Attachment 369138 Details for Bug 197617 – Patch

[patch] Patch

bug-197617-20190506105815.patch (text/plain), 5.41 KB, created by Chris Dumez on 2019-05-06 10:58:15 PDT

(hide)

Description:

Filename:

MIME Type:

Creator: Chris Dumez

Created: 2019-05-06 10:58:15 PDT

Size: 5.41 KB

patch

obsolete

>Subversion Revision: 244961
>diff --git a/Source/WebCore/ChangeLog b/Source/WebCore/ChangeLog
>index c6c1f7679f545d94a40166b2a4b7d364ff85b7b1..61123b58e4e102f121c0989de27cc5b4a687372c 100644
>--- a/Source/WebCore/ChangeLog
>+++ b/Source/WebCore/ChangeLog
>@@ -1,3 +1,22 @@
>+2019-05-06  Chris Dumez  <cdumez@apple.com>
>+
>+        Add assertions to JSLazyEventListener to help catch the cause of a crash
>+        https://bugs.webkit.org/show_bug.cgi?id=197617
>+
>+        Reviewed by NOBODY (OOPS!).
>+
>+        Add assertions to JSLazyEventListener to help catch the cause of <rdar://problem/24314027>.
>+
>+        * bindings/js/JSLazyEventListener.cpp:
>+        (WebCore::JSLazyEventListener::checkValidityForEventTarget):
>+        * bindings/js/JSLazyEventListener.h:
>+        * dom/EventListener.h:
>+        (WebCore::EventListener::checkValidityForEventTarget):
>+        * dom/EventTarget.cpp:
>+        (WebCore::EventTarget::addEventListener):
>+        (WebCore::EventTarget::setAttributeEventListener):
>+        (WebCore::EventTarget::innerInvokeEventListeners):
>+
> 2019-05-06  Zan Dobersek  <zdobersek@igalia.com>
> 
>         [GLib] WebCore::MainThreadSharedTimer should use the appropriate GSource priority, name
>diff --git a/Source/WebCore/bindings/js/JSLazyEventListener.cpp b/Source/WebCore/bindings/js/JSLazyEventListener.cpp
>index 8ca1336eff3bf76be3c3dd3351e4b385be831440..bfe62c4583ee57d08ac6bddf217df716802cbe9e 100644
>--- a/Source/WebCore/bindings/js/JSLazyEventListener.cpp
>+++ b/Source/WebCore/bindings/js/JSLazyEventListener.cpp
>@@ -79,6 +79,18 @@ JSLazyEventListener::JSLazyEventListener(CreationArguments&& arguments, const St
> #endif
> }
> 
>+#if !ASSERT_DISABLED
>+// This is to help find the underlying cause of <rdar://problem/24314027>.
>+void JSLazyEventListener::checkValidityForEventTarget(EventTarget& eventTarget)
>+{
>+    if (eventTarget.isNode()) {
>+        ASSERT(m_originalNode);
>+        ASSERT(static_cast<EventTarget*>(m_originalNode.get()) == &eventTarget);
>+    } else
>+        ASSERT(!m_originalNode);
>+}
>+#endif
>+
> JSLazyEventListener::~JSLazyEventListener()
> {
> #ifndef NDEBUG
>diff --git a/Source/WebCore/bindings/js/JSLazyEventListener.h b/Source/WebCore/bindings/js/JSLazyEventListener.h
>index 552d0779305eff0150e0881c0b2ab769ad015b71..2d4c068b0b1472d34900cc4095eb9c22d9a2a92b 100644
>--- a/Source/WebCore/bindings/js/JSLazyEventListener.h
>+++ b/Source/WebCore/bindings/js/JSLazyEventListener.h
>@@ -46,6 +46,10 @@ private:
>     static RefPtr<JSLazyEventListener> create(CreationArguments&&);
>     JSLazyEventListener(CreationArguments&&, const String& sourceURL, const TextPosition&);
> 
>+#if !ASSERT_DISABLED
>+    void checkValidityForEventTarget(EventTarget&) final;
>+#endif
>+
>     JSC::JSObject* initializeJSFunction(ScriptExecutionContext&) const final;
>     bool wasCreatedFromMarkup() const final { return true; }
> 
>diff --git a/Source/WebCore/dom/EventListener.h b/Source/WebCore/dom/EventListener.h
>index c36136f3b626cdb2629ad7a7f2292134267f2d30..f8e22708cc8c2982cb4944c551b3d2d8391e3b1a 100644
>--- a/Source/WebCore/dom/EventListener.h
>+++ b/Source/WebCore/dom/EventListener.h
>@@ -31,6 +31,7 @@ namespace WebCore {
> 
> class ScriptExecutionContext;
> class Event;
>+class EventTarget;
> 
> class EventListener : public RefCounted<EventListener> {
> public:
>@@ -55,6 +56,10 @@ public:
>     virtual bool isAttribute() const { return false; }
>     Type type() const { return m_type; }
> 
>+#if !ASSERT_DISABLED
>+    virtual void checkValidityForEventTarget(EventTarget&) { }
>+#endif
>+
> protected:
>     explicit EventListener(Type type)
>         : m_type(type)
>diff --git a/Source/WebCore/dom/EventTarget.cpp b/Source/WebCore/dom/EventTarget.cpp
>index 6ddde4d7dfdd87c81c634e49acd2557a94f3e405..b89394bae9adaad485cb30582d432410020f30fa 100644
>--- a/Source/WebCore/dom/EventTarget.cpp
>+++ b/Source/WebCore/dom/EventTarget.cpp
>@@ -38,6 +38,7 @@
> #include "HTMLHtmlElement.h"
> #include "InspectorInstrumentation.h"
> #include "JSEventListener.h"
>+#include "JSLazyEventListener.h"
> #include "RuntimeEnabledFeatures.h"
> #include "ScriptController.h"
> #include "ScriptDisallowedScope.h"
>@@ -69,6 +70,10 @@ bool EventTarget::isPaymentRequest() const
> 
> bool EventTarget::addEventListener(const AtomicString& eventType, Ref<EventListener>&& listener, const AddEventListenerOptions& options)
> {
>+#if !ASSERT_DISABLED
>+    listener->checkValidityForEventTarget(*this);
>+#endif
>+
>     auto passive = options.passive;
> 
>     if (!passive.hasValue() && eventNames().isTouchScrollBlockingEventType(eventType)) {
>@@ -145,6 +150,10 @@ bool EventTarget::setAttributeEventListener(const AtomicString& eventType, RefPt
>     if (existingListener) {
>         InspectorInstrumentation::willRemoveEventListener(*this, eventType, *existingListener, false);
> 
>+#if !ASSERT_DISABLED
>+        listener->checkValidityForEventTarget(*this);
>+#endif
>+
>         auto listenerPointer = listener.copyRef();
>         eventTargetData()->eventListenerMap.replace(eventType, *existingListener, listener.releaseNonNull(), { });
> 
>@@ -301,6 +310,10 @@ void EventTarget::innerInvokeEventListeners(Event& event, EventListenerVector li
>         if (registeredListener->isPassive())
>             event.setInPassiveListener(true);
> 
>+#if !ASSERT_DISABLED
>+        registeredListener->callback().checkValidityForEventTarget(*this);
>+#endif
>+
>         InspectorInstrumentation::willHandleEvent(context, event, *registeredListener);
>         registeredListener->callback().handleEvent(context, event);
>         InspectorInstrumentation::didHandleEvent(context);

Actions: View | Formatted Diff | Diff

Attachments on bug 197617: 369138 | 369184