CFXJS_ObjDefinition's lifetime must match isolate.
Introduced at https://codereview.chromium.org/1424933013/
The v8 objects are 1:1 with the context being destroyed in
FXJS_ReleaseRuntime, but the CFXJS_ObjDefinitions are still
1:1 with the isolate, so they can't be destroyed until the
refcounts hit zero.
BUG=561184
R=jochen@chromium.org
Review URL: https://codereview.chromium.org/1468423004 .
diff --git a/fpdfsdk/src/jsapi/fxjs_v8.cpp b/fpdfsdk/src/jsapi/fxjs_v8.cpp
index 4e069d5..ed8e2e8 100644
--- a/fpdfsdk/src/jsapi/fxjs_v8.cpp
+++ b/fpdfsdk/src/jsapi/fxjs_v8.cpp
@@ -351,12 +351,14 @@
pObjDef->m_pDestructor(pObj);
FXJS_FreePrivate(pObj);
}
- delete pObjDef;
}
if (pIsolate == g_isolate && --g_isolate_ref_count > 0)
return;
+ for (int i = 0; i < maxID; ++i)
+ delete CFXJS_ObjDefinition::ForID(pIsolate, i);
+
pIsolate->SetData(g_embedderDataSlot, nullptr);
delete pData;
}