[Webkit-unassigned] [Bug 52035] New: Unregistering DOMWrapperWorlds is unsafe

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=52035

           Summary: Unregistering DOMWrapperWorlds is unsafe
           Product: WebKit
           Version: 528+ (Nightly build)
          Platform: PC
        OS/Version: Mac OS X 10.5
            Status: NEW
          Severity: Normal
          Priority: P2
         Component: WebCore JavaScript
        AssignedTo: webkit-unassigned at lists.webkit.org
        ReportedBy: barraclough at apple.com


The method DOMWrapperWorld::unregisterWorld() effectively calls the DOMWrapperWorld's destructor early, in order to release wrappers once we know we no longer intend to use them.  Whilst it is okay to have a method to throw away wrappers (assuming we know we're willing to lose any state stored on them) it is not okay to deregister the world from the JSGlobalData.  A sequence of events that triggers the bug would look like this:

(1) Create a DOMWrapperWorld.
(2) Register a timer in the world.
(3) Call unregisterWorld() on the world.
(4) Timer goes off, code is executed in the world, creates a Node not attached to a Document.
(5) We attempt to lookup a wrapper map for the world on the JSGlobalData, but because we've called forgetWorld() none exists.
(6) Attempt to add a wrapper to a NULL map.

-- 
Configure bugmail: https://bugs.webkit.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.