Bug 45309 – ActiveDOMObjects::hasPendingActivity doesn't prevent element wrapper collection

• Status: NEW
• Component: WebCore JavaScript

[Eric Carlson]

Created attachment 66738 [details]
test case (may crash)

Even with the changes for https://bugs.webkit.org/show_bug.cgi?id=45306, the attached test case asserts in JSEventListener::jsFunction when a media element tries to fire an event after the js wrapper has been collected. Those changes should prevent this because they make HTMLMediaElement inherit from ActiveDOMObject and 1) return true from hasPendingActivity when events are in the queue, and 2) flush pending events in suspend/stop. 

It doesn't prevent the object from being collected because when markActiveObjectsForContext sees that a media element has pending activity it calls markDOMObjectWrapper, but the media element has a DOMNodeWrapper so the mark never happens and the element is collected.

[Alexey Proskuryakov]

We're hitting this for media elements and with marquee.

[Alexey Proskuryakov]

<rdar://problem/8931194> ActiveDOMObjects::hasPendingActivity doesn't prevent element wrapper collection

[Geoffrey Garen]

I believe that all we need to do to fix this bug is to mark these elements with the ActiveDOMObject IDL attribute.

[Alexey Proskuryakov]

This test doesn't ASSERT in ToT, although there is no ActiveDOMObject IDL attribute on the elements. I'm not sure if this is just because of some unrelated behavior change that renders the test ineffective, or the problem is somehow fully fixed.

[Adam Barth]

This will likely be fixed when I fix bug 101428.  It might actually be fixed on trunk currently given that we're using the ActiveDOMObject owner for HTMLMediaElement rather than the Node owner.