Fix memory leak caused by CSSRuleList wrapper

Accessing cssrulelist in javascript will create a new
CSSRuleList object and wrapper JS object. The wrapper
JS object will be added into hidden array in parent JS
object which is alive during the whole execution. Thus
memory leak happens (CSSRuleList in webkit, wrapper object
and weak global handle in v8).

Cherry pick 2 patches from upstream solves the problem:

http://trac.webkit.org/changeset/90949

This patch changes hidden reference from array to named
property. So new wrapper will replace old wrappper. But the
memory leak still exists because the CSSRuleList wrapper
will be added into an object group of current document. So
they will still be alive during execution.

http://trac.webkit.org/changeset/91256

This patch avoids to adding CSSRuleList wrapper into document
object group. Combined with the first patch, it can resolve
the memory leak problem.

Change-Id: Icb523db52963726f27b6c02596822cfb6e8d5049
Author: Vitaly Repeshko <vitalyr@chromium.org>
Signed-off-by: Xi Qian <xi.qian@intel.com>
Signed-off-by: Shuo Gao <shuo.gao@intel.com>
Signed-off-by: Bruce Beare <bruce.j.beare@intel.com>
Signed-off-by: Jack Ren <jack.ren@intel.com>
Author-tracking-BZ: 32630

1 files changed, 1 insertions, 1 deletions

diff --git a/Source/WebCore/bindings/scripts/test/V8/V8TestObj.cpp b/Source/WebCore/bindings/scripts/test/V8/V8TestObj.cpp
index 5884e89..8030559 100644
--- a/Source/WebCore/bindings/scripts/test/V8/V8TestObj.cpp
+++ b/Source/WebCore/bindings/scripts/test/V8/V8TestObj.cpp
@@ -75,7 +75,7 @@ static v8::Handle<v8::Value> readOnlyTestObjAttrAttrGetter(v8::Local<v8::String>
     if (wrapper.IsEmpty()) {
         wrapper = toV8(result.get());
         if (!wrapper.IsEmpty())
-            V8DOMWrapper::setHiddenReference(info.Holder(), wrapper);
+            V8DOMWrapper::setNamedHiddenReference(info.Holder(), "readOnlyTestObjAttr", wrapper);
     }
     return wrapper;
 }