Commit f8515980 authored by akling@apple.com's avatar akling@apple.com

Ref: A smart pointer for the reference age.

<https://webkit.org/b/120570>

Reviewed by Antti Koivisto.

Source/WebCore:

Use Ref<T> for various stack guards where null checking isn't needed.

Source/WTF:

Add a very simple simple Ref<T> smart pointer class that is never null.
It's initialized by passing a T& to the constructor and cannot be assigned to.

operator-> is not overloaded, to prevent unsafe-looking code.
The value is extracted by "T& get()", since C++ does not let you override operator.()

* wtf/Ref.h:

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@154962 268f45cc-cd09-0410-ab3c-d52691b4dbfc
parent 7e6e9e66
2013-09-01 Andreas Kling <akling@apple.com>
Ref: A smart pointer for the reference age.
<https://webkit.org/b/120570>
Reviewed by Antti Koivisto.
Add a very simple simple Ref<T> smart pointer class that is never null.
It's initialized by passing a T& to the constructor and cannot be assigned to.
operator-> is not overloaded, to prevent unsafe-looking code.
The value is extracted by "T& get()", since C++ does not let you override operator.()
* wtf/Ref.h:
2013-08-30 Oliver Hunt <oliver@apple.com>
Make JSValue bool conversion less dangerous
......
......@@ -85,6 +85,7 @@ HEADERS += \
MessageQueue.h \
MetaAllocator.h \
MetaAllocatorHandle.h \
Ref.h \
Noncopyable.h \
NonCopyingSort.h \
NotFound.h \
......
......@@ -494,6 +494,9 @@
<ClInclude Include="..\wtf\NeverDestroyed.h">
<Filter>wtf</Filter>
</ClInclude>
<ClInclude Include="..\wtf\Ref.h">
<Filter>wtf</Filter>
</ClInclude>
<ClInclude Include="..\wtf\Noncopyable.h">
<Filter>wtf</Filter>
</ClInclude>
......
......@@ -54,6 +54,7 @@
1FA47C8A152502DA00568D1B /* WebCoreThread.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 1FA47C88152502DA00568D1B /* WebCoreThread.cpp */; };
1FA47C8B152502DA00568D1B /* WebCoreThread.h in Headers */ = {isa = PBXBuildFile; fileRef = 1FA47C89152502DA00568D1B /* WebCoreThread.h */; };
26147B0A15DDCCDC00DDB907 /* IntegerToStringConversion.h in Headers */ = {isa = PBXBuildFile; fileRef = 26147B0815DDCCDC00DDB907 /* IntegerToStringConversion.h */; };
26299B6E17A9E5B800ADEBE5 /* Ref.h in Headers */ = {isa = PBXBuildFile; fileRef = 26299B6D17A9E5B800ADEBE5 /* Ref.h */; };
2C05385415BC819000F21B96 /* GregorianDateTime.h in Headers */ = {isa = PBXBuildFile; fileRef = 2C05385315BC819000F21B96 /* GregorianDateTime.h */; };
2CCD892A15C0390200285083 /* GregorianDateTime.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 2CCD892915C0390200285083 /* GregorianDateTime.cpp */; };
44F66008171AFAE600E4AD19 /* EnumClass.h in Headers */ = {isa = PBXBuildFile; fileRef = 44F66007171AFAA900E4AD19 /* EnumClass.h */; };
......@@ -320,6 +321,7 @@
1FA47C88152502DA00568D1B /* WebCoreThread.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = WebCoreThread.cpp; sourceTree = "<group>"; };
1FA47C89152502DA00568D1B /* WebCoreThread.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = WebCoreThread.h; sourceTree = "<group>"; };
26147B0815DDCCDC00DDB907 /* IntegerToStringConversion.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = IntegerToStringConversion.h; sourceTree = "<group>"; };
