WebKit Bugzilla
Attachment 349844 Details for
Bug 184307
: Custom elements in a reaction queue can lose its JS wrapper and become HTMLUnknownElement
Home
|
New
|
Browse
|
Search
|
[?]
|
Reports
|
Requests
|
Help
|
New Account
|
Log In
Remember
[x]
|
Forgot Password
Login:
[x]
[patch]
WIP
wip184307.patch (text/plain), 3.45 KB, created by
Ryosuke Niwa
on 2018-09-14 18:47:58 PDT
(
hide
)
Description:
WIP
Filename:
MIME Type:
Creator:
Ryosuke Niwa
Created:
2018-09-14 18:47:58 PDT
Size:
3.45 KB
patch
obsolete
>Index: Source/WebCore/bindings/js/JSDOMWindowCustom.cpp >=================================================================== >--- Source/WebCore/bindings/js/JSDOMWindowCustom.cpp (revision 236001) >+++ Source/WebCore/bindings/js/JSDOMWindowCustom.cpp (working copy) >@@ -75,6 +75,8 @@ > // even though DOMWindow is an EventTarget, JSDOMWindow does not subclass JSEventTarget, so we need > // to do this here. > wrapped().visitJSEventListeners(visitor); >+ >+ CustomElementReactionQueue::visitEnqueuedElements(visitor); > } > > #if ENABLE(USER_MESSAGE_HANDLERS) >Index: Source/WebCore/dom/CustomElementReactionQueue.cpp >=================================================================== >--- Source/WebCore/dom/CustomElementReactionQueue.cpp (revision 236001) >+++ Source/WebCore/dom/CustomElementReactionQueue.cpp (working copy) >@@ -33,14 +33,18 @@ > #include "HTMLNames.h" > #include "JSCustomElementInterface.h" > #include "JSDOMBinding.h" >+#include "JSElement.h" > #include "Microtasks.h" > #include <JavaScriptCore/CatchScope.h> > #include <JavaScriptCore/Heap.h> >+#include <JavaScriptCore/SlotVisitor.h> > #include <wtf/NeverDestroyed.h> > #include <wtf/Optional.h> > #include <wtf/Ref.h> > #include <wtf/SetForScope.h> > >+#include "Logging.h" >+ > namespace WebCore { > > class CustomElementReactionQueueItem { >@@ -234,15 +238,16 @@ > { > RELEASE_ASSERT(!m_invoking); > SetForScope<bool> invoking(m_invoking, true); >- Vector<Ref<Element>> elements; >- elements.swap(m_elements); >- RELEASE_ASSERT(m_elements.isEmpty()); >- for (auto& element : elements) { >+// Vector<Ref<Element>> elements; >+// elements.swap(m_elements); >+// RELEASE_ASSERT(m_elements.isEmpty()); >+ size_t count = m_elements.size(); >+ for (auto& element : m_elements) { > auto* queue = element->reactionQueue(); > ASSERT(queue); > queue->invokeAll(element.get()); > } >- RELEASE_ASSERT(m_elements.isEmpty()); >+ RELEASE_ASSERT(m_elements.size() == count); > } > > inline void CustomElementReactionQueue::ElementQueue::processQueue(JSC::ExecState* state) >@@ -334,4 +339,18 @@ > return queue.get(); > } > >+void CustomElementReactionQueue::visitEnqueuedElements(JSC::SlotVisitor& visitor) >+{ >+ for (auto* currentStack = CustomElementReactionStack::s_currentProcessingStack; currentStack; currentStack = currentStack->m_previousProcessingStack) { >+ if (auto* queue = currentStack->m_queue) { >+ for (auto& element : queue->elements()) >+ visitor.addOpaqueRoot(root(element.get())); >+ } >+ } >+ if (s_processingBackupElementQueue) { >+ for (auto& element : backupElementQueue().elements()) >+ visitor.addOpaqueRoot(root(element.get())); >+ } > } >+ >+} >Index: Source/WebCore/dom/CustomElementReactionQueue.h >=================================================================== >--- Source/WebCore/dom/CustomElementReactionQueue.h (revision 236001) >+++ Source/WebCore/dom/CustomElementReactionQueue.h (working copy) >@@ -32,6 +32,7 @@ > namespace JSC { > > class ExecState; >+class SlotVisitor; > > } > >@@ -68,6 +69,8 @@ > void add(Element&); > void processQueue(JSC::ExecState*); > >+ const Vector<Ref<Element>>& elements() { return m_elements; } >+ > private: > void invokeAll(); > >@@ -75,6 +78,8 @@ > bool m_invoking { false }; > }; > >+ static void visitEnqueuedElements(JSC::SlotVisitor&); >+ > private: > static CustomElementReactionQueue& ensureCurrentQueue(Element&); > static ElementQueue& ensureBackupQueue();
You cannot view the attachment while viewing its details because your browser does not support IFRAMEs.
View the attachment on a separate page
.
View Attachment As Diff
View Attachment As Raw
Actions:
View
|
Formatted Diff
|
Diff
Attachments on
bug 184307
:
337178
|
345910
|
349736
|
349740
|
349844
|
350093
|
350146
|
350157
|
350178