fix: delay deletion of Wrappable objects (#22044)

This commit is contained in:
Cheng Zhao 2020-02-06 00:50:26 +09:00 committed by GitHub
parent dee324f79a
commit 3341a2c3b4
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23

View file

@ -5,6 +5,7 @@
#include "shell/common/gin_helper/wrappable.h"
#include "base/logging.h"
#include "base/threading/thread_task_runner_handle.h"
#include "shell/common/gin_helper/dictionary.h"
namespace gin_helper {
@ -69,8 +70,16 @@ void WrappableBase::FirstWeakCallback(
// static
void WrappableBase::SecondWeakCallback(
const v8::WeakCallbackInfo<WrappableBase>& data) {
WrappableBase* wrappable = data.GetParameter();
delete wrappable;
// Certain classes (for example api::WebContents and api::WebContentsView)
// are running JS code in the destructor, while V8 may crash when JS code
// runs inside weak callback.
//
// We work around this problem by delaying the deletion to next tick where
// garbage collection is done.
base::ThreadTaskRunnerHandle::Get()->PostNonNestableTask(
FROM_HERE,
base::BindOnce([](WrappableBase* wrappable) { delete wrappable; },
base::Unretained(data.GetParameter())));
}
namespace internal {