Chromium Code Reviews
chromiumcodereview-hr@appspot.gserviceaccount.com (chromiumcodereview-hr) | Please choose your nickname with Settings | Help | Chromium Project | Gerrit Changes | Sign out
(592)

Issue 1877153002: Remove second-weak callbacks from V8AbstractEventListener (Closed)

Created:
4 years, 8 months ago by haraken
Modified:
4 years, 8 months ago
CC:
blink-reviews, blink-reviews-bindings_chromium.org, chromium-reviews
Base URL:
https://chromium.googlesource.com/chromium/src.git@master
Target Ref:
refs/pending/heads/master
Project:
chromium
Visibility:
Public.

Description

Remove second-weak callbacks from V8AbstractEventListener Second-weak callbacks are unsafe with Oilpan because the following scenario can happen: 1) V8 calls the first-weak callback for a wrapper X. 2) V8 drops X from a list scanned by PersistentWrapperVisitor. 3) Oilpan triggers a GC. It traces all wrappers with PersistentWrapperVisitor. X is not traced. X's corresponding DOM object gets collected. 4) V8 calls the second-weak callback for X. It crashes. BUG=602276 Committed: https://crrev.com/f0cabf25d6d285c0f26a532681ce5070038fd356 Cr-Commit-Position: refs/heads/master@{#386587}

Patch Set 1 #

Unified diffs Side-by-side diffs Delta from patch set Stats (+5 lines, -16 lines) Patch
M third_party/WebKit/Source/bindings/core/v8/V8AbstractEventListener.h View 1 chunk +1 line, -2 lines 0 comments Download
M third_party/WebKit/Source/bindings/core/v8/V8AbstractEventListener.cpp View 2 chunks +4 lines, -14 lines 0 comments Download

Messages

Total messages: 14 (6 generated)
haraken
PTAL FYI, I've already removed all other second-weak callbacks for DOM objects -- it won't ...
4 years, 8 months ago (2016-04-12 00:06:53 UTC) #2
haraken
4 years, 8 months ago (2016-04-12 00:07:16 UTC) #4
jochen (gone - plz use gerrit)
lgtm
4 years, 8 months ago (2016-04-12 01:37:40 UTC) #5
commit-bot: I haz the power
CQ is trying da patch. Follow status at https://chromium-cq-status.appspot.com/patch-status/1877153002/1 View timeline at https://chromium-cq-status.appspot.com/patch-timeline/1877153002/1
4 years, 8 months ago (2016-04-12 01:39:17 UTC) #7
commit-bot: I haz the power
Try jobs failed on following builders: mac_chromium_rel_ng on tryserver.chromium.mac (JOB_FAILED, http://build.chromium.org/p/tryserver.chromium.mac/builders/mac_chromium_rel_ng/builds/209411)
4 years, 8 months ago (2016-04-12 02:59:13 UTC) #9
commit-bot: I haz the power
CQ is trying da patch. Follow status at https://chromium-cq-status.appspot.com/patch-status/1877153002/1 View timeline at https://chromium-cq-status.appspot.com/patch-timeline/1877153002/1
4 years, 8 months ago (2016-04-12 03:36:03 UTC) #11
commit-bot: I haz the power
Committed patchset #1 (id:1)
4 years, 8 months ago (2016-04-12 04:37:13 UTC) #12
commit-bot: I haz the power
4 years, 8 months ago (2016-04-12 04:38:22 UTC) #14
Message was sent while issue was closed.
Patchset 1 (id:??) landed as
https://crrev.com/f0cabf25d6d285c0f26a532681ce5070038fd356
Cr-Commit-Position: refs/heads/master@{#386587}

Powered by Google App Engine
This is Rietveld 408576698