26299B6D17A9E5B800ADEBE5 /* Ref.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = Ref.h; sourceTree = "<group>"; };
2C05385315BC819000F21B96 /* GregorianDateTime.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = GregorianDateTime.h; sourceTree = "<group>"; };
2CCD892915C0390200285083 /* GregorianDateTime.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = GregorianDateTime.cpp; sourceTree = "<group>"; };
44DEE74A152274BB00C6EC37 /* iOS.xcconfig */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text.xcconfig; path = iOS.xcconfig; sourceTree = "<group>"; };
......@@ -708,6 +710,7 @@
A8A472CE151A825B004123FF /* MetaAllocator.h */,
A8A472CF151A825B004123FF /* MetaAllocatorHandle.h */,
1A3F6BE6174ADA2100B2EEA7 /* NeverDestroyed.h */,
26299B6D17A9E5B800ADEBE5 /* Ref.h */,
0F0D85B317234CB100338210 /* NoLock.h */,
A8A472D0151A825B004123FF /* Noncopyable.h */,
A8A472D1151A825B004123FF /* NonCopyingSort.h */,
......@@ -1001,6 +1004,7 @@
A8A473DA151A825B004123FF /* HashTraits.h in Headers */,
A8A473DB151A825B004123FF /* HexNumber.h in Headers */,
A8A473DC151A825B004123FF /* InlineASM.h in Headers */,
26299B6E17A9E5B800ADEBE5 /* Ref.h in Headers */,
A70DA0841799F04D00529A9B /* Insertion.h in Headers */,
26147B0A15DDCCDC00DDB907 /* IntegerToStringConversion.h in Headers */,
A70DA0851799F04D00529A9B /* ListDump.h in Headers */,
......@@ -1063,6 +1067,7 @@
A8A47424151A825B004123FF /* SinglyLinkedList.h in Headers */,
A748745317A0BDAE00FA04CB /* SixCharacterHash.h in Headers */,
A8A47426151A825B004123FF /* Spectrum.h in Headers */,
26A7052617445A5F00118ACA /* Ref.h in Headers */,
A8A47428151A825B004123FF /* StackBounds.h in Headers */,
FEDACD3E1630F83F00C69634 /* StackStats.h in Headers */,
A8A47429151A825B004123FF /* StaticConstructors.h in Headers */,
......
......@@ -55,6 +55,7 @@ set(WTF_HEADERS
MetaAllocatorHandle.h
NonCopyingSort.h
ThreadRestrictionVerifier.h
Ref.h
Noncopyable.h
NotFound.h
NullPtr.h
......
......@@ -32,6 +32,7 @@ namespace WTF {
template<typename T> class PassOwnPtr;
template<typename T> class PassRefPtr;
template<typename T> class RefPtr;
template<typename T> class Ref;
template<typename T, size_t inlineCapacity, typename OverflowHandler> class Vector;
class AtomicString;
......@@ -55,6 +56,7 @@ using WTF::PassOwnArrayPtr;
using WTF::PassOwnPtr;
using WTF::PassRefPtr;
using WTF::RefPtr;
using WTF::Ref;
using WTF::Vector;
using WTF::AtomicString;
......
2013-09-01 Andreas Kling <akling@apple.com>
Ref: A smart pointer for the reference age.
<https://webkit.org/b/120570>
Reviewed by Antti Koivisto.
Use Ref<T> for various stack guards where null checking isn't needed.
2013-09-02 Andreas Kling <akling@apple.com>
Simplify DocumentType handling.
......@@ -35,6 +35,7 @@
#include "Geoposition.h"
#include "Page.h"
#include <wtf/CurrentTime.h>
#include <wtf/Ref.h>
#include "Coordinates.h"
#include "GeolocationController.h"
......@@ -147,7 +148,7 @@ void Geolocation::GeoNotifier::timerFired(Timer<GeoNotifier>*)
// Protect this GeoNotifier object, since it
// could be deleted by a call to clearWatch in a callback.
RefPtr<GeoNotifier> protect(this);
Ref<GeoNotifier> protect(*this);
// Test for fatal error first. This is required for the case where the Frame is
// disconnected and requests are cancelled.
