tree 1b078f5d7a7e38b354e843d01d1e1c9a6355dfc7
parent 8e05f2b4e9624d281ae75dfdd0e1e7e6b3991631
author Carlos Garcia Campos <cgarcia@igalia.com> 1428508746 +0000
committer Carlos Garcia Campos <carlosgc@webkit.org> 1428508746 +0000

Merge r182537 - [GTK] Crash in DOMObjectCache when a wrapped object owned by the cache is unreffed by the user
https://bugs.webkit.org/show_bug.cgi?id=143521

Reviewed by Martin Robinson.

This is a case we claim to support, but it only works if the
object has only one reference. In that case, when the user unrefs
it, the weak ref notify callback removes the object from the
cache. However, if the object has more than one ref, the cache
doesn't know the user unreffed it, and when clearing the cache we
try to remove more references than what the object actually has,
causing a crash in g_object_unref.

* bindings/gobject/DOMObjectCache.cpp:
(WebKit::DOMObjectCacheData::clearObject):