object is "active" and therefore should not be subject to garbage collection until it becomes inactive. On the other hand, that doesn't seem much different from an explicit call to gcProtect, except for being a bit more language-independent. It would be a bit more elegant to make a call to the bindings machinery on the DOM object and let the helper function do the "map to a wrapper and a gcProtect".

[Alexey Proskuryakov]

Comment on attachment 23908 [details]
proposed fix

Clearing review flag, going to investigate a better solution.

[Alexey Proskuryakov]

Created attachment 23937 [details]
updated patch

[Sam Weinig]

Comment on attachment 23937 [details]
updated patch

Nice.

[Alexey Proskuryakov]

Committed revision 37094.