......@@ -433,7 +434,7 @@ void Geolocation::clearWatch(int watchID)
void Geolocation::setIsAllowed(bool allowed)
{
// Protect the Geolocation object from garbage collection during a callback.
RefPtr<Geolocation> protect(this);
Ref<Geolocation> protect(*this);
// This may be due to either a new position from the service, or a cached
// position.
......
......@@ -84,6 +84,7 @@
#include <wtf/MainThread.h>
#include <wtf/OwnPtr.h>
#include <wtf/PassOwnPtr.h>
#include <wtf/Ref.h>
#include <wtf/RefCounted.h>
#include <wtf/text/WTFString.h>
......@@ -843,7 +844,7 @@ void AudioContext::deleteMarkedNodes()
ASSERT(isMainThread());
// Protect this object from being deleted before we release the mutex locked by AutoLocker.
RefPtr<AudioContext> protect(this);
Ref<AudioContext> protect(*this);
{
AutoLocker locker(this);
......
......@@ -36,6 +36,7 @@
#include "JSSQLTransaction.h"
#include "ScriptExecutionContext.h"
#include <runtime/JSLock.h>
#include <wtf/Ref.h>
namespace WebCore {
......@@ -46,7 +47,7 @@ bool JSSQLStatementErrorCallback::handleEvent(SQLTransaction* transaction, SQLEr
if (!m_data || !m_data->globalObject() || !canInvokeCallback())
return true;
RefPtr<JSSQLStatementErrorCallback> protect(this);
Ref<JSSQLStatementErrorCallback> protect(*this);
JSC::JSLockHolder lock(m_data->globalObject()->vm());
......
......@@ -35,6 +35,7 @@
#include "PageConsole.h"
#include "SecurityOrigin.h"
#include <runtime/JSLock.h>
#include <wtf/Ref.h>
namespace WebCore {
......@@ -86,7 +87,7 @@ String JSCustomXPathNSResolver::lookupNamespaceURI(const String& prefix)
function = m_customResolver.get();
}
RefPtr<JSCustomXPathNSResolver> selfProtector(this);
Ref<JSCustomXPathNSResolver> selfProtector(*this);
MarkedArgumentBuffer args;
args.append(jsStringWithCache(exec, prefix));
......
......@@ -29,6 +29,7 @@
#include "ActiveDOMCallback.h"
#include "JSMainThreadExecState.h"
#include <heap/StrongInlines.h>
#include <wtf/Ref.h>
using namespace JSC;
......@@ -46,7 +47,7 @@ public:
if (!canInvokeCallback())
return;
RefPtr<JSGlobalObjectCallback> protect(this);
Ref<JSGlobalObjectCallback> protect(*this);
JSLockHolder lock(m_globalObject->vm());
ExecState* exec = m_globalObject->globalExec();
......
......@@ -38,6 +38,7 @@
#include "JSEvent.h"
#include "JSMainThreadExecState.h"
#include <runtime/JSLock.h>
#include <wtf/Ref.h>
using namespace JSC;
......@@ -79,7 +80,7 @@ void JSErrorHandler::handleEvent(ScriptExecutionContext* scriptExecutionContext,
CallType callType = jsFunction->methodTable()->getCallData(jsFunction, callData);
if (callType != CallTypeNone) {
RefPtr<JSErrorHandler> protectedctor(this);
Ref<JSErrorHandler> protectedctor(*this);
Event* savedEvent = globalObject->currentEvent();
globalObject->setCurrentEvent(event);
......
......@@ -30,6 +30,7 @@
#include "WorkerGlobalScope.h"
#include <runtime/ExceptionHelpers.h>
#include <runtime/JSLock.h>
#include <wtf/Ref.h>
#include <wtf/RefCountedLeakCounter.h>
using namespace JSC;
......@@ -111,7 +112,7 @@ void JSEventListener::handleEvent(ScriptExecutionContext* scriptExecutionContext
}
if (callType != CallTypeNone) {
RefPtr<JSEventListener> protect(this);
Ref<JSEventListener> protect(*this);
MarkedArgumentBuffer args;
args.append(toJS(exec, globalObject, event));
......
