Title: [110400] branches/chromium/1025
- Revision
- 110400
- Author
- [email protected]
- Date
- 2012-03-11 15:07:06 -0700 (Sun, 11 Mar 2012)
Log Message
Merge 108780 - [v8] when a named item on document goes out of scope, actually remove it
https://bugs.webkit.org/show_bug.cgi?id=79409
Reviewed by Adam Barth.
Source/WebCore:
The original change already included the code, but it led to some
problems, so it was reverted in http://trac.webkit.org/changeset/63845.
However, not removing the items leaks a considerable amount of memory,
so I'm adding the code back. The bug that led to the revert was that
the accessor was removed unconditionally. I'm now only removing it,
when the last item with that name is removed.
Test: fast/dom/HTMLDocument/named-item.html
* bindings/v8/V8DOMWindowShell.cpp:
(WebCore::V8DOMWindowShell::namedItemRemoved):
LayoutTests:
* fast/dom/HTMLDocument/named-item-expected.txt: Added.
* fast/dom/HTMLDocument/named-item.html: Added.
[email protected]
Review URL: https://chromiumcodereview.appspot.com/9667038
Modified Paths
Added Paths
Diff
Copied: branches/chromium/1025/LayoutTests/fast/dom/HTMLDocument/named-item-expected.txt (from rev 108780, trunk/LayoutTests/fast/dom/HTMLDocument/named-item-expected.txt) (0 => 110400)
--- branches/chromium/1025/LayoutTests/fast/dom/HTMLDocument/named-item-expected.txt (rev 0)
+++ branches/chromium/1025/LayoutTests/fast/dom/HTMLDocument/named-item-expected.txt 2012-03-11 22:07:06 UTC (rev 110400)
@@ -0,0 +1,3 @@
+Tests that the named item created for an image with an ID is correctly removed. The test passes, if you see a "PASS" message in the div below.
+
+PASS
Copied: branches/chromium/1025/LayoutTests/fast/dom/HTMLDocument/named-item.html (from rev 108780, trunk/LayoutTests/fast/dom/HTMLDocument/named-item.html) (0 => 110400)
--- branches/chromium/1025/LayoutTests/fast/dom/HTMLDocument/named-item.html (rev 0)
+++ branches/chromium/1025/LayoutTests/fast/dom/HTMLDocument/named-item.html 2012-03-11 22:07:06 UTC (rev 110400)
@@ -0,0 +1,28 @@
+<html>
+<head>
+<script>
+if (window.layoutTestController)
+ layoutTestController.dumpAsText();
+
+function test() {
+ var div = document.getElementById("testdiv");
+ var img = document.createElement("img");
+ img.id = "testimg";
+ div.appendChild(img);
+ div.innerHTML = "";
+ if ("testimg" in document)
+ div.innerText = "FAIL: named item was not removed";
+ else
+ div.innerText = "PASS";
+}
+</script>
+</head>
+<body _onload_="test()">
+<p>
+Tests that the named item created for an image with an ID is correctly removed.
+The test passes, if you see a "PASS" message in the div below.
+</p>
+<div id="testdiv"></div>
+</body>
+</html>
+
Modified: branches/chromium/1025/Source/WebCore/bindings/v8/V8DOMWindowShell.cpp (110399 => 110400)
--- branches/chromium/1025/Source/WebCore/bindings/v8/V8DOMWindowShell.cpp 2012-03-11 20:12:56 UTC (rev 110399)
+++ branches/chromium/1025/Source/WebCore/bindings/v8/V8DOMWindowShell.cpp 2012-03-11 22:07:06 UTC (rev 110400)
@@ -577,6 +577,18 @@
void V8DOMWindowShell::namedItemRemoved(HTMLDocument* doc, const AtomicString& name)
{
+ if (doc->hasNamedItem(name.impl()) || doc->hasExtraNamedItem(name.impl()))
+ return;
+
+ if (!initContextIfNeeded())
+ return;
+
+ v8::HandleScope handleScope;
+ v8::Context::Scope contextScope(m_context);
+
+ ASSERT(!m_document.IsEmpty());
+ checkDocumentWrapper(m_document, doc);
+ m_document->Delete(v8String(name));
}
void V8DOMWindowShell::updateSecurityOrigin()
_______________________________________________
webkit-changes mailing list
[email protected]
http://lists.webkit.org/mailman/listinfo.cgi/webkit-changes
