[Webkit-unassigned] [Bug 93812] REGRESSION(r125251): It made svg/custom/use-instanceRoot-as-event-target.xhtml assert and flakey

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=93812


Darin Adler <darin at apple.com> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
 Attachment #237244|review?                     |review-
               Flag|                            |




--- Comment #21 from Darin Adler <darin at apple.com>  2014-09-03 23:37:17 PST ---
(From update of attachment 237244)
View in context: https://bugs.webkit.org/attachment.cgi?id=237244&action=review

Geoff, what’s your analysis about what’s happening here?

> Source/WebCore/bindings/js/JSEventListener.h:72
> +        mutable JSC::Strong<JSC::JSObject> m_wrapper;

I don’t think we can just change this from Weak to Strong; doing that would lead to cycles and every object with an event listener that captured the object would leak. We should write a test case that checks this does not happen.

> LayoutTests/ChangeLog:9
> +        There are cases where the wrapper is not referenced from anywhere any more at
> +        the time when the event needs to be fired, which prevents that firing.

We can’t fix this bug without understanding more about those cases.

-- 
Configure bugmail: https://bugs.webkit.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.