Changeset 185277 in webkit for trunk/Source/JavaScriptCore/jsc.cpp

Timestamp:

Jun 5, 2015, 5:33:43 PM (10 years ago)

Author:

[email protected]

Message:

Subclasses of JSNonFinalObject with gc'able children need to implement visitChildren().
​https://bugs.webkit.org/show_bug.cgi?id=145709

Reviewed by Geoffrey Garen.

• jsc.cpp:

(functionSetElementRoot):

• The Element class has a member of type Root which extends JSDestructibleObject. It should be stored in a WriteBarrier, and visited by visitChildren().

• runtime/ClonedArguments.cpp:

(JSC::ClonedArguments::materializeSpecialsIfNecessary):
(JSC::ClonedArguments::visitChildren):

• runtime/ClonedArguments.h:
• Add missing visitChildren().

• tests/stress/cloned-arguments-should-visit-callee-during-gc.js: Added.

(makeTransientFunction.transientFunc):
(makeTransientFunction):

File:

• trunk/Source/JavaScriptCore/jsc.cpp (modified) (5 diffs)

trunk/Source/JavaScriptCore/jsc.cpp

@@ -131 +131 @@
 class Element : public JSNonFinalObject {
 public:
-    Element(VM& vm, Structure* structure, Root* root)
+    Element(VM& vm, Structure* structure)
         : Base(vm, structure)
-        , m_root(root)
     {
     }
@@ -140 +139 @@
     static const bool needsDestruction = false;
 
-    Root* root() const { return m_root; }
-    void setRoot(Root* root) { m_root = root; }
+    Root* root() const { return m_root.get(); }
+    void setRoot(VM& vm, Root* root) { m_root.set(vm, this, root); }
 
     static Element* create(VM& vm, JSGlobalObject* globalObject, Root* root)
     {
         Structure* structure = createStructure(vm, globalObject, jsNull());
-        Element* element = new (NotNull, allocateCell<Element>(vm.heap, sizeof(Element))) Element(vm, structure, root);
-        element->finishCreation(vm);
+        Element* element = new (NotNull, allocateCell<Element>(vm.heap, sizeof(Element))) Element(vm, structure);
+        element->finishCreation(vm, root);
         return element;
     }
 
-    void finishCreation(VM&);
+    void finishCreation(VM&, Root*);
+
+    static void visitChildren(JSCell* cell, SlotVisitor& visitor)
+    {
+        Element* thisObject = jsCast<Element*>(cell);
+        ASSERT_GC_OBJECT_INHERITS(thisObject, info());
+        Base::visitChildren(thisObject, visitor);
+        visitor.append(&thisObject->m_root);
+    }
 
     static ElementHandleOwner* handleOwner();
@@ -163 +170 @@
 
 private:
-    Root* m_root;
+    WriteBarrier<Root> m_root;
 };
 
@@ -422 +429 @@
 }
 
-void Element::finishCreation(VM& vm)
+void Element::finishCreation(VM& vm, Root* root)
 {
     Base::finishCreation(vm);
+    setRoot(vm, root);
     m_root->setElement(this);
 }
@@ -787 +795 @@
     Element* element = jsCast<Element*>(exec->argument(0));
     Root* root = jsCast<Root*>(exec->argument(1));
-    element->setRoot(root);
+    element->setRoot(exec->vm(), root);
     return JSValue::encode(jsUndefined());
 }