Bug 31873 – [V8] Avoid using JavaScript objects as context data

• Status: RESOLVED
• Resolution: FIXED
• Component: WebCore Misc.

[Søren Gjesse]

The V8 API provides the ability to associate a context with a "data" object. If a context dependent object is used this ha the side effect of keeping the context alive for some time after the page using the context has been closed.

To avoid this the context "data" object should be a string which is not context dependent. In the V8 API the type will be changed from Object to String in the near future.

See http://crbug.com/23058.

[Søren Gjesse]

Created attachment 43847 [details]
Use string instead if JavaScript object for context "data"

[Søren Gjesse]

This should not be committed before http://codereview.chromium.org/443002 has been committed in Chromium.

[Pavel Feldman]

Comment on attachment 43847 [details]
Use string instead if JavaScript object for context "data"

> -const char* V8Proxy::kContextDebugDataType = "type";
> -const char* V8Proxy::kContextDebugDataValue = "value";

Remove these from .h as well? Otherwise r+.

[Yury Semikhatsky]

Looks good to me.

(In reply to comment #1)
> Created an attachment (id=43847) [details]
> Use string instead if JavaScript object for context "data"

[Søren Gjesse]

Created attachment 43900 [details]
Updated patch

Removed unused members from V8Proxy.h

[Søren Gjesse]

(In reply to comment #3)
> (From update of attachment 43847 [details])
> > -const char* V8Proxy::kContextDebugDataType = "type";
> > -const char* V8Proxy::kContextDebugDataValue = "value";
> 
> Remove these from .h as well? Otherwise r+.

Done.

[WebKit Commit Bot]

Comment on attachment 43900 [details]
Updated patch

Clearing flags on attachment: 43900

Committed r51407: <http://trac.webkit.org/changeset/51407>

[WebKit Commit Bot]

All reviewed patches have been landed.  Closing bug.

[Dimitri Glazkov (Google)]

This change has a flaw in logic. It removes the ability to set debug context id for a newly created context. The early return:

if (debugId == -1)
   return false;

causes V8Proxy::setInjectedScriptContext to always return false for newly created worlds with id > 0.

I'll fix.