Changeset 189616 in webkit for trunk/Source/JavaScriptCore/heap/WeakImpl.h

Timestamp:

Sep 11, 2015, 2:16:37 AM (10 years ago)

Author:

[email protected]

Message:

[JSC] Weak should only accept cell pointees.
<​https://webkit.org/b/148955>

Reviewed by Geoffrey Garen.

Source/JavaScriptCore:

Since WeakImpls only support pointing to JSCell derived objects,
enforce that at compile time by having the API use JSCell* instead of JSValue.

WeakHandleOwner callbacks now get JSCell& and JSCell*& respectively instead
of wrapping the cell pointer in a Handle<Unknown>.

Also added a static_assert so Weak<T> can't be instantiated with a T that's
not convertible to JSCell.

• API/JSAPIWrapperObject.mm:

(JSAPIWrapperObjectHandleOwner::finalize):
(JSAPIWrapperObjectHandleOwner::isReachableFromOpaqueRoots):
(JSC::JSAPIWrapperObject::finishCreation):

• API/JSManagedValue.mm:

(JSManagedValueHandleOwner::isReachableFromOpaqueRoots):
(JSManagedValueHandleOwner::finalize):

• builtins/BuiltinExecutables.cpp:

(JSC::BuiltinExecutables::finalize):

• builtins/BuiltinExecutables.h:
• heap/Heap.cpp:

(JSC::Heap::addFinalizer):
(JSC::Heap::FinalizerOwner::finalize):

• heap/Heap.h:
• heap/WeakBlock.cpp:

(JSC::WeakBlock::visit):
(JSC::WeakBlock::reap):

• heap/WeakHandleOwner.cpp:

(JSC::WeakHandleOwner::isReachableFromOpaqueRoots):
(JSC::WeakHandleOwner::finalize):

• heap/WeakHandleOwner.h:
• heap/WeakImpl.h:

(JSC::WeakImpl::WeakImpl):
(JSC::WeakImpl::state):
(JSC::WeakImpl::cell):
(JSC::WeakImpl::asWeakImpl):
(JSC::WeakImpl::jsValue): Deleted.

• heap/WeakInlines.h:

(JSC::Weak<T>::Weak):
(JSC::>):
(JSC::Weak<T>::operator):
(JSC::Weak<T>::get):
(JSC::Weak<T>::was):

• heap/WeakSet.h:
• heap/WeakSetInlines.h:

(JSC::WeakSet::allocate):
(JSC::WeakBlock::finalize):

• jit/JITThunks.cpp:

(JSC::JITThunks::finalize):

• jit/JITThunks.h:
• jsc.cpp:

(WTF::ElementHandleOwner::isReachableFromOpaqueRoots): Deleted.

• runtime/JSCell.h:

(JSC::jsCast):

• runtime/RegExpCache.cpp:

(JSC::RegExpCache::finalize):

• runtime/RegExpCache.h:
• runtime/Structure.cpp:

(JSC::StructureTransitionTable::singleTransition):
(JSC::StructureTransitionTable::setSingleTransition):

Source/WebCore:

Update WebCore bindings for the new Weak and Weak-related signatures.

• bindings/js/JSCSSRuleListCustom.cpp:

(WebCore::JSCSSRuleListOwner::isReachableFromOpaqueRoots):

• bindings/js/JSCSSValueCustom.cpp:

(WebCore::JSCSSValueOwner::isReachableFromOpaqueRoots):
(WebCore::JSCSSValueOwner::finalize):

• bindings/js/JSCallbackData.cpp:

(WebCore::JSCallbackDataWeak::WeakOwner::isReachableFromOpaqueRoots):

• bindings/js/JSCallbackData.h:
• bindings/js/JSMutationObserverCustom.cpp:

(WebCore::JSMutationObserverOwner::isReachableFromOpaqueRoots):

• bindings/js/JSNodeCustom.cpp:

(WebCore::isReachableFromDOM):
(WebCore::JSNodeOwner::isReachableFromOpaqueRoots):

• bindings/js/JSNodeListCustom.cpp:

(WebCore::JSNodeListOwner::isReachableFromOpaqueRoots):

• bindings/js/JSTextTrackCueCustom.cpp:

(WebCore::JSTextTrackCueOwner::isReachableFromOpaqueRoots):

• bindings/js/WebCoreTypedArrayController.cpp:

(WebCore::WebCoreTypedArrayController::JSArrayBufferOwner::isReachableFromOpaqueRoots):
(WebCore::WebCoreTypedArrayController::JSArrayBufferOwner::finalize):

