Changeset 19183 in webkit for trunk/JavaScriptCore/bindings/runtime_root.cpp

Timestamp:

Jan 26, 2007, 8:50:17 PM (18 years ago)

Author:

ggaren

Message:

JavaScriptCore:

Reviewed by Maciej Stachowiak.

Fixed <rdar://problem/4608404> WebScriptObject's _rootObject lack
of ownership policy causes crashes (e.g., in Dashcode)

The old model for RootObject ownership was either to (1) leak them or (2) assign
them to a single owner -- the WebCore::Frame -- which would destroy them
when it believed that all of its plug-ins had unloaded.

This model was broken because of (1) and also because plug-ins are not the only
RootObject clients. All Bindings clients are RootObjects clients, including
applications, which outlive any particular WebCore::Frame.

The new model for RootObject ownership is to reference-count them, with a
throw-back to the old model: The WebCore::Frame tracks the RootObjects
it creates, and invalidates them when it believes that all of its plug-ins
have unloaded.

We maintain this throw-back to avoid plug-in leaks, particularly from Java.
Java is completely broken when it comes to releasing JavaScript objects.
Comments in our code allege that Java does not always call finalize when
collecting objects. Moreoever, my own testing reveals that, when Java does
notify JavaScript of a finalize, the data it provides is totally bogus.

This setup is far from ideal, but I don't think we can do better without
completely rewriting the bindings code, and possibly part of the Java
plug-in / VM.

Layout tests pass. No additional leaks reported. WebCore/manual-tests/*liveconnect*
and a few LiveConnect demos on the web also run without a hitch.

const RootObject* => RootObject*, since we need to ref/deref

• bindings/NP_jsobject.cpp: (jsDeallocate): deref our RootObjects. Also unprotect or JSObject, instead of just relying on the RootObject to do it for us when it's invalidated. (_isSafeScript): Check RootObject validity. (_NPN_CreateScriptObject): ditto (_NPN_Invoke): ditto (_NPN_Evaluate): ditto (_NPN_GetProperty): ditto (_NPN_SetProperty): ditto (_NPN_RemoveProperty): ditto (_NPN_HasProperty): ditto (_NPN_HasMethod): ditto (_NPN_SetException): ditto

• bindings/runtime_root.cpp: Revived bit-rotted LIAR LIAR LIAR comment.

LOOK: Added support for invalidating RootObjects without deleting them,
which is the main goal of this patch.

Moved protect counting into the RootObject class, to emphasize that
the RootObject protects the JSObject, and unprotects it upon being invalidated.

addNativeReference => RootObject::gcProtect
removeNativeReference => RootObject::gcUnprotect
ProtectCountSet::contains => RootObject::gcIsProtected

I know we'll all be sad to see the word "native" go.

• bindings/runtime_root.h: Added ref-counting support to RootObject, with all the standard accoutrements.

• bindings/c/c_utility.cpp: (KJS::Bindings::convertValueToNPVariant): If we can't find a valid RootObject, return void instead of just leaking.

• bindings/jni/jni_instance.cpp: (JavaInstance::JavaInstance): Don't take a RootObject in our constructor; be like other Instances and require the caller to call setRootObject. This reduces the number of ownership code paths. (JavaInstance::invokeMethod): Check RootObject for validity.
• bindings/jni/jni_instance.h: Removed private no-arg constructor. Having an arg constructor accomplishes the same thing.

• bindings/jni/jni_jsobject.cpp: (JavaJSObject::invoke): No need to call findProtectCountSet, because finalize() checks for RootObject validity. (JavaJSObject::JavaJSObject): check RootObject for validity (JavaJSObject::call): ditto (JavaJSObject::eval): ditto (JavaJSObject::getMember): ditto (JavaJSObject::setMember): ditto (JavaJSObject::removeMember): ditto (JavaJSObject::getSlot): ditto (JavaJSObject::setSlot): ditto (JavaJSObject::toString): ditto (JavaJSObject::finalize): ditto (JavaJSObject::createNative): No need to tell the RootObject to protect the global object, since the RootObject already owns the interpreter.

• bindings/jni/jni_runtime.cpp: (JavaArray::JavaArray): Removed copy construcutor becaue it was unused. Dead code is dangerous code.

• bindings/objc/objc_runtime.mm: Added WebUndefined protocol. Previous use of WebScriptObject was bogus, because WebUndefined is not a subclass of WebScriptObject. (convertValueToObjcObject): If we can't find a valid RootObject, return nil instead of just leaking.

• bindings/objc/objc_utility.mm: (KJS::Bindings::convertValueToObjcValue): If we can't find a valid RootObject, return nil instead of just leaking.

LayoutTests:

Reviewed by Maciej Stachowiak.

Added test for <rdar://problem/4608404> WebScriptObject's _rootObject lack
of ownership policy causes crashes (e.g., in Dashcode)

No test for Java or NPP versions of this bug because there's no reliable way to
make Java and NPP objects outlive their RootObjects (although Java objects
sometimes do).

