WebKit Bugzilla
Attachment 349740 Details for
Bug 184307
: Custom elements in a reaction queue can lose its JS wrapper and become HTMLUnknownElement
Home
|
New
|
Browse
|
Search
|
[?]
|
Reports
|
Requests
|
Help
|
New Account
|
Log In
Remember
[x]
|
Forgot Password
Login:
[x]
[patch]
WIP logging
wip184307-logging.patch (text/plain), 4.77 KB, created by
Ryosuke Niwa
on 2018-09-13 23:49:38 PDT
(
hide
)
Description:
WIP logging
Filename:
MIME Type:
Creator:
Ryosuke Niwa
Created:
2018-09-13 23:49:38 PDT
Size:
4.77 KB
patch
obsolete
>Index: Source/WebCore/bindings/js/JSCustomElementInterface.cpp >=================================================================== >--- Source/WebCore/bindings/js/JSCustomElementInterface.cpp (revision 236001) >+++ Source/WebCore/bindings/js/JSCustomElementInterface.cpp (working copy) >@@ -220,6 +220,15 @@ > element.setIsDefinedCustomElement(*this); > } > >+HashMap<Element*, unsigned>& finalizedElements(); >+ >+bool hasSeenBug = false; >+HashMap<Element*, unsigned>& finalizedElements() >+{ >+ static NeverDestroyed<HashMap<Element*, unsigned>> map; >+ return map; >+} >+ > void JSCustomElementInterface::invokeCallback(Element& element, JSObject* callback, const WTF::Function<void(ExecState*, JSDOMGlobalObject*, MarkedArgumentBuffer&)>& addArguments) > { > if (!canInvokeCallback()) >@@ -238,6 +247,11 @@ > return; > ExecState* state = globalObject->globalExec(); > >+ auto* wrapper = element.wrapper(); >+ if (!wrapper && !hasSeenBug) { >+ hasSeenBug = true; >+ fprintf(stderr, "Found a wrapper-less node! finalized=%d\n", finalizedElements().contains(&element)); >+ } > JSObject* jsElement = asObject(toJS(state, globalObject, element)); > > CallData callData; >Index: Source/WebCore/bindings/js/JSDOMWindowCustom.cpp >=================================================================== >--- Source/WebCore/bindings/js/JSDOMWindowCustom.cpp (revision 236001) >+++ Source/WebCore/bindings/js/JSDOMWindowCustom.cpp (working copy) >@@ -70,11 +70,13 @@ > { > if (Frame* frame = wrapped().frame()) > visitor.addOpaqueRoot(frame); >- >+ > // Normally JSEventTargetCustom.cpp's JSEventTarget::visitAdditionalChildren() would call this. But > // even though DOMWindow is an EventTarget, JSDOMWindow does not subclass JSEventTarget, so we need > // to do this here. > wrapped().visitJSEventListeners(visitor); >+ >+ CustomElementReactionQueue::visitEnqueuedElements(visitor); > } > > #if ENABLE(USER_MESSAGE_HANDLERS) >Index: Source/WebCore/dom/ContainerNode.cpp >=================================================================== >--- Source/WebCore/dom/ContainerNode.cpp (revision 236001) >+++ Source/WebCore/dom/ContainerNode.cpp (working copy) >@@ -891,6 +891,8 @@ > return std::distance(children.begin(), children.end()); > } > >+extern bool hasSeenBug; >+ > ExceptionOr<void> ContainerNode::append(Vector<NodeOrString>&& vector) > { > auto result = convertNodesOrStringsIntoNode(WTFMove(vector)); >@@ -901,6 +903,8 @@ > if (!node) > return { }; > >+ hasSeenBug = false; >+ > return appendChild(*node); > } > >Index: Source/WebCore/dom/CustomElementReactionQueue.cpp >=================================================================== >--- Source/WebCore/dom/CustomElementReactionQueue.cpp (revision 236001) >+++ Source/WebCore/dom/CustomElementReactionQueue.cpp (working copy) >@@ -33,14 +33,18 @@ > #include "HTMLNames.h" > #include "JSCustomElementInterface.h" > #include "JSDOMBinding.h" >+#include "JSElement.h" > #include "Microtasks.h" > #include <JavaScriptCore/CatchScope.h> > #include <JavaScriptCore/Heap.h> >+#include <JavaScriptCore/SlotVisitor.h> > #include <wtf/NeverDestroyed.h> > #include <wtf/Optional.h> > #include <wtf/Ref.h> > #include <wtf/SetForScope.h> > >+#include "Logging.h" >+ > namespace WebCore { > > class CustomElementReactionQueueItem { >@@ -334,4 +338,23 @@ > return queue.get(); > } > >+void CustomElementReactionQueue::visitEnqueuedElements(JSC::SlotVisitor& visitor) >+{ >+ unsigned visited = 0; >+ for (auto* currentStack = CustomElementReactionStack::s_currentProcessingStack; currentStack; currentStack = currentStack->m_previousProcessingStack) { >+ if (auto* queue = currentStack->m_queue) { >+ for (auto& element : queue->elements()) { >+ visited++; >+ visitor.addOpaqueRoot(root(element.get())); >+ } >+ } >+ } >+ if (s_processingBackupElementQueue) { >+ for (auto& element : backupElementQueue().elements()) { >+ visitor.addOpaqueRoot(root(element.get())); >+ visited++; >+ } >+ } > } >+ >+} >Index: Source/WebCore/dom/CustomElementReactionQueue.h >=================================================================== >--- Source/WebCore/dom/CustomElementReactionQueue.h (revision 236001) >+++ Source/WebCore/dom/CustomElementReactionQueue.h (working copy) >@@ -32,6 +32,7 @@ > namespace JSC { > > class ExecState; >+class SlotVisitor; > > } > >@@ -68,6 +69,8 @@ > void add(Element&); > void processQueue(JSC::ExecState*); > >+ const Vector<Ref<Element>>& elements() { return m_elements; } >+ > private: > void invokeAll(); > >@@ -75,6 +78,8 @@ > bool m_invoking { false }; > }; > >+ static void visitEnqueuedElements(JSC::SlotVisitor&); >+ > private: > static CustomElementReactionQueue& ensureCurrentQueue(Element&); > static ElementQueue& ensureBackupQueue();
You cannot view the attachment while viewing its details because your browser does not support IFRAMEs.
View the attachment on a separate page
.
View Attachment As Diff
View Attachment As Raw
Actions:
View
|
Formatted Diff
|
Diff
Attachments on
bug 184307
:
337178
|
345910
|
349736
|
349740
|
349844
|
350093
|
350146
|
350157
|
350178