Title: [125656] trunk
- Revision
- 125656
- Author
- [email protected]
- Date
- 2012-08-15 01:26:06 -0700 (Wed, 15 Aug 2012)
Log Message
[Chromium] fast/dom/Window/dom-access-from-closure-window.html is flaky on Linux
https://bugs.webkit.org/show_bug.cgi?id=94060
Reviewed by Kentaro Hara.
Source/WebCore:
Previously, the V8 garbage collector might have collected the Document
wrapper before the DOMWindow wrapper because we overwrite the
"document" property of the DOMWindow during navigation.
This patch adds a hidden document property on the global object to
ensure that the Document wrapper lives at least as long as the
DOMWindow wrapper, ensuring that DOMWindows that we obtain from V8
always have non-null Document objects.
The _javascript_Core bindings already have this behavior.
Test: fast/dom/Window/dom-access-from-closure-window-with-gc.html
* bindings/v8/V8DOMWindowShell.cpp:
(WebCore::V8DOMWindowShell::updateDocumentWrapperCache):
* bindings/v8/V8HiddenPropertyName.h:
(WebCore):
LayoutTests:
Ensure that collecting garbage doesn't change the behavior of this test
(compared with dom-access-from-closure-window.html).
* fast/dom/Window/dom-access-from-closure-window-with-gc-expected.txt: Added.
* fast/dom/Window/dom-access-from-closure-window-with-gc.html: Added.
Modified Paths
Added Paths
Diff
Modified: trunk/LayoutTests/ChangeLog (125655 => 125656)
--- trunk/LayoutTests/ChangeLog 2012-08-15 08:17:24 UTC (rev 125655)
+++ trunk/LayoutTests/ChangeLog 2012-08-15 08:26:06 UTC (rev 125656)
@@ -1,3 +1,16 @@
+2012-08-15 Adam Barth <[email protected]>
+
+ [Chromium] fast/dom/Window/dom-access-from-closure-window.html is flaky on Linux
+ https://bugs.webkit.org/show_bug.cgi?id=94060
+
+ Reviewed by Kentaro Hara.
+
+ Ensure that collecting garbage doesn't change the behavior of this test
+ (compared with dom-access-from-closure-window.html).
+
+ * fast/dom/Window/dom-access-from-closure-window-with-gc-expected.txt: Added.
+ * fast/dom/Window/dom-access-from-closure-window-with-gc.html: Added.
+
2012-08-15 Yuta Kitamura <[email protected]>
[Chromium] Unreviewed. Add one more flaky test to test expectations.
Added: trunk/LayoutTests/fast/dom/Window/dom-access-from-closure-window-with-gc-expected.txt (0 => 125656)
--- trunk/LayoutTests/fast/dom/Window/dom-access-from-closure-window-with-gc-expected.txt (rev 0)
+++ trunk/LayoutTests/fast/dom/Window/dom-access-from-closure-window-with-gc-expected.txt 2012-08-15 08:26:06 UTC (rev 125656)
@@ -0,0 +1,5 @@
+document.URL: LayoutTests/fast/dom/Window/resources/dom-access-from-closure-window-child.html
+window.document.URL: LayoutTests/fast/dom/Window/resources/notify-opener-done.html
+name: child
+window.name: child
+
Added: trunk/LayoutTests/fast/dom/Window/dom-access-from-closure-window-with-gc.html (0 => 125656)
--- trunk/LayoutTests/fast/dom/Window/dom-access-from-closure-window-with-gc.html (rev 0)
+++ trunk/LayoutTests/fast/dom/Window/dom-access-from-closure-window-with-gc.html 2012-08-15 08:26:06 UTC (rev 125656)
@@ -0,0 +1,27 @@
+<script src=""
+<script>
+ if (window.testRunner) {
+ testRunner.dumpAsText();
+ testRunner.setCanOpenWindows();
+ testRunner.setCloseRemainingWindowsWhenComplete();
+ testRunner.waitUntilDone();
+ }
+
+ var win = window.open("resources/dom-access-from-closure-window-child.html", "child");
+
+ function log(s)
+ {
+ document.getElementById('console').appendChild(document.createTextNode(s + "\n"));
+ }
+
+ function done()
+ {
+ gc();
+ // Call the method injected by resources/dom-access-from-closure-window-child.html
+ accessFrame();
+
+ if (window.testRunner)
+ testRunner.notifyDone();
+ }
+</script>
+<pre id="console"></pre>
Modified: trunk/Source/WebCore/ChangeLog (125655 => 125656)
--- trunk/Source/WebCore/ChangeLog 2012-08-15 08:17:24 UTC (rev 125655)
+++ trunk/Source/WebCore/ChangeLog 2012-08-15 08:26:06 UTC (rev 125656)
@@ -1,3 +1,28 @@
+2012-08-15 Adam Barth <[email protected]>
+
+ [Chromium] fast/dom/Window/dom-access-from-closure-window.html is flaky on Linux
+ https://bugs.webkit.org/show_bug.cgi?id=94060
+
+ Reviewed by Kentaro Hara.