• plugins/root-object-premature-delete-crash-expected.txt: Added.
• plugins/root-object-premature-delete-crash.html: Added.

WebCore:

Reviewed by Maciej Stachowiak.

Fixed <rdar://problem/4608404> WebScriptObject's _executionContext lack
of ownership policy causes crashes (e.g., in Dashcode)

Added RootObject ref-counting goodness.

• page/mac/FrameMac.h:
• page/mac/FrameMac.mm: (WebCore::FrameMac::cleanupPluginObjects): Invalidate our RootObjects instead of detroying them. Track _bindingRootObject separately from the rest of our RootObjects, since it has its own variable.

• page/mac/WebCoreFrameBridge.mm: (createRootObject): Use the Frame's new, more encapsulated function to create a RootObject.

• bindings/objc/WebScriptObject.mm: Nixed rootObject setters, since they were unused and they complicated reference-counting.

WebKitTools:

Reviewed by Maciej Stachowiak.

Added support for test for <rdar://problem/4608404> WebScriptObject's
_rootObject lack of ownership policy causes crashes (e.g., in Dashcode)

• DumpRenderTree/DumpRenderTree.m: (+[LayoutTestController isSelectorExcludedFromWebScript:]): (+[LayoutTestController webScriptNameForSelector:]): (-[LayoutTestController storeWebScriptObject:]): (-[LayoutTestController accessStoredWebScriptObject]): (-[LayoutTestController dealloc]):

File:

• trunk/JavaScriptCore/bindings/runtime_root.cpp (modified) (3 diffs)

trunk/JavaScriptCore/bindings/runtime_root.cpp

@@ -28 +28 @@
 #include "runtime_root.h"
 #include <wtf/HashCountedSet.h>
+#include <wtf/HashSet.h>
 
 namespace KJS { namespace Bindings {
 
-// Java does NOT always call finalize (and thus KJS_JSObject_JSFinalize) when
-// it collects an objects.  This presents some difficulties.  We must ensure
-// the a JavaJSObject's corresponding JavaScript object doesn't get collected.  We
-// do this by incrementing the JavaScript's reference count the first time we
-// create a JavaJSObject for it, and decrementing the JavaScript reference count when
-// the last JavaJSObject that refers to it is finalized, or when the applet is
-// shutdown.
-//
-// To do this we keep a map that maps each applet instance
-// to the JavaScript objects it is referencing.  For each JavaScript instance
-// we also maintain a secondary reference count.  When that reference count reaches
-// 1 OR the applet is shutdown we deref the JavaScript instance.  Applet instances
-// are represented by a jlong.
-
-typedef HashMap<const RootObject*, ProtectCountSet*> RootObjectMap;
-
-static RootObjectMap* rootObjectMap()
-{
-    static RootObjectMap staticRootObjectMap;
-    return &staticRootObjectMap;
-}
-
-static ProtectCountSet* getProtectCountSet(const RootObject* rootObject)
-{
-    ProtectCountSet* protectCountSet = rootObjectMap()->get(rootObject);
-
-    if (!protectCountSet) {
-        protectCountSet = new ProtectCountSet;
-        rootObjectMap()->add(rootObject, protectCountSet);
-    }
-    return protectCountSet;
-}
-
-static void destroyProtectCountSet(const RootObject* rootObject, ProtectCountSet* protectCountSet)
-{
-    rootObjectMap()->remove(rootObject);
-    delete protectCountSet;
+// This code attempts to solve two problems: (1) plug-ins leaking references to 
+// JS and the DOM; (2) plug-ins holding stale references to JS and the DOM. Previous 
+// comments in this file claimed that problem #1 was an issue in Java, in particular, 
+// because Java, allegedly, didn't always call finalize when collecting an object.
+
+typedef HashSet<RootObject*> RootObjectSet;
+
+static RootObjectSet* rootObjectSet()
+{
+    static RootObjectSet staticRootObjectSet;
+    return &staticRootObjectSet;
 }
 
@@ -73 +48 @@
 // fix them by adding a JSObject to RootObject dictionary.
 
-ProtectCountSet* findProtectCountSet(JSObject* jsObject)
-{
-    const RootObject* rootObject = findRootObject(jsObject);
-    return rootObject ? getProtectCountSet(rootObject) : 0;
-}
-
-const RootObject* findRootObject(JSObject* jsObject)
-{
-    RootObjectMap::const_iterator end = rootObjectMap()->end();
-    for (RootObjectMap::const_iterator it = rootObjectMap()->begin(); it != end; ++it) {
-        ProtectCountSet* set = it->second;
-        if (set->contains(jsObject))
-            return it->first;
-    }
-    
+RootObject* findRootObject(JSObject* jsObject)
+{
+    RootObjectSet::const_iterator end = rootObjectSet()->end();
+    for (RootObjectSet::const_iterator it = rootObjectSet()->begin(); it != end; ++it) {
+        if ((*it)->gcIsProtected(jsObject))
+            return *it;
+    }
     return 0;
 }
 