......@@ -26,6 +26,7 @@
#include <heap/StrongInlines.h>
#include <heap/Weak.h>
#include <heap/WeakInlines.h>
#include <wtf/Ref.h>
namespace WebCore {
......@@ -79,7 +80,7 @@ namespace WebCore {
{
// initializeJSFunction can trigger code that deletes this event listener
// before we're done. It should always return 0 in this case.
RefPtr<JSEventListener> protect(const_cast<JSEventListener*>(this));
Ref<JSEventListener> protect(const_cast<JSEventListener&>(*this));
JSC::Strong<JSC::JSObject> wrapper(*m_isolatedWorld->vm(), m_wrapper.get());
if (!m_jsFunction) {
......
......@@ -34,6 +34,7 @@
#include <runtime/JSGlobalObject.h>
#include <wtf/HashCountedSet.h>
#include <wtf/HashSet.h>
#include <wtf/Ref.h>
#include <wtf/StdLibExtras.h>
namespace JSC { namespace Bindings {
......@@ -201,7 +202,7 @@ void RootObject::finalize(JSC::Handle<JSC::Unknown> handle, void*)
{
RuntimeObject* object = static_cast<RuntimeObject*>(handle.get().asCell());
RefPtr<RootObject> protect(this);
Ref<RootObject> protect(*this);
object->invalidate();
weakRemove(m_runtimeObjects, object, object);
}
......
......@@ -50,6 +50,7 @@
#include "StyleResolver.h"
#include "StyleRule.h"
#include "WebKitFontFamilyNames.h"
#include <wtf/Ref.h>
#include <wtf/text/AtomicString.h>
#if ENABLE(SVG)
......@@ -598,7 +599,7 @@ void CSSFontSelector::beginLoadTimerFired(Timer<WebCore::CSSFontSelector>*)
fontsToBeginLoading.swap(m_fontsToBeginLoading);
// CSSFontSelector could get deleted via beginLoadIfNeeded() or loadDone() unless protected.
RefPtr<CSSFontSelector> protect(this);
Ref<CSSFontSelector> protect(*this);
CachedResourceLoader* cachedResourceLoader = m_document->cachedResourceLoader();
for (size_t i = 0; i < fontsToBeginLoading.size(); ++i) {
......
......@@ -34,6 +34,7 @@
#include "StyleRule.h"
#include "StyleRuleImport.h"
#include <wtf/Deque.h>
#include <wtf/Ref.h>
namespace WebCore {
......@@ -341,12 +342,10 @@ void StyleSheetContents::checkLoaded()
if (isLoading())
return;
RefPtr<StyleSheetContents> protect(this);
// Avoid |this| being deleted by scripts that run via
// ScriptableDocumentParser::executeScriptsWaitingForStylesheets().
// See <rdar://problem/6622300>.
RefPtr<StyleSheetContents> protector(this);
Ref<StyleSheetContents> protect(*this);
StyleSheetContents* parentSheet = parentStyleSheet();
if (parentSheet) {
parentSheet->checkLoaded();
......
......@@ -35,6 +35,7 @@
#include "StyleInheritedData.h"
#include "Text.h"
#include "TextBreakIterator.h"
#include <wtf/Ref.h>
using namespace std;
......@@ -46,7 +47,7 @@ void CharacterData::setData(const String& data, ExceptionCode&)
if (m_data == nonNullData)
return;
RefPtr<CharacterData> protect = this;
Ref<CharacterData> protect(*this);
unsigned oldLength = length();
......
