Changeset 164448 in webkit for trunk/Source/JavaScriptCore/heap/CopiedBlock.h

Timestamp:

Feb 20, 2014, 2:55:11 PM (11 years ago)

Author:

[email protected]

Message:

CopiedBlock::pin can call into fastFree while forbidden
​https://bugs.webkit.org/show_bug.cgi?id=128654

Reviewed by Oliver Hunt.

A FullCollection that skips copying doesn't clear the CopyWorkList of the all the surviving
CopiedBlocks because we currently only call didSurviveGC() at the beginning of FullCollections.

EdenCollections always do copying, therefore they always clear all CopyWorkLists.

The fix is to call didSurviveGC() for all surviving CopiedBlocks at the end of FullCollections
as well at the beginning.

• heap/CopiedBlock.h:

(JSC::CopiedBlock::didSurviveGC):

• heap/CopiedSpace.cpp:

(JSC::CopiedSpace::doneCopying):

File:

• trunk/Source/JavaScriptCore/heap/CopiedBlock.h (modified) (1 diff)

trunk/Source/JavaScriptCore/heap/CopiedBlock.h

@@ -148 +148 @@
 {
     checkConsistency();
+    ASSERT(isOld());
     m_liveBytes = 0;
 #ifndef NDEBUG