Bug 31681 - [Qt] Wrong runtime instance objects of wrapped QObjects may be used if the wrapped object died before the gc removed the instance.
Summary: [Qt] Wrong runtime instance objects of wrapped QObjects may be used if the w...
Status: RESOLVED FIXED
Alias: None
Product: WebKit
Classification: Unclassified
Component: WebKit Qt (show other bugs)
Version: 420+
Hardware: PC Windows XP
: P2 Major
Assignee: Simon Hausmann
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2009-11-19 13:30 PST by Yoann Lopes
Modified: 2009-11-23 04:58 PST (History)
4 users (show)

See Also:


Attachments
Bug example (6.00 KB, application/x-tar)
2009-11-19 13:30 PST, Yoann Lopes
no flags Details
Potential fix, without changelog and testcase. (1.03 KB, patch)
2009-11-22 09:30 PST, Simon Hausmann
no flags Details | Formatted Diff | Diff
Patch (4.88 KB, patch)
2009-11-23 04:27 PST, Simon Hausmann
no flags Details | Formatted Diff | Diff

Note You need to log in before you can comment on or make changes to this bug.
Description Yoann Lopes 2009-11-19 13:30:40 PST
Created attachment 43519 [details]
Bug example

A bug occurs when a new Object is made available to javascript (addToJavascriptWindowObject) and when this new object is at the same address in memory than a previously deleted object (which one was also made available to javascript at some point).

In that case, a javascript exception is raised saying that you are trying to access a deleted object, when actually the object that you are trying to access is not deleted. (It just raises that exception because the new object occupies a memory address that has been previously marked as deleted).

Bug spotted using Qt 4.5.1

I attach to this report a small example illustrating the bug.
Comment 1 Simon Hausmann 2009-11-22 09:27:21 PST
ACK. This may be fixable inside QtInstance::getQtInstance
Comment 2 Simon Hausmann 2009-11-22 09:30:22 PST
Created attachment 43682 [details]
Potential fix, without changelog and testcase.

Yoann, can you try the attached patch?

It shouldn't be too hard to turn your testcase into a unit test. Want to have a go at it? :)
Comment 3 Kenneth Rohde Christiansen 2009-11-22 11:21:23 PST
I guess it would be nice with some comments in the code as well.
Comment 4 Simon Hausmann 2009-11-23 04:27:22 PST
Created attachment 43702 [details]
Patch
Comment 5 Yoann Lopes 2009-11-23 04:37:54 PST
Just tried the patch, it works just fine now :)
Comment 6 WebKit Commit Bot 2009-11-23 04:58:39 PST
Comment on attachment 43702 [details]
Patch

Clearing flags on attachment: 43702

Committed r51306: <http://trac.webkit.org/changeset/51306>
Comment 7 WebKit Commit Bot 2009-11-23 04:58:45 PST
All reviewed patches have been landed.  Closing bug.