Changeset 190113 in webkit for trunk/Source/JavaScriptCore/heap/Heap.cpp

Timestamp:

Sep 22, 2015, 5:21:31 AM (10 years ago)

Author:

[email protected]

Message:

Unreviewed, rolling out r189616.
​https://bugs.webkit.org/show_bug.cgi?id=149456

suspected cause of multiple regressions (Requested by kling on
#webkit).

Reverted changeset:

"[JSC] Weak should only accept cell pointees."
​https://bugs.webkit.org/show_bug.cgi?id=148955
​http://trac.webkit.org/changeset/189616

File:

• trunk/Source/JavaScriptCore/heap/Heap.cpp (modified) (1 diff)

trunk/Source/JavaScriptCore/heap/Heap.cpp

@@ -1359 +1359 @@
 void Heap::addFinalizer(JSCell* cell, Finalizer finalizer)
 {
-    WeakSet::allocate(*cell, &m_finalizerOwner, reinterpret_cast<void*>(finalizer)); // Balanced by FinalizerOwner::finalize().
-}
-
-void Heap::FinalizerOwner::finalize(JSCell*& cell, void* context)
-{
+    WeakSet::allocate(cell, &m_finalizerOwner, reinterpret_cast<void*>(finalizer)); // Balanced by FinalizerOwner::finalize().
+}
+
+void Heap::FinalizerOwner::finalize(Handle<Unknown> handle, void* context)
+{
+    HandleSlot slot = handle.slot();
     Finalizer finalizer = reinterpret_cast<Finalizer>(context);
-    finalizer(cell);
-    WeakSet::deallocate(WeakImpl::asWeakImpl(&cell));
+    finalizer(slot->asCell());
+    WeakSet::deallocate(WeakImpl::asWeakImpl(slot));
 }