[Webkit-unassigned] [Bug 211844] New: JSDOMWindowBase m_windowCloseWatchpoints must be Ref<>

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=211844

            Bug ID: 211844
           Summary: JSDOMWindowBase m_windowCloseWatchpoints must be Ref<>
           Product: WebKit
           Version: WebKit Nightly Build
          Hardware: Unspecified
                OS: Unspecified
            Status: NEW
          Severity: Normal
          Priority: P2
         Component: WebCore JavaScript
          Assignee: webkit-unassigned at lists.webkit.org
          Reporter: xc.o.c.1180 at gmail.com

Created attachment 399266

  --> https://bugs.webkit.org/attachment.cgi?id=399266&action=review

patch

JSC WatchpointSet is reference counted, however m_windowCloseWatchpoints is just a member variable.

ProxyableAccessCase holds on it, when JSDOMWindowBase is destroyed, m_additionalSet holds a dangling pointer.

By the way, WatchpointSet constructor should be private.

I can not build latest WebKit, please clean up the patch, add other stuffs, then commit it.


Thanks.

-- 
You are receiving this mail because:
You are the assignee for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.webkit.org/pipermail/webkit-unassigned/attachments/20200513/49055f3a/attachment.htm>