tree 42715f8b961b30b98625ffe34bc4d946abd5a234
parent 3adc38d4348d8968028a58b27e392bd63aa7b376
author cdumez@apple.com <cdumez@apple.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc> 1585864184 +0000
committer cdumez@apple.com <cdumez@apple.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc> 1585864184 +0000

ActiveDOMObject::hasPendingActivity() should stop preventing wrapper collection after ActiveDOMObject::stop() has been called
https://bugs.webkit.org/show_bug.cgi?id=209886

Reviewed by Ryosuke Niwa.

ActiveDOMObject::stop() gets called when the script execution context is about to be destroyed.
ActiveDOMObject objects should no longer run script after that and there is therefore no point
in keeping the JS wrapper alive once stop() has been called. Worse, depending on the
implementation of virtualHasPendingActivity(), keeping the wrapper alive past this point may
actually cause JS wrapper leaks. Some of the virtualHasPendingActivity() were properly checking
if the context was stopped but not all of them. To address the issue, we now check
ActiveDOMObject::isContextStopped() in the JS bindings, in addition to
ActiveDOMObject::hasPendingActivity(), so that it is no longer possible to keep a JS wrapper
alive past the point where the script execution context has been stopped. This new approach
is a lot less leak/error prone.

* Modules/indexeddb/IDBDatabase.cpp:
(WebCore::IDBDatabase::virtualHasPendingActivity const):
* Modules/indexeddb/IDBOpenDBRequest.cpp:
(WebCore::IDBOpenDBRequest::requestCompleted):
* Modules/indexeddb/IDBRequest.cpp:
(WebCore::IDBRequest::virtualHasPendingActivity const):
(WebCore::IDBRequest::stop):
(WebCore::IDBRequest::enqueueEvent):
(WebCore::IDBRequest::dispatchEvent):
* Modules/indexeddb/IDBRequest.h:
* Modules/indexeddb/IDBTransaction.cpp:
(WebCore::IDBTransaction::virtualHasPendingActivity const):
(WebCore::IDBTransaction::stop):
(WebCore::IDBTransaction::notifyDidAbort):
(WebCore::IDBTransaction::enqueueEvent):
(WebCore::IDBTransaction::dispatchEvent):
* Modules/indexeddb/IDBTransaction.h:
* Modules/mediastream/MediaDevices.cpp:
(WebCore::MediaDevices::virtualHasPendingActivity const):
* bindings/scripts/CodeGeneratorJS.pm:
(GenerateImplementation):
* bindings/scripts/test/JS/JSTestInterface.cpp:
(WebCore::JSTestInterfaceOwner::isReachableFromOpaqueRoots):
* bindings/scripts/test/JS/JSTestNamedConstructor.cpp:
(WebCore::JSTestNamedConstructorOwner::isReachableFromOpaqueRoots):
* css/FontFace.cpp:
(WebCore::FontFace::virtualHasPendingActivity const):
* dom/ActiveDOMObject.h:
* html/HTMLCanvasElement.cpp:
(WebCore::HTMLCanvasElement::virtualHasPendingActivity const):
* workers/service/ServiceWorkerRegistration.cpp:
(WebCore::ServiceWorkerRegistration::getOrCreate):
(WebCore::ServiceWorkerRegistration::update):
(WebCore::ServiceWorkerRegistration::unregister):
(WebCore::ServiceWorkerRegistration::queueTaskToFireUpdateFoundEvent):
(WebCore::ServiceWorkerRegistration::stop):
(WebCore::ServiceWorkerRegistration::virtualHasPendingActivity const):
* workers/service/ServiceWorkerRegistration.h:

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@259419 268f45cc-cd09-0410-ab3c-d52691b4dbfc