Changeset 118856 in webkit for trunk/Source/JavaScriptCore/runtime/WeakGCMap.h

Timestamp:

May 29, 2012, 4:40:26 PM (13 years ago)

Author:

[email protected]

Message:

WeakGCMap should be lazy-finalization-safe
​https://bugs.webkit.org/show_bug.cgi?id=87784

Reviewed by Darin Adler.

• runtime/WeakGCMap.h:

(JSC::WeakGCMap::get): Since this is a map of raw WeakImpl pointers, and
not Weak<T>, we need to verify manually that the WeakImpl is live before
we return its payload.

File:

• trunk/Source/JavaScriptCore/runtime/WeakGCMap.h (modified) (1 diff)

trunk/Source/JavaScriptCore/runtime/WeakGCMap.h

@@ -70 +70 @@
     ExternalType get(const KeyType& key) const
     {
-        return HandleTypes<MappedType>::getFromSlot(const_cast<JSValue*>(&m_map.get(key)->jsValue()));
+        WeakImpl* impl = m_map.get(key);
+        if (!impl || impl->state() != WeakImpl::Live)
+            return ExternalType();
+        return HandleTypes<MappedType>::getFromSlot(const_cast<JSValue*>(&impl->jsValue()));
     }