......@@ -55,6 +55,7 @@
#include "TemplateContentDocumentFragment.h"
#include "Text.h"
#include <wtf/CurrentTime.h>
#include <wtf/Ref.h>
#include <wtf/Vector.h>
#if ENABLE(DELETION_UI)
......@@ -262,7 +263,7 @@ bool ContainerNode::insertBefore(PassRefPtr<Node> newChild, Node* refChild, Exce
// If it is, it can be deleted as a side effect of sending mutation events.
ASSERT(refCount() || parentOrShadowHostNode());
RefPtr<Node> protect(this);
Ref<ContainerNode> protect(*this);
ec = 0;
......@@ -403,7 +404,7 @@ bool ContainerNode::replaceChild(PassRefPtr<Node> newChild, Node* oldChild, Exce
// If it is, it can be deleted as a side effect of sending mutation events.
ASSERT(refCount() || parentOrShadowHostNode());
RefPtr<Node> protect(this);
Ref<ContainerNode> protect(*this);
ec = 0;
......@@ -526,7 +527,7 @@ bool ContainerNode::removeChild(Node* oldChild, ExceptionCode& ec)
// If it is, it can be deleted as a side effect of sending mutation events.
ASSERT(refCount() || parentOrShadowHostNode());
RefPtr<Node> protect(this);
Ref<ContainerNode> protect(*this);
ec = 0;
......@@ -637,7 +638,7 @@ void ContainerNode::removeChildren()
return;
// The container node can be removed from event handlers.
RefPtr<ContainerNode> protect(this);
Ref<ContainerNode> protect(*this);
// exclude this node when looking for removed focusedNode since only children will be removed
document().removeFocusedNodeOfSubtree(this, true);
......@@ -648,7 +649,7 @@ void ContainerNode::removeChildren()
// Do any prep work needed before actually starting to detach
// and remove... e.g. stop loading frames, fire unload events.
willRemoveChildren(protect.get());
willRemoveChildren(this);
NodeVector removedChildren;
{
......@@ -674,7 +675,7 @@ void ContainerNode::removeChildren()
bool ContainerNode::appendChild(PassRefPtr<Node> newChild, ExceptionCode& ec, AttachBehavior attachBehavior)
{
RefPtr<ContainerNode> protect(this);
Ref<ContainerNode> protect(*this);
// Check that this node is not "floating".
// If it is, it can be deleted as a side effect of sending mutation events.
......@@ -777,7 +778,7 @@ void ContainerNode::suspendPostAttachCallbacks()
void ContainerNode::resumePostAttachCallbacks()
{
if (s_attachDepth == 1) {
RefPtr<ContainerNode> protect(this);
Ref<ContainerNode> protect(*this);
if (s_postAttachCallbackQueue)
dispatchPostAttachCallbacks();
......
......@@ -30,6 +30,7 @@
#include "NodeTraversal.h"
#include "ShadowRoot.h"
#include <wtf/Assertions.h>
#include <wtf/Ref.h>
namespace WebCore {
......@@ -183,7 +184,7 @@ namespace Private {
tail = n;
} else {
RefPtr<GenericNode> protect(n); // removedFromDocument may remove remove all references to this node.
Ref<GenericNode> protect(*n); // removedFromDocument may remove remove all references to this node.
NodeRemovalDispatcher<GenericNode, GenericNodeContainer, ShouldDispatchRemovalNotification<GenericNode>::value>::dispatch(n, container);
}
}
......@@ -196,7 +197,7 @@ namespace Private {
inline void ChildNodeInsertionNotifier::notifyNodeInsertedIntoDocument(Node* node)
{
ASSERT(m_insertionPoint->inDocument());
RefPtr<Node> protect(node);
Ref<Node> protect(*node);
if (Node::InsertionShouldCallDidNotifySubtreeInsertions == node->insertedInto(m_insertionPoint))
m_postInsertionNotificationTargets.append(node);
if (node->isContainerNode())
......@@ -221,8 +222,8 @@ inline void ChildNodeInsertionNotifier::notify(Node* node)
InspectorInstrumentation::didInsertDOMNode(&node->document(), node);
#endif
RefPtr<Document> protectDocument(&node->document());
RefPtr<Node> protectNode(node);
Ref<Document> protectDocument(node->document());
Ref<Node> protectNode(*node);
if (m_insertionPoint->inDocument())
notifyNodeInsertedIntoDocument(node);
......
