[Webkit-unassigned] [Bug 85152] New: [V8] An event listener object can be reclaimed by GC even if it is still alive

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=85152

           Summary: [V8] An event listener object can be reclaimed by GC
                    even if it is still alive
           Product: WebKit
           Version: 528+ (Nightly build)
          Platform: Unspecified
        OS/Version: Unspecified
            Status: NEW
          Severity: Normal
          Priority: P2
         Component: WebCore JavaScript
        AssignedTo: webkit-unassigned at lists.webkit.org
        ReportedBy: haraken at chromium.org
                CC: abarth at webkit.org, ojan at chromium.org,
                    arv at chromium.org, haraken at chromium.org


This is a bug detected in bug 84908. In a nutshell, an onresize event handler in the popup window can be non-deterministically reclaimed by GC. For more details, please look at the chromium issue 123642: http://code.google.com/p/chromium/issues/detail?id=123642

The patch for bug 84908 fixes V8LazyEventListner.cpp so that an event listener object is re-created if the event listener object is already reclaimed. This is just a temporary fix. We should fix the code so that an alive event listener object is never reclaimed. Please look at bug 84908 and chromium issue 123642 for more details.

-- 
Configure bugmail: https://bugs.webkit.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.