Changeset 213773 in webkit for trunk/Source/JavaScriptCore/runtime/Structure.cpp

Timestamp:

Mar 12, 2017, 3:56:55 PM (8 years ago)

Author:

[email protected]

Message:

Structure::willStoreValueSlow needs to keep the property table alive until the end
​https://bugs.webkit.org/show_bug.cgi?id=169520

Reviewed by Michael Saboff.

We use pointers logically interior to propertyTable after doing a GC. We need to prevent the
compiler from optimizing away pointers to propertyTable.

• heap/HeapCell.cpp:

(JSC::HeapCell::use):

• heap/HeapCell.h:

(JSC::HeapCell::use): Introduce API for keeping a pointer alive until some point in execution.

• runtime/Structure.cpp:

(JSC::Structure::willStoreValueSlow): Use HeapCell::use() to keep the pointer alive.

File:

• trunk/Source/JavaScriptCore/runtime/Structure.cpp (modified) (1 diff)

trunk/Source/JavaScriptCore/runtime/Structure.cpp

@@ -919 +919 @@
         entry->hasInferredType = false;
     }
+    
+    propertyTable->use(); // This makes it safe to use entry above.
 }