Changeset 190113 in webkit for trunk/Source/JavaScriptCore/heap/WeakSetInlines.h

Timestamp:

Sep 22, 2015, 5:21:31 AM (10 years ago)

Author:

[email protected]

Message:

Unreviewed, rolling out r189616.
​https://bugs.webkit.org/show_bug.cgi?id=149456

suspected cause of multiple regressions (Requested by kling on
#webkit).

Reverted changeset:

"[JSC] Weak should only accept cell pointees."
​https://bugs.webkit.org/show_bug.cgi?id=148955
​http://trac.webkit.org/changeset/189616

File:

• trunk/Source/JavaScriptCore/heap/WeakSetInlines.h (modified) (3 diffs)

trunk/Source/JavaScriptCore/heap/WeakSetInlines.h

@@ -31 +31 @@
 namespace JSC {
 
-inline WeakImpl* WeakSet::allocate(JSCell& cell, WeakHandleOwner* weakHandleOwner, void* context)
+inline WeakImpl* WeakSet::allocate(JSValue jsValue, WeakHandleOwner* weakHandleOwner, void* context)
 {
-    WeakSet& weakSet = MarkedBlock::blockFor(&cell)->weakSet();
+    WeakSet& weakSet = MarkedBlock::blockFor(jsValue.asCell())->weakSet();
     WeakBlock::FreeCell* allocator = weakSet.m_allocator;
     if (UNLIKELY(!allocator))
@@ -40 +40 @@
 
     WeakImpl* weakImpl = WeakBlock::asWeakImpl(allocator);
-    return new (NotNull, weakImpl) WeakImpl(cell, weakHandleOwner, context);
+    return new (NotNull, weakImpl) WeakImpl(jsValue, weakHandleOwner, context);
 }
 
@@ -50 +50 @@
     if (!weakHandleOwner)
         return;
-    weakHandleOwner->finalize(weakImpl->m_cell, weakImpl->context());
+    weakHandleOwner->finalize(Handle<Unknown>::wrapSlot(&const_cast<JSValue&>(weakImpl->jsValue())), weakImpl->context());
 }