Bug 56350 - Fix crash caused by Invalid call to destroyActiveDOMObject during stopActiveDOMObjects
Summary: Fix crash caused by Invalid call to destroyActiveDOMObject during stopActiveD...
Status: RESOLVED FIXED
Alias: None
Product: WebKit
Classification: Unclassified
Component: New Bugs (show other bugs)
Version: 528+ (Nightly build)
Hardware: Other OS X 10.5
: P2 Normal
Assignee: Nobody
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2011-03-14 18:16 PDT by David Grogan
Modified: 2011-03-15 15:17 PDT (History)
6 users (show)

See Also:


Attachments
Patch (10.89 KB, patch)
2011-03-14 18:19 PDT, David Grogan
no flags Details | Formatted Diff | Diff
Patch (10.93 KB, patch)
2011-03-14 18:28 PDT, David Grogan
no flags Details | Formatted Diff | Diff
Patch (11.62 KB, patch)
2011-03-15 11:02 PDT, David Grogan
no flags Details | Formatted Diff | Diff
Patch (11.52 KB, patch)
2011-03-15 14:10 PDT, David Grogan
no flags Details | Formatted Diff | Diff

Note You need to log in before you can comment on or make changes to this bug.
Description David Grogan 2011-03-14 18:16:41 PDT
Fix crash caused by Invalid call to destroyActiveDOMObject during stopActiveDOMObjects
Comment 1 David Grogan 2011-03-14 18:19:58 PDT
Created attachment 85750 [details]
Patch
Comment 2 David Grogan 2011-03-14 18:28:01 PDT
Created attachment 85752 [details]
Patch
Comment 3 WebKit Review Bot 2011-03-14 18:35:07 PDT
Attachment 85750 [details] did not build on chromium:
Build output: http://queues.webkit.org/results/8175439
Comment 4 David Grogan 2011-03-14 18:42:48 PDT
chrome bug and review:
http://crbug.com/75264
http://codereview.chromium.org/6677034/
Comment 5 David Grogan 2011-03-14 18:48:57 PDT
This fixes the crash but I'm not confident that memory isn't leaked and that I did the unregister thing right.
Comment 6 Jeremy Orlow 2011-03-14 19:27:52 PDT
Comment on attachment 85752 [details]
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=85752&action=review

close

> Source/WebCore/ChangeLog:7
> +

Please add some more detail and explain why it only affects multi-process.

> Source/WebCore/storage/IDBDatabase.h:118
> +    RefPtr<IDBDatabaseCallbacks> m_databaseCallbacks;

Save the impl here.

> Source/WebCore/storage/IDBDatabaseCallbacks.h:36
> +class IDBDatabase;

don't add

> Source/WebCore/storage/IDBDatabaseCallbacks.h:43
> +    virtual void unRegisterDatabase(IDBDatabase*) { ASSERT_NOT_REACHED(); };

don't add

> Source/WebCore/storage/IDBDatabaseCallbacksImpl.h:42
> +    virtual ~IDBDatabaseCallbacksImpl() { }

Don't inline.

> Source/WebCore/storage/IDBDatabaseCallbacksImpl.h:48
> +    IDBDatabaseCallbacksImpl(IDBDatabase*);

newline after

explain why this needs to be weak in comment?
Comment 7 David Grogan 2011-03-15 11:02:42 PDT
Created attachment 85827 [details]
Patch
Comment 8 David Grogan 2011-03-15 11:04:54 PDT
Comment on attachment 85752 [details]
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=85752&action=review

>> Source/WebCore/ChangeLog:7
>> +
> 
> Please add some more detail and explain why it only affects multi-process.

done

>> Source/WebCore/storage/IDBDatabase.h:118
>> +    RefPtr<IDBDatabaseCallbacks> m_databaseCallbacks;
> 
> Save the impl here.

done

>> Source/WebCore/storage/IDBDatabaseCallbacks.h:36
>> +class IDBDatabase;
> 
> don't add

done

>> Source/WebCore/storage/IDBDatabaseCallbacks.h:43
>> +    virtual void unRegisterDatabase(IDBDatabase*) { ASSERT_NOT_REACHED(); };
> 
> don't add

done

>> Source/WebCore/storage/IDBDatabaseCallbacksImpl.h:42
>> +    virtual ~IDBDatabaseCallbacksImpl() { }
> 
> Don't inline.

done

>> Source/WebCore/storage/IDBDatabaseCallbacksImpl.h:48
>> +    IDBDatabaseCallbacksImpl(IDBDatabase*);
> 
> newline after
> 
> explain why this needs to be weak in comment?

done
Comment 9 Jeremy Orlow 2011-03-15 12:32:27 PDT
Comment on attachment 85827 [details]
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=85827&action=review

r=me

> Source/WebCore/storage/IDBDatabaseCallbacksImpl.h:45
> +    void unRegisterDatabase(IDBDatabase*);

How do we camelCaseThis elsewhere?  I think usually unregister rather than unRegister?

> Source/WebCore/storage/IDBDatabaseCallbacksImpl.h:51
> +    // If a RefPtr were used here, there'd be a cycle and the ref counting

It seems like this could be more concise.
Comment 10 David Grogan 2011-03-15 14:10:00 PDT
Created attachment 85859 [details]
Patch
Comment 11 David Grogan 2011-03-15 14:10:30 PDT
Comment on attachment 85827 [details]
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=85827&action=review

>> Source/WebCore/storage/IDBDatabaseCallbacksImpl.h:45
>> +    void unRegisterDatabase(IDBDatabase*);
> 
> How do we camelCaseThis elsewhere?  I think usually unregister rather than unRegister?

You're right, changed.

>> Source/WebCore/storage/IDBDatabaseCallbacksImpl.h:51
>> +    // If a RefPtr were used here, there'd be a cycle and the ref counting
> 
> It seems like this could be more concise.

Shortened.
Comment 12 Jeremy Orlow 2011-03-15 14:22:31 PDT
Comment on attachment 85859 [details]
Patch

r=me
Comment 13 WebKit Commit Bot 2011-03-15 15:17:53 PDT
Comment on attachment 85859 [details]
Patch

Clearing flags on attachment: 85859

Committed r81181: <http://trac.webkit.org/changeset/81181>
Comment 14 WebKit Commit Bot 2011-03-15 15:17:59 PDT
All reviewed patches have been landed.  Closing bug.