Changeset 190113 in webkit for trunk/Source/JavaScriptCore/heap/WeakBlock.cpp

Timestamp:

Sep 22, 2015, 5:21:31 AM (10 years ago)

Author:

[email protected]

Message:

Unreviewed, rolling out r189616.
​https://bugs.webkit.org/show_bug.cgi?id=149456

suspected cause of multiple regressions (Requested by kling on
#webkit).

Reverted changeset:

"[JSC] Weak should only accept cell pointees."
​https://bugs.webkit.org/show_bug.cgi?id=148955
​http://trac.webkit.org/changeset/189616

File:

• trunk/Source/JavaScriptCore/heap/WeakBlock.cpp (modified) (3 diffs)

trunk/Source/JavaScriptCore/heap/WeakBlock.cpp

@@ -113 +113 @@
             continue;
 
-        if (m_markedBlock->isMarkedOrNewlyAllocated(weakImpl->m_cell))
+        const JSValue& jsValue = weakImpl->jsValue();
+        if (m_markedBlock->isMarkedOrNewlyAllocated(jsValue.asCell()))
             continue;
 
@@ -120 +121 @@
             continue;
 
-        if (!weakHandleOwner->isReachableFromOpaqueRoots(*weakImpl->m_cell, weakImpl->context(), visitor))
+        if (!weakHandleOwner->isReachableFromOpaqueRoots(Handle<Unknown>::wrapSlot(&const_cast<JSValue&>(jsValue)), weakImpl->context(), visitor))
             continue;
 
-        heapRootVisitor.visit(&weakImpl->m_cell);
+        heapRootVisitor.visit(&const_cast<JSValue&>(jsValue));
     }
 }
@@ -144 +145 @@
             continue;
 
-        if (m_markedBlock->isMarkedOrNewlyAllocated(weakImpl->cell())) {
+        if (m_markedBlock->isMarkedOrNewlyAllocated(weakImpl->jsValue().asCell())) {
             ASSERT(weakImpl->state() == WeakImpl::Live);
             continue;