[Webkit-unassigned] [Bug 184307] Custom elements can lose its JS wrapper and become HTMLUnknownElement

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=184307

--- Comment #10 from Ryosuke Niwa <rniwa at webkit.org> ---
Created attachment 349740

  --> https://bugs.webkit.org/attachment.cgi?id=349740&action=review

WIP logging

Interesting. Simply retaining elements in the custom element reaction queue isn't enough.
The attached patch sill knows some failures.

Note that one has to manually modify JSNodeOwner::finalize in DerivedSource to do the following:

extern HashMap<Element*, unsigned>& finalizedElements();

void JSNodeOwner::finalize(JSC::Handle<JSC::Unknown> handle, void* context)
{
    auto* jsNode = static_cast<JSNode*>(handle.slot()->asCell());
    auto& world = *static_cast<DOMWrapperWorld*>(context);
    auto& node = jsNode->wrapped();
    if (is<Element>(node) && node.isDefinedCustomElement()) {
        finalizedElements().set(&downcast<Element>(node), 1);
    }
    uncacheWrapper(world, &jsNode->wrapped(), jsNode);
}

If I add console.log right above where we append the result,
I see that sometimes the wrapper goes away without this code getting code:

CONSOLE MESSAGE: line 37: PASS!
CONSOLE MESSAGE: line 37: PASS!
Found a wrapper-less node! finalized=0
CONSOLE MESSAGE: line 35: FAIL:1999
CONSOLE MESSAGE: line 37: PASS!
Found a wrapper-less node! finalized=0
CONSOLE MESSAGE: line 35: FAIL:1999
CONSOLE MESSAGE: line 37: PASS!
CONSOLE MESSAGE: line 37: PASS!
Found a wrapper-less node! finalized=0
CONSOLE MESSAGE: line 35: FAIL:1999
CONSOLE MESSAGE: line 37: PASS!
Found a wrapper-less node! finalized=1
CONSOLE MESSAGE: line 35: FAIL:1999
CONSOLE MESSAGE: line 37: PASS!
CONSOLE MESSAGE: line 37: PASS!
CONSOLE MESSAGE: line 37: PASS!
CONSOLE MESSAGE: line 37: PASS!
CONSOLE MESSAGE: line 37: PASS!
Found a wrapper-less node! finalized=1
CONSOLE MESSAGE: line 35: FAIL:1999
CONSOLE MESSAGE: line 37: PASS!
CONSOLE MESSAGE: line 37: PASS!
CONSOLE MESSAGE: line 37: PASS!
CONSOLE MESSAGE: line 37: PASS!

It's a tad strange that JSElement wrappers are going away without JSNodeOwner::finalize getting called.

-- 
You are receiving this mail because:
You are the assignee for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.webkit.org/pipermail/webkit-unassigned/attachments/20180914/d16c7b5d/attachment-0001.html>