• bindings/js/WebCoreTypedArrayController.h:
• bindings/scripts/CodeGeneratorJS.pm:

(GenerateHeader):
(GenerateImplementation):

• bindings/scripts/test/JS/JSTestActiveDOMObject.cpp:

(WebCore::JSTestActiveDOMObjectOwner::isReachableFromOpaqueRoots):
(WebCore::JSTestActiveDOMObjectOwner::finalize):

• bindings/scripts/test/JS/JSTestActiveDOMObject.h:
• bindings/scripts/test/JS/JSTestCustomConstructorWithNoInterfaceObject.cpp:

(WebCore::JSTestCustomConstructorWithNoInterfaceObjectOwner::isReachableFromOpaqueRoots):
(WebCore::JSTestCustomConstructorWithNoInterfaceObjectOwner::finalize):

• bindings/scripts/test/JS/JSTestCustomConstructorWithNoInterfaceObject.h:
• bindings/scripts/test/JS/JSTestCustomNamedGetter.cpp:

(WebCore::JSTestCustomNamedGetterOwner::isReachableFromOpaqueRoots):
(WebCore::JSTestCustomNamedGetterOwner::finalize):

• bindings/scripts/test/JS/JSTestCustomNamedGetter.h:
• bindings/scripts/test/JS/JSTestEventConstructor.cpp:

(WebCore::JSTestEventConstructorOwner::isReachableFromOpaqueRoots):
(WebCore::JSTestEventConstructorOwner::finalize):

• bindings/scripts/test/JS/JSTestEventConstructor.h:
• bindings/scripts/test/JS/JSTestEventTarget.cpp:

(WebCore::JSTestEventTargetOwner::isReachableFromOpaqueRoots):
(WebCore::JSTestEventTargetOwner::finalize):

• bindings/scripts/test/JS/JSTestEventTarget.h:
• bindings/scripts/test/JS/JSTestException.cpp:

(WebCore::JSTestExceptionOwner::isReachableFromOpaqueRoots):
(WebCore::JSTestExceptionOwner::finalize):

• bindings/scripts/test/JS/JSTestException.h:
• bindings/scripts/test/JS/JSTestGenerateIsReachable.cpp:

(WebCore::JSTestGenerateIsReachableOwner::isReachableFromOpaqueRoots):
(WebCore::JSTestGenerateIsReachableOwner::finalize):

• bindings/scripts/test/JS/JSTestGenerateIsReachable.h:
• bindings/scripts/test/JS/JSTestInterface.cpp:

(WebCore::JSTestInterfaceOwner::isReachableFromOpaqueRoots):
(WebCore::JSTestInterfaceOwner::finalize):

• bindings/scripts/test/JS/JSTestInterface.h:
• bindings/scripts/test/JS/JSTestMediaQueryListListener.cpp:

(WebCore::JSTestMediaQueryListListenerOwner::isReachableFromOpaqueRoots):
(WebCore::JSTestMediaQueryListListenerOwner::finalize):

• bindings/scripts/test/JS/JSTestMediaQueryListListener.h:
• bindings/scripts/test/JS/JSTestNamedConstructor.cpp:

(WebCore::JSTestNamedConstructorOwner::isReachableFromOpaqueRoots):
(WebCore::JSTestNamedConstructorOwner::finalize):

• bindings/scripts/test/JS/JSTestNamedConstructor.h:
• bindings/scripts/test/JS/JSTestNondeterministic.cpp:

(WebCore::JSTestNondeterministicOwner::isReachableFromOpaqueRoots):
(WebCore::JSTestNondeterministicOwner::finalize):

• bindings/scripts/test/JS/JSTestNondeterministic.h:
• bindings/scripts/test/JS/JSTestObj.cpp:

(WebCore::JSTestObjOwner::isReachableFromOpaqueRoots):
(WebCore::JSTestObjOwner::finalize):

• bindings/scripts/test/JS/JSTestObj.h:
• bindings/scripts/test/JS/JSTestOverloadedConstructors.cpp:

(WebCore::JSTestOverloadedConstructorsOwner::isReachableFromOpaqueRoots):
(WebCore::JSTestOverloadedConstructorsOwner::finalize):

• bindings/scripts/test/JS/JSTestOverloadedConstructors.h:
• bindings/scripts/test/JS/JSTestOverrideBuiltins.cpp:

(WebCore::JSTestOverrideBuiltinsOwner::isReachableFromOpaqueRoots):
(WebCore::JSTestOverrideBuiltinsOwner::finalize):