......@@ -165,6 +165,7 @@
#include <wtf/CurrentTime.h>
#include <wtf/MainThread.h>
#include <wtf/PassRefPtr.h>
#include <wtf/Ref.h>
#include <wtf/TemporaryChange.h>
#include <wtf/text/StringBuffer.h>
......@@ -2372,7 +2373,7 @@ void Document::implicitClose()
return;
// Call to dispatchWindowLoadEvent can blow us from underneath.
RefPtr<Document> protect(this);
Ref<Document> protect(*this);
m_processingLoadEvent = true;
......@@ -5322,7 +5323,7 @@ void Document::fullScreenChangeDelayTimerFired(Timer<Document>*)
// Since we dispatch events in this function, it's possible that the
// document will be detached and GC'd. We protect it here to make sure we
// can finish the function successfully.
RefPtr<Document> protectDocument(this);
Ref<Document> protect(*this);
Deque<RefPtr<Node> > changeQueue;
m_fullScreenChangeEventTargetQueue.swap(changeQueue);
Deque<RefPtr<Node> > errorQueue;
......
......@@ -34,6 +34,7 @@
#include "RuntimeApplicationChecks.h"
#include "ScriptExecutionContext.h"
#include "SuspendableTimer.h"
#include <wtf/Ref.h>
namespace WebCore {
......@@ -135,7 +136,7 @@ void DocumentEventQueue::pendingEventTimerFired()
bool wasAdded = m_queuedEvents.add(0).isNewEntry;
ASSERT_UNUSED(wasAdded, wasAdded); // It should not have already been in the list.
RefPtr<DocumentEventQueue> protector(this);
Ref<DocumentEventQueue> protect(*this);
while (!m_queuedEvents.isEmpty()) {
ListHashSet<RefPtr<Event>, 16>::iterator iter = m_queuedEvents.begin();
......
......@@ -38,6 +38,7 @@
#include "ScriptController.h"
#include "WebKitTransitionEvent.h"
#include <wtf/MainThread.h>
#include <wtf/Ref.h>
#include <wtf/StdLibExtras.h>
#include <wtf/Vector.h>
......@@ -240,7 +241,7 @@ bool EventTarget::fireEventListeners(Event* event)
void EventTarget::fireEventListeners(Event* event, EventTargetData* d, EventListenerVector& entry)
{
RefPtr<EventTarget> protect = this;
Ref<EventTarget> protect(*this);
// Fire all listeners registered for this event. Don't fire listeners removed during event dispatch.
// Also, don't fire event listeners added during event dispatch. Conveniently, all new event listeners will be added
......
......@@ -2180,7 +2180,7 @@ bool Node::dispatchBeforeLoadEvent(const String& sourceURL)
if (!document().hasListenerType(Document::BEFORELOAD_LISTENER))
return true;
RefPtr<Node> protector(this);
Ref<Node> protect(*this);
RefPtr<BeforeLoadEvent> beforeLoadEvent = BeforeLoadEvent::create(sourceURL);
dispatchEvent(beforeLoadEvent.get());
return !beforeLoadEvent->defaultPrevented();
......
......@@ -38,6 +38,7 @@
#include "WorkerGlobalScope.h"
#include "WorkerThread.h"
#include <wtf/MainThread.h>
#include <wtf/Ref.h>
// FIXME: This is a layering violation.
#include "JSDOMWindow.h"
......@@ -123,7 +124,7 @@ void ScriptExecutionContext::processMessagePortMessagesSoon()
void ScriptExecutionContext::dispatchMessagePortEvents()
{
RefPtr<ScriptExecutionContext> protect(this);
Ref<ScriptExecutionContext> protect(*this);
// Make a frozen copy.
