Chromium Code Reviews
DescriptionRemove second-weak callbacks from V8AbstractEventListener
Second-weak callbacks are unsafe with Oilpan because the following scenario can happen:
1) V8 calls the first-weak callback for a wrapper X.
2) V8 drops X from a list scanned by PersistentWrapperVisitor.
3) Oilpan triggers a GC. It traces all wrappers with PersistentWrapperVisitor. X is not traced. X's corresponding DOM object gets collected.
4) V8 calls the second-weak callback for X. It crashes.
BUG=602276
Committed: https://crrev.com/f0cabf25d6d285c0f26a532681ce5070038fd356
Cr-Commit-Position: refs/heads/master@{#386587}
Patch Set 1 #
Messages
Total messages: 14 (6 generated)
|
||||||||||||||||||||||||||||