• bindings/scripts/test/JS/JSTestOverrideBuiltins.h:
• bindings/scripts/test/JS/JSTestSerializedScriptValueInterface.cpp:

(WebCore::JSTestSerializedScriptValueInterfaceOwner::isReachableFromOpaqueRoots):
(WebCore::JSTestSerializedScriptValueInterfaceOwner::finalize):

• bindings/scripts/test/JS/JSTestSerializedScriptValueInterface.h:
• bindings/scripts/test/JS/JSTestTypedefs.cpp:

(WebCore::JSTestTypedefsOwner::isReachableFromOpaqueRoots):
(WebCore::JSTestTypedefsOwner::finalize):

• bindings/scripts/test/JS/JSTestTypedefs.h:
• bindings/scripts/test/JS/JSattribute.cpp:

(WebCore::JSattributeOwner::isReachableFromOpaqueRoots):
(WebCore::JSattributeOwner::finalize):

• bindings/scripts/test/JS/JSattribute.h:
• bindings/scripts/test/JS/JSreadonly.cpp:

(WebCore::JSreadonlyOwner::isReachableFromOpaqueRoots):
(WebCore::JSreadonlyOwner::finalize):

• bindings/scripts/test/JS/JSreadonly.h:
• bridge/runtime_root.cpp:

(JSC::Bindings::RootObject::finalize):

• bridge/runtime_root.h:

Source/WebKit2:

• WebProcess/Plugins/Netscape/NPRuntimeObjectMap.cpp:

(WebKit::NPRuntimeObjectMap::finalize):

• WebProcess/Plugins/Netscape/NPRuntimeObjectMap.h:

File:

• trunk/Source/JavaScriptCore/heap/WeakImpl.h (modified) (4 diffs)

trunk/Source/JavaScriptCore/heap/WeakImpl.h

@@ -1 +1 @@
 /*
- * Copyright (C) 2012 Apple Inc. All rights reserved.
+ * Copyright (C) 2012-2015 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
@@ -47 +47 @@
 
     WeakImpl();
-    WeakImpl(JSValue, WeakHandleOwner*, void* context);
+    WeakImpl(JSCell&, WeakHandleOwner*, void* context);
 
-    State state();
+    State state() const;
     void setState(State);
 
-    const JSValue& jsValue();
+    JSCell* cell();
     WeakHandleOwner* weakHandleOwner();
     void* context();
 
-    static WeakImpl* asWeakImpl(JSValue*);
+    static WeakImpl* asWeakImpl(JSCell**);
 
 private:
-    const JSValue m_jsValue;
-    WeakHandleOwner* m_weakHandleOwner;
-    void* m_context;
+    friend class WeakBlock;
+
+    JSCell* m_cell { nullptr };
+    WeakHandleOwner* m_weakHandleOwner { nullptr };
+    void* m_context { nullptr };
 };
 
 inline WeakImpl::WeakImpl()
-    : m_weakHandleOwner(0)
-    , m_context(0)
 {
     setState(Deallocated);
 }
 
-inline WeakImpl::WeakImpl(JSValue jsValue, WeakHandleOwner* weakHandleOwner, void* context)
-    : m_jsValue(jsValue)
+inline WeakImpl::WeakImpl(JSCell& cell, WeakHandleOwner* weakHandleOwner, void* context)
+    : m_cell(&cell)
     , m_weakHandleOwner(weakHandleOwner)
     , m_context(context)
 {
     ASSERT(state() == Live);
-    ASSERT(m_jsValue && m_jsValue.isCell());
 }
 
-inline WeakImpl::State WeakImpl::state()
+inline WeakImpl::State WeakImpl::state() const
 {
     return static_cast<State>(reinterpret_cast<uintptr_t>(m_weakHandleOwner) & StateMask);
@@ -91 +90 @@
 }
 
-inline const JSValue& WeakImpl::jsValue()
+inline JSCell* WeakImpl::cell()
 {
-    return m_jsValue;
+    return m_cell;
 }
 
@@ -106 +105 @@
 }
 
-inline WeakImpl* WeakImpl::asWeakImpl(JSValue* slot)
+inline WeakImpl* WeakImpl::asWeakImpl(JSCell** slot)
 {
-    return reinterpret_cast_ptr<WeakImpl*>(reinterpret_cast_ptr<char*>(slot) + OBJECT_OFFSETOF(WeakImpl, m_jsValue));
+    return reinterpret_cast_ptr<WeakImpl*>(reinterpret_cast_ptr<char*>(slot));
 }