Vector<MessagePort*> ports;
......
......@@ -34,6 +34,7 @@
#include "InspectorInstrumentation.h"
#include "RequestAnimationFrameCallback.h"
#include "Settings.h"
#include <wtf/Ref.h>
#if USE(REQUEST_ANIMATION_FRAME_TIMER)
#include <algorithm>
......@@ -140,7 +141,7 @@ void ScriptedAnimationController::serviceScriptedAnimations(double monotonicTime
// Invoking callbacks may detach elements from our document, which clears the document's
// reference to us, so take a defensive reference.
RefPtr<ScriptedAnimationController> protector(this);
Ref<ScriptedAnimationController> protect(*this);
for (size_t i = 0; i < callbacks.size(); ++i) {
RequestAnimationFrameCallback* callback = callbacks[i].get();
......
......@@ -37,6 +37,7 @@
#include "RenderEmbeddedObject.h"
#include "RenderWidget.h"
#include "Settings.h"
#include <wtf/Ref.h>
namespace WebCore {
......@@ -154,7 +155,7 @@ void HTMLEmbedElement::updateWidget(PluginCreationOption pluginCreationOption)
Vector<String> paramValues;
parametersForPlugin(paramNames, paramValues);
RefPtr<HTMLEmbedElement> protect(this); // Loading the plugin might remove us from the document.
Ref<HTMLEmbedElement> protect(*this); // Loading the plugin might remove us from the document.
bool beforeLoadAllowedLoad = guardedDispatchBeforeLoadEvent(m_url);
if (!beforeLoadAllowedLoad) {
if (document().isPluginDocument()) {
......
......@@ -41,6 +41,7 @@
#include "ScriptEventListener.h"
#include "ValidationMessage.h"
#include "ValidityState.h"
#include <wtf/Ref.h>
#include <wtf/Vector.h>
namespace WebCore {
......@@ -413,10 +414,10 @@ bool HTMLFormControlElement::checkValidity(Vector<RefPtr<FormAssociatedElement>
if (!willValidate() || isValidFormControlElement())
return true;
// An event handler can deref this object.
RefPtr<HTMLFormControlElement> protector(this);
RefPtr<Document> originalDocument(&document());
Ref<HTMLFormControlElement> protect(*this);
Ref<Document> originalDocument(document());
bool needsDefaultAction = dispatchEvent(Event::create(eventNames().invalidEvent, false, true));
if (needsDefaultAction && unhandledInvalidControls && inDocument() && originalDocument == &document())
if (needsDefaultAction && unhandledInvalidControls && inDocument() && &originalDocument.get() == &document())
unhandledInvalidControls->append(this);
return false;
}
......
......@@ -47,6 +47,7 @@
#include "ScriptEventListener.h"
#include "Settings.h"
#include <limits>
#include <wtf/Ref.h>
using namespace std;
......@@ -227,7 +228,7 @@ bool HTMLFormElement::validateInteractively(Event* event)
// has !renderer()->needsLayout() assertion.
document().updateLayoutIgnorePendingStylesheets();
RefPtr<HTMLFormElement> protector(this);
Ref<HTMLFormElement> protect(*this);
// Focus on the first focusable control and show a validation message.
for (unsigned i = 0; i < unhandledInvalidControls.size(); ++i) {
FormAssociatedElement* unhandledAssociatedElement = unhandledInvalidControls[i].get();
......@@ -595,7 +596,7 @@ bool HTMLFormElement::checkValidity()
bool HTMLFormElement::checkInvalidControlsAndCollectUnhandled(Vector<RefPtr<FormAssociatedElement> >& unhandledInvalidControls)
{
RefPtr<HTMLFormElement> protector(this);
Ref<HTMLFormElement> protect(*this);
// Copy m_associatedElements because event handlers called from
// HTMLFormControlElement::checkValidity() might change m_associatedElements.
Vector<RefPtr<FormAssociatedElement> > elements;
......