Merge 103979 - v8 binding: npCreateV8ScriptObject() should not returned an existing V8NPObject if...

Source/WebCore/bindings/v8/NPV8Object.cpp

 /*
  * Copyright (C) 2004, 2006 Apple Computer, Inc.  All rights reserved.
  * Copyright (C) 2007, 2008, 2009 Google, Inc.  All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  * 1. Redistributions of source code must retain the above copyright
  *    notice, this list of conditions and the following disclaimer.
  * 2. Redistributions in binary form must reproduce the above copyright
@@ skipping 39 matching lines @@
 using namespace WebCore;
 
 namespace WebCore {
 
 WrapperTypeInfo* npObjectTypeInfo()
 {
     static WrapperTypeInfo typeInfo = { 0, 0, 0, 0 };
     return &typeInfo;
 }
 
-typedef HashMap<int, V8NPObject*> V8NPObjectMap;
+typedef Vector<V8NPObject*> V8NPObjectVector;
+typedef HashMap<int, V8NPObjectVector> V8NPObjectMap;
 
 static V8NPObjectMap* staticV8NPObjectMap()
 {
     DEFINE_STATIC_LOCAL(V8NPObjectMap, v8npObjectMap, ());
     return &v8npObjectMap;
 }
 
 // FIXME: Comments on why use malloc and free.
 static NPObject* allocV8NPObject(NPP, NPClass*)
 {
     return static_cast<NPObject*>(malloc(sizeof(V8NPObject)));
 }
 
 static void freeV8NPObject(NPObject* npObject)
 {
     V8NPObject* v8NpObject = reinterpret_cast<V8NPObject*>(npObject);
     if (int v8ObjectHash = v8NpObject->v8Object->GetIdentityHash()) {
-        ASSERT(staticV8NPObjectMap()->contains(v8ObjectHash));
-        staticV8NPObjectMap()->remove(v8ObjectHash);
+        V8NPObjectMap::iterator iter = staticV8NPObjectMap()->find(v8ObjectHash);
+        if (iter != staticV8NPObjectMap()->end()) {
+            V8NPObjectVector& objects = iter->second;
+            for (size_t index = 0; index < objects.size(); ++index) {
+                if (objects.at(index) == v8NpObject) {
+                    objects.remove(index);
+                    break;
+                }
+            }
+            if (objects.isEmpty())
+                staticV8NPObjectMap()->remove(v8ObjectHash);
+        } else
+            ASSERT_NOT_REACHED();
     } else {
         ASSERT(!v8::Context::InContext());
         staticV8NPObjectMap()->clear();
     }
 
 #ifndef NDEBUG
     V8GCController::unregisterGlobalHandle(v8NpObject, v8NpObject->v8Object);
 #endif
     v8NpObject->v8Object.Dispose();
     free(v8NpObject);
@@ skipping 42 matching lines @@
         if (typeInfo == npObjectTypeInfo()) {
 
             NPObject* returnValue = v8ObjectToNPObject(object);
             _NPN_RetainObject(returnValue);
             return returnValue;
         }
     }
 
     int v8ObjectHash = object->GetIdentityHash();
     ASSERT(v8ObjectHash);
-    if (staticV8NPObjectMap()->contains(v8ObjectHash)) {
-        V8NPObject* v8npObject = staticV8NPObjectMap()->get(v8ObjectHash);
-        ASSERT(v8npObject->v8Object == object);
-        _NPN_RetainObject(&v8npObject->object);
-        return reinterpret_cast<NPObject*>(v8npObject);
+    V8NPObjectMap::iterator iter = staticV8NPObjectMap()->find(v8ObjectHash);
+    if (iter != staticV8NPObjectMap()->end()) {
+        V8NPObjectVector& objects = iter->second;
+        for (size_t index = 0; index < objects.size(); ++index) {
+            V8NPObject* v8npObject = objects.at(index);
+            if (v8npObject->rootObject == root) {
+                ASSERT(v8npObject->v8Object == object);
+                _NPN_RetainObject(&v8npObject->object);
+                return reinterpret_cast<NPObject*>(v8npObject);
+            }
+        }
+    } else {
+        iter = staticV8NPObjectMap()->set(v8ObjectHash, V8NPObjectVector()).first; 
     }
 
     V8NPObject* v8npObject = reinterpret_cast<V8NPObject*>(_NPN_CreateObject(npp, &V8NPObjectClass));
     v8npObject->v8Object = v8::Persistent<v8::Object>::New(object);
 #ifndef NDEBUG
     V8GCController::registerGlobalHandle(NPOBJECT, v8npObject, v8npObject->v8Object);
 #endif
     v8npObject->rootObject = root;
 
-    staticV8NPObjectMap()->set(v8ObjectHash, v8npObject);
+    iter->second.append(v8npObject);
 
     return reinterpret_cast<NPObject*>(v8npObject);
 }
 
 } // namespace WebCore
 
 bool _NPN_Invoke(NPP npp, NPObject* npObject, NPIdentifier methodName, const NPVariant* arguments, uint32_t argumentCount, NPVariant* result)
 {
     if (!npObject)
         return false;
@@ skipping 397 matching lines @@
 
         convertV8ObjectToNPVariant(resultObject, npObject, result);
         return true;
     }
 
     if (NP_CLASS_STRUCT_VERSION_HAS_CTOR(npObject->_class) && npObject->_class->construct)
         return npObject->_class->construct(npObject, arguments, argumentCount, result);
 
     return false;
 }