[V8] Keep a RefPtr<SerializedScriptValue*> when we call serialize()/deserialize() (part 1)
https://bugs.webkit.org/show_bug.cgi?id=107891

Reviewed by Abhishek Arya.

If you use a raw SerializedScriptValue* for serialize()/deserialize(),
it can potentially cause a use-after-free. This is because serialize()/
deserialize() can destruct a RefPtr of the SerializedScriptValue*,
depending on data that is serialized/deserialized. So we should keep a
RefPtr<SerializedScriptValue*> when we call serialize()/deserialize().
(See https://bugs.webkit.org/show_bug.cgi?id=107792 for more details.)

No tests. This is just a just-in-case fix. I couldn't find any bug
even in an ASAN build.

* bindings/v8/custom/V8CustomEventCustom.cpp:
(WebCore::V8CustomEvent::detailAccessorGetter):


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@140887 268f45cc-cd09-0410-ab3c-d52691b4dbfc
[chromium] move tracking of the top loading frame to TestRunner library
https://bugs.webkit.org/show_bug.cgi?id=107948

Reviewed by Adam Barth.

* DumpRenderTree/chromium/DRTTestRunner.cpp:
(DRTTestRunner::WorkQueue::processWorkSoon):
(DRTTestRunner::WorkQueue::processWork):
(DRTTestRunner::completeNotifyDone):
* DumpRenderTree/chromium/DRTTestRunner.h:
(DRTTestRunner):
* DumpRenderTree/chromium/TestRunner/public/WebTestProxy.h:
(WebTestProxyBase):
* DumpRenderTree/chromium/TestRunner/public/WebTestRunner.h:
(WebTestRunner::WebTestRunner::setTopLoadingFrame):
(WebTestRunner::WebTestRunner::topLoadingFrame):
* DumpRenderTree/chromium/TestRunner/src/TestRunner.cpp:
(WebTestRunner::TestRunner::TestRunner):
(WebTestRunner::TestRunner::reset):
(WebTestRunner::TestRunner::setTopLoadingFrame):
(WebTestRunner):
(WebTestRunner::TestRunner::topLoadingFrame):
* DumpRenderTree/chromium/TestRunner/src/TestRunner.h:
(TestRunner):
(WebTestRunner::TestRunner::locationChangeDone):
* DumpRenderTree/chromium/TestRunner/src/WebTestProxy.cpp:
(WebTestRunner::WebTestProxyBase::didStartProvisionalLoad):
(WebTestRunner::WebTestProxyBase::didFailProvisionalLoad):
(WebTestRunner::WebTestProxyBase::didFailLoad):
(WebTestRunner::WebTestProxyBase::didFinishLoad):
(WebTestRunner::WebTestProxyBase::locationChangeDone):
(WebTestRunner):
* DumpRenderTree/chromium/WebViewHost.cpp:
(WebViewHost::reset):
(WebViewHost::updateURL):
* DumpRenderTree/chromium/WebViewHost.h:
(WebViewHost):


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@140889 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Keep a RefPtr<SerializedScriptValue*> when we call serialize()/deserialize() for MessageEvent
https://bugs.webkit.org/show_bug.cgi?id=107900

Reviewed by Abhishek Arya.

If you use a raw SerializedScriptValue* for serialize()/deserialize(),
it can potentially cause a use-after-free. This is because serialize()/
deserialize() can destruct a RefPtr of the SerializedScriptValue*,
depending on data that is serialized/deserialized. So we should keep a
RefPtr<SerializedScriptValue*> when we call serialize()/deserialize().
(See https://bugs.webkit.org/show_bug.cgi?id=107792 for more details.)

No tests. This is just a just-in-case fix. I couldn't find any bug
even in an ASAN build.

* bindings/js/JSMessageEventCustom.cpp:
(WebCore::JSMessageEvent::data):
* bindings/v8/custom/V8MessageEventCustom.cpp:
(WebCore::V8MessageEvent::dataAccessorGetter):
* dom/MessageEvent.h:
(WebCore::MessageEvent::dataAsSerializedScriptValue):


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@140891 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Keep a RefPtr<SerializedScriptValue*> when we call serialize()/deserialize() in code generators
https://bugs.webkit.org/show_bug.cgi?id=107902

Reviewed by Abhishek Arya.

If you use a raw SerializedScriptValue* for serialize()/deserialize(),
it can potentially cause a use-after-free. This is because serialize()/
deserialize() can destruct a RefPtr of the SerializedScriptValue*,
depending on data that is serialized/deserialized. So we should keep a
RefPtr<SerializedScriptValue*> when we call serialize()/deserialize().
(See https://bugs.webkit.org/show_bug.cgi?id=107792 for more details.)

No tests. This is just a just-in-case fix.

* Modules/intents/Intent.h:
(WebCore::Intent::data):
* Modules/intents/IntentRequest.cpp:
(WebCore::IntentRequest::postResult):
(WebCore::IntentRequest::postFailure):
* Modules/intents/IntentRequest.h:
(IntentRequest):
* Modules/intents/IntentResultCallback.h:
(IntentResultCallback):
* bindings/scripts/CodeGeneratorJS.pm:
(GetNativeTypeForCallbacks):
* bindings/scripts/CodeGeneratorV8.pm:
(GenerateNormalAttrGetter):
(GetNativeTypeForCallbacks):
* bindings/scripts/test/V8/V8TestSerializedScriptValueInterface.cpp:
(WebCore::TestSerializedScriptValueInterfaceV8Internal::cachedValueAttrGetter):
(WebCore::TestSerializedScriptValueInterfaceV8Internal::cachedReadonlyValueAttrGetter):
* dom/MessagePortChannel.h:
(WebCore::MessagePortChannel::EventData::message):


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@140892 268f45cc-cd09-0410-ab3c-d52691b4dbfc