-const RootObject* findRootObject(Interpreter* interpreter)
-{
-    RootObjectMap::const_iterator end = rootObjectMap()->end();
-    for (RootObjectMap::const_iterator it = rootObjectMap()->begin(); it != end; ++it) {
-        const RootObject* aRootObject = it->first;
-        
-        if (aRootObject->interpreter() == interpreter)
-            return aRootObject;
-    }
-    
+RootObject* findRootObject(Interpreter* interpreter)
+{
+    RootObjectSet::const_iterator end = rootObjectSet()->end();
+    for (RootObjectSet::const_iterator it = rootObjectSet()->begin(); it != end; ++it) {
+        if ((*it)->interpreter() == interpreter)
+            return *it;
+    }
     return 0;
-}
-
-void addNativeReference(const RootObject* rootObject, JSObject* jsObject)
-{
-    if (!rootObject)
-        return;
-    
-    ProtectCountSet* protectCountSet = getProtectCountSet(rootObject);
-    if (!protectCountSet->contains(jsObject)) {
-        JSLock lock;
-        gcProtect(jsObject);
-    }
-    protectCountSet->add(jsObject);
-}
-
-void removeNativeReference(JSObject* jsObject)
-{
-    if (!jsObject)
-        return;
-
-    // We might have manually detroyed the root object and its protect set already
-    ProtectCountSet* protectCountSet = findProtectCountSet(jsObject);
-    if (!protectCountSet)
-        return;
-
-    if (protectCountSet->count(jsObject) == 1) {
-        JSLock lock;
-        gcUnprotect(jsObject);
-    }
-    protectCountSet->remove(jsObject);
 }
 
@@ -256 +190 @@
     CFRunLoopAddSource(RootObject::_runLoop, RootObject::_performJavaScriptSource, kCFRunLoopDefaultMode);
 }
+
 #endif
 
-// Destroys the RootObject and unprotects all JSObjects associated with it.
-void RootObject::destroy()
-{
-    ProtectCountSet* protectCountSet = getProtectCountSet(this);
-    
-    if (protectCountSet) {
-        ProtectCountSet::iterator end = protectCountSet->end();
-        for (ProtectCountSet::iterator it = protectCountSet->begin(); it != end; ++it) {
-            JSLock lock;
-            gcUnprotect(it->first);            
-        }
-
-        destroyProtectCountSet(this, protectCountSet);
-    }
-
-    delete this;
+PassRefPtr<RootObject> RootObject::create(const void* nativeHandle, PassRefPtr<Interpreter> interpreter)
+{
+    return new RootObject(nativeHandle, interpreter);
+}
+
+RootObject::RootObject(const void* nativeHandle, PassRefPtr<Interpreter> interpreter)
+    : m_refCount(0)
+    , m_isValid(true)
+    , m_nativeHandle(nativeHandle)
+    , m_interpreter(interpreter)
+{
+    ASSERT(m_interpreter);
+    rootObjectSet()->add(this);
+}
+
+RootObject::~RootObject()
+{
+    if (m_isValid)
+        invalidate();
+}
+
+void RootObject::invalidate()
+{
+    if (!m_isValid)
+        return;
+
+    m_isValid = false;
+
+    m_nativeHandle = 0;
+    m_interpreter = 0;
+
+    ProtectCountSet::iterator end = m_protectCountSet.end();
+    for (ProtectCountSet::iterator it = m_protectCountSet.begin(); it != end; ++it) {
+        JSLock lock;
+        KJS::gcUnprotect(it->first);
+    }
+    m_protectCountSet.clear();
+
+    rootObjectSet()->remove(this);
+}
+
+void RootObject::gcProtect(JSObject* jsObject)
+{
+    ASSERT(m_isValid);
+    
+    if (!m_protectCountSet.contains(jsObject)) {
+        JSLock lock;
+        KJS::gcProtect(jsObject);
+    }
+    m_protectCountSet.add(jsObject);
+}
+
+void RootObject::gcUnprotect(JSObject* jsObject)
+{
+    ASSERT(m_isValid);
+    
+    if (!jsObject)
+        return;
+
+    if (m_protectCountSet.count(jsObject) == 1) {
+        JSLock lock;
+        KJS::gcUnprotect(jsObject);
+    }
+    m_protectCountSet.remove(jsObject);
+}
+
+bool RootObject::gcIsProtected(JSObject* jsObject)
+{
+    ASSERT(m_isValid);
+    return m_protectCountSet.contains(jsObject);
+}
+
+const void* RootObject::nativeHandle() const 
+{ 
+    ASSERT(m_isValid);
+    return m_nativeHandle; 
+}
+
+Interpreter* RootObject::interpreter() const 
+{ 
+    ASSERT(m_isValid);
+    return m_interpreter.get(); 
 }