+
+ Previously, the V8 garbage collector might have collected the Document
+ wrapper before the DOMWindow wrapper because we overwrite the
+ "document" property of the DOMWindow during navigation.
+
+ This patch adds a hidden document property on the global object to
+ ensure that the Document wrapper lives at least as long as the
+ DOMWindow wrapper, ensuring that DOMWindows that we obtain from V8
+ always have non-null Document objects.
+
+ The _javascript_Core bindings already have this behavior.
+
+ Test: fast/dom/Window/dom-access-from-closure-window-with-gc.html
+
+ * bindings/v8/V8DOMWindowShell.cpp:
+ (WebCore::V8DOMWindowShell::updateDocumentWrapperCache):
+ * bindings/v8/V8HiddenPropertyName.h:
+ (WebCore):
+
2012-08-14 Andrey Kosyakov <[email protected]>
Web Inspector: Calling getEventListeners() on element with malformed _javascript_ event listeners crashes
Modified: trunk/Source/WebCore/bindings/v8/V8DOMWindowShell.cpp (125655 => 125656)
--- trunk/Source/WebCore/bindings/v8/V8DOMWindowShell.cpp 2012-08-15 08:17:24 UTC (rev 125655)
+++ trunk/Source/WebCore/bindings/v8/V8DOMWindowShell.cpp 2012-08-15 08:26:06 UTC (rev 125656)
@@ -488,6 +488,12 @@
}
ASSERT(documentWrapper->IsObject());
m_context->Global()->ForceSet(v8::String::New("document"), documentWrapper, static_cast<v8::PropertyAttribute>(v8::ReadOnly | v8::DontDelete));
+
+ // We also stash a reference to the document on the real global object so that
+ // DOMWindow objects we obtain from _javascript_ references are guaranteed to have
+ // live Document objects.
+ v8::Handle<v8::Object> v8RealGlobal = v8::Handle<v8::Object>::Cast(m_context->Global()->GetPrototype());
+ v8RealGlobal->SetHiddenValue(V8HiddenPropertyName::document(), documentWrapper);
}
void V8DOMWindowShell::clearDocumentWrapperCache()
Modified: trunk/Source/WebCore/bindings/v8/V8HiddenPropertyName.h (125655 => 125656)
--- trunk/Source/WebCore/bindings/v8/V8HiddenPropertyName.h 2012-08-15 08:17:24 UTC (rev 125655)
+++ trunk/Source/WebCore/bindings/v8/V8HiddenPropertyName.h 2012-08-15 08:26:06 UTC (rev 125656)
@@ -36,17 +36,18 @@
namespace WebCore {
#define V8_HIDDEN_PROPERTIES(V) \
+ V(attributeListener) \
+ V(document) \
+ V(domStringMap) \
+ V(domTokenList) \
+ V(event) \
V(listener) \
- V(attributeListener) \
+ V(ownerNode) \
V(scriptState) \
V(sleepFunction) \
- V(toStringString) \
- V(event) \
V(state) \
- V(domStringMap) \
- V(domTokenList) \
- V(ownerNode) \
- V(textTracks)
+ V(textTracks) \
+ V(toStringString)
class V8HiddenPropertyName {
public:
_______________________________________________
webkit-changes mailing list
[email protected]
http://lists.webkit.org/mailman/listinfo/webkit-changes
