Changeset 191350 in webkit for trunk/Source/JavaScriptCore/jit/GCAwareJITStubRoutine.cpp

Timestamp:

Oct 20, 2015, 11:37:38 AM (10 years ago)

Author:

[email protected]

Message:

GCAwareJITStubRoutineWithExceptionHandler has a stale CodeBlock pointer in its destructor
​https://bugs.webkit.org/show_bug.cgi?id=150351

Reviewed by Mark Lam.

We may regenerate many GCAwareJITStubRoutineWithExceptionHandler stubs per one PolymorphicAccess.
Only the last GCAwareJITStubRoutineWithExceptionHandler stub that was generated will get the CodeBlock's aboutToDie()
notification. All other GCAwareJITStubRoutineWithExceptionHandler stubs will still be holding a stale CodeBlock pointer
that they will use in their destructor. The solution is to have GCAwareJITStubRoutineWithExceptionHandler remove its
exception handler in observeZeroRefCount() instead of its destructor. observeZeroRefCount() will run when a PolymorphicAccess
replaces its m_stubRoutine.

• jit/GCAwareJITStubRoutine.cpp:

(JSC::GCAwareJITStubRoutineWithExceptionHandler::aboutToDie):
(JSC::GCAwareJITStubRoutineWithExceptionHandler::observeZeroRefCount):
(JSC::createJITStubRoutine):
(JSC::GCAwareJITStubRoutineWithExceptionHandler::~GCAwareJITStubRoutineWithExceptionHandler): Deleted.

• jit/GCAwareJITStubRoutine.h:

File:

• trunk/Source/JavaScriptCore/jit/GCAwareJITStubRoutine.cpp (modified) (1 diff)

trunk/Source/JavaScriptCore/jit/GCAwareJITStubRoutine.cpp

@@ -114 +114 @@
 }
 
-GCAwareJITStubRoutineWithExceptionHandler::~GCAwareJITStubRoutineWithExceptionHandler()
+void GCAwareJITStubRoutineWithExceptionHandler::observeZeroRefCount()
 {
     if (m_codeBlockWithExceptionHandler) {
         m_codeBlockWithExceptionHandler->jitCode()->dfgCommon()->removeCallSiteIndex(m_exceptionHandlerCallSiteIndex);
         m_codeBlockWithExceptionHandler->removeExceptionHandlerForCallSite(m_exceptionHandlerCallSiteIndex);
+        m_codeBlockWithExceptionHandler = nullptr;
     }
+
+    Base::observeZeroRefCount();
 }
-    
+
 
 PassRefPtr<JITStubRoutine> createJITStubRoutine(