Changeset 27359 in webkit for trunk/JavaScriptCore/wtf

Timestamp:

Nov 1, 2007, 1:50:28 PM (18 years ago)

Author:

ggaren

Message:

JavaScriptCore:

Reviewed by Maciej Stachowiak.

Fixed ​http://bugs.webkit.org/show_bug.cgi?id=15785
REGRESSION(r27344): Crash on load at finance.yahoo.com

Reverted a small portion of my last check-in. (The speedup and the List
removal are still there, though.)

ActivationImp needs to hold a pointer to its function, and mark that
pointer (rather than accessing its function through its ExecState, and
counting on the active scope to mark its function) because a closure
can cause an ActivationImp to outlive its ExecState along with any
active scope.

• kjs/ExecState.cpp: (KJS::ExecState::ExecState):
• kjs/function.cpp: (KJS::FunctionImp::~FunctionImp): (KJS::ActivationImp::ActivationImp):
• kjs/function.h: (KJS::ActivationImp::ActivationImpPrivate::ActivationImpPrivate):

Also made HashTable a little more crash-happy in debug builds, so
problems like this will show up earlier:

• wtf/HashTable.h: (WTF::HashTable::~HashTable):

LayoutTests:

Reviewed by Maciej Stachowiak.

Layout test for ​http://bugs.webkit.org/show_bug.cgi?id=15785
REGRESSION(r27344): Crash on load at finance.yahoo.com

• fast/js/activation-object-function-lifetime-expected.txt: Added.
• fast/js/activation-object-function-lifetime.html: Added.

File:

• trunk/JavaScriptCore/wtf/HashTable.h (modified) (2 diffs)

trunk/JavaScriptCore/wtf/HashTable.h

@@ -35 +35 @@
 #ifdef NDEBUG
 #define CHECK_HASHTABLE_ITERATORS 0
+#define CHECK_HASHTABLE_USE_AFTER_DESTRUCTION 0
 #else
 #define CHECK_HASHTABLE_ITERATORS 1
+#define CHECK_HASHTABLE_USE_AFTER_DESTRUCTION 1
 #endif
 
@@ -280 +282 @@
 
         HashTable();
-        ~HashTable() { invalidateIterators(); deallocateTable(m_table, m_tableSize); }
+        ~HashTable() 
+        {
+            invalidateIterators(); 
+            deallocateTable(m_table, m_tableSize); 
+#if CHECK_HASHTABLE_USE_AFTER_DESTRUCTION
+            m_table = (ValueType*)(uintptr_t)0xbbadbeef;
+#endif
+        }
 
         HashTable(const HashTable&);