Fixed some WebKit2 crashes seen on the buildbot after my last patch.

Reviewed by Beth Dakin.

* WebProcess/Plugins/Netscape/NPRuntimeObjectMap.cpp:
(WebKit::NPRuntimeObjectMap::finalize): Don't try to get our value
out of the map, since Weak<T> returns NULL during finalization. Instead,
use the handle we've been passed for finalization.

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@113146 268f45cc-cd09-0410-ab3c-d52691b4dbfc

diff --git a/Source/WebKit2/ChangeLog b/Source/WebKit2/ChangeLog
index 6982213..35e6208 100644 (file)
--- a/Source/WebKit2/ChangeLog
+++ b/Source/WebKit2/ChangeLog
@@ -1,3 +1,14 @@
+2012-04-03  Geoffrey Garen  <ggaren@apple.com>
+
+        Fixed some WebKit2 crashes seen on the buildbot after my last patch.
+
+        Reviewed by Beth Dakin.
+
+        * WebProcess/Plugins/Netscape/NPRuntimeObjectMap.cpp:
+        (WebKit::NPRuntimeObjectMap::finalize): Don't try to get our value
+        out of the map, since Weak<T> returns NULL during finalization. Instead,
+        use the handle we've been passed for finalization.
+
 2012-03-29  Geoffrey Garen  <ggaren@apple.com>
 
         First step toward incremental Weak<T> finalization

diff --git a/Source/WebKit2/WebProcess/Plugins/Netscape/NPRuntimeObjectMap.cpp b/Source/WebKit2/WebProcess/Plugins/Netscape/NPRuntimeObjectMap.cpp
index b4f0381..1bf94cb 100644 (file)
--- a/Source/WebKit2/WebProcess/Plugins/Netscape/NPRuntimeObjectMap.cpp
+++ b/Source/WebKit2/WebProcess/Plugins/Netscape/NPRuntimeObjectMap.cpp
@@ -290,11 +290,13 @@ void NPRuntimeObjectMap::addToInvalidationQueue(NPObject* npObject)
 
 void NPRuntimeObjectMap::finalize(JSC::Handle<JSC::Unknown> handle, void* context)
 {
+    JSNPObject* object = jsCast<JSNPObject*>(asObject(handle.get()));
+
     HashMap<NPObject*, JSC::Weak<JSNPObject> >::iterator found = m_jsNPObjects.find(static_cast<NPObject*>(context));
     ASSERT(found != m_jsNPObjects.end());
-    ASSERT_UNUSED(handle, asObject(handle.get()) == found->second.get());
-    JSNPObject* object = found->second.get();
+    ASSERT(found->second.was(object));
     m_jsNPObjects.remove(found);
+
     addToInvalidationQueue(object->leakNPObject());
 }