Changeset 160822 in webkit for trunk/Source/JavaScriptCore/runtime/JSCellInlines.h

Timestamp:

Dec 18, 2013, 8:30:02 PM (12 years ago)

Author:

[email protected]

Message:

DelayedReleaseScope is in the wrong place
​https://bugs.webkit.org/show_bug.cgi?id=125876

Reviewed by Geoffrey Garen.

The DelayedReleaseScope needs to be around the free list sweeping in MarkedAllocator::tryAllocateHelper.
This location gives us a good safe point between getting ready to allocate (i.e. identifying a non-empty
free list) and doing the actual allocation (popping the free list).

• heap/MarkedAllocator.cpp:

(JSC::MarkedAllocator::tryAllocateHelper):
(JSC::MarkedAllocator::allocateSlowCase):
(JSC::MarkedAllocator::addBlock):

• runtime/JSCellInlines.h:

(JSC::allocateCell):

File:

• trunk/Source/JavaScriptCore/runtime/JSCellInlines.h (modified) (2 diffs)

trunk/Source/JavaScriptCore/runtime/JSCellInlines.h

@@ -89 +89 @@
     ASSERT(!DisallowGC::isGCDisallowedOnCurrentThread());
     ASSERT(size >= sizeof(T));
-#if ENABLE(GC_VALIDATION)
-    ASSERT(!heap.vm()->isInitializingObject());
-    heap.vm()->setInitializingObjectClass(T::info());
-#endif
     JSCell* result = 0;
     if (T::needsDestruction && T::hasImmortalStructure)
@@ -100 +96 @@
     else 
         result = static_cast<JSCell*>(heap.allocateWithoutDestructor(size));
+#if ENABLE(GC_VALIDATION)
+    ASSERT(!heap.vm()->isInitializingObject());
+    heap.vm()->setInitializingObjectClass(T::info());
+#endif
     result->clearStructure();
     return result;