Bug 30906 – [V8] Out-of-memory crash in isolated worlds

• Status: RESOLVED
• Resolution: FIXED
• Component: WebCore JavaScript

[Adam Barth]

----------------------------
*        Crash Trace       *
----------------------------
                     [api.cc:435] - v8::Context::Enter()
         [v8isolatedworld.cpp:63] - WebCore::V8IsolatedWorld::V8IsolatedWorld(WebCore::V8Proxy *,int)
                [v8proxy.cpp:286] - WebCore::V8Proxy::evaluateInIsolatedWorld(int,WTF::Vector const &,int)
           [webframe_impl.cc:644] - WebFrameImpl::executeScriptInIsolatedWorld(int,WebKit::WebScriptSource const *,unsigned int,int)
       [user_script_slave.cc:192] - UserScriptSlave::InjectScripts(WebKit::WebFrame *,UserScript::RunLocation)
            [render_view.cc:2232] - RenderView::didFinishDocumentLoad(WebKit::WebFrame *)
[webframeloaderclient_impl.cc:312] - WebFrameLoaderClient::dispatchDidFinishDocumentLoad()
           [frameloader.cpp:1044] - WebCore::FrameLoader::finishedParsing()
            [frameloader.cpp:544] - WebCore::FrameLoader::stopLoading(WebCore::UnloadEventPolicy,WebCore::DatabasePolicy)
         [documentloader.cpp:276] - WebCore::DocumentLoader::stopLoading(WebCore::DatabasePolicy)
           [frameloader.cpp:2235] - WebCore::FrameLoader::stopAllLoaders(WebCore::DatabasePolicy)
           [frameloader.cpp:3069] - WebCore::FrameLoader::frameDetached()
   [htmlframeownerelement.cpp:45] - WebCore::HTMLFrameOwnerElement::willRemove()
          [containernode.cpp:282] - WebCore::ContainerNode::willRemove()
          [containernode.cpp:296] - WebCore::willRemoveChild
          [containernode.cpp:323] - WebCore::ContainerNode::removeChild(WebCore::Node *,int &)
          [containernode.cpp:192] - WebCore::ContainerNode::replaceChild(WTF::PassRefPtr,WebCore::Node *,int &,bool)
          [v8htmlelement.cpp:214] - WebCore::HTMLElementInternal::outerHTMLAttrSetter

[Adam Barth]

Created attachment 42099 [details]
Patch v1

[Adam Barth]

Comment on attachment 42099 [details]
Patch v1

This patch leaks the isolated world object.

[Adam Barth]

Created attachment 42103 [details]
Patch v1

[Dimitri Glazkov (Google)]

Comment on attachment 42103 [details]
Patch v1

r=me.

[Adam Barth]

Comment on attachment 42103 [details]
Patch v1

Time to break the build!

[Eric Seidel (no email)]

Comment on attachment 42103 [details]
Patch v1

Can we make world a smart pointer (like OwnPtr) instead of using manual delete?

[Adam Barth]

(In reply to comment #6)
> (From update of attachment 42103 [details])
> Can we make world a smart pointer (like OwnPtr) instead of using manual delete?

The problem is that it's lifetime is managed by the V8 GC.  We manually delete it here because if we never create the context, we can't transfer ownership to V8.

[WebKit Commit Bot]

Comment on attachment 42103 [details]
Patch v1

Clearing flags on attachment: 42103

Committed r50296: <http://trac.webkit.org/changeset/50296>

[WebKit Commit Bot]

All reviewed patches have been landed.  Closing bug.

[Adam Barth]

Committed r50299: <http://trac.webkit.org/changeset/50299>

[Adam Barth]

http://trac.webkit.org/changeset/50319