Changeset 29710 in webkit for trunk/JavaScriptCore/kjs/ExecState.cpp

Timestamp:

Jan 21, 2008, 10:18:10 PM (17 years ago)

Author:

[email protected]

Message:

JavaScriptCore:

Reviewed by Maciej Stachowiak.

Fixed ​http://bugs.webkit.org/show_bug.cgi?id=16909
REGRESSION: Amazon.com crash (ActivationImp)

(and a bunch of other crashes)

Plus, a .7% SunSpider speedup to boot.

Replaced the buggy currentExec and savedExec mechanisms with an
explicit ExecState stack.

• kjs/collector.cpp: (KJS::Collector::collect): Explicitly mark the ExecState stack.

(KJS::Collector::reportOutOfMemoryToAllExecStates): Slight change in
behavior: We no longer throw an exception in any global ExecStates,
since global ExecStates are more like pseudo-ExecStates, and aren't
used for script execution. (It's unclear what would happen if you left
an exception waiting around in a global ExecState, but it probably
wouldn't be good.)

WebCore:

Reviewed by Maciej Stachowiak.

Adapted WebCore to the fix for ​http://bugs.webkit.org/show_bug.cgi?id=16909
REGRESSION: Amazon.com crash (ActivationImp)

• bindings/js/kjs_proxy.cpp: (WebCore::KJSProxy::~KJSProxy): No convenient way to make this assertion anymore. (It wasn't firing for anyone, anyway, so it's no big loss.)

• bindings/objc/WebScriptObject.mm: (+[WebScriptObject throwException:]): Use the ExecState stack, instead of currentExec. (-[WebScriptObject setException:]): ditto. Also, a slight change in behavior: If no ExecStates are active, we no longer throw an exception in the global ExecState. The JavaScriptCore ChangeLog explains why. This also matches the behavior of +throwException.

LayoutTests:

Layout test for ​http://bugs.webkit.org/show_bug.cgi?id=16909
REGRESSION: Amazon.com crash (ActivationImp)

• fast/js/exec-state-marking-expected.txt: Added.
• fast/js/exec-state-marking.html: Added.

File:

• trunk/JavaScriptCore/kjs/ExecState.cpp (modified) (9 diffs)

trunk/JavaScriptCore/kjs/ExecState.cpp

@@ -42 +42 @@
 // ECMA 10.2
 
+// The constructor for the globalExec pseudo-ExecState
+ExecState::ExecState(JSGlobalObject* globalObject)
+    : m_globalObject(globalObject)
+    , m_exception(0)
+    , m_propertyNames(CommonIdentifiers::shared())
+    , m_emptyList(globalEmptyList())
+    , m_callingExec(0)
+    , m_scopeNode(0)
+    , m_function(0)
+    , m_arguments(0)
+    , m_activation(0)
+    , m_localStorage(&globalObject->localStorage())
+    , m_variableObject(globalObject)
+    , m_thisVal(globalObject)
+    , m_iterationDepth(0)
+    , m_switchDepth(0) 
+    , m_codeType(GlobalCode)
+{
+    m_scopeChain.push(globalObject);
+}
+
 ExecState::ExecState(JSGlobalObject* globalObject, JSObject* /*thisObject*/, ProgramNode* programNode)
     : m_globalObject(globalObject)
@@ -48 +69 @@
     , m_emptyList(globalEmptyList())
     , m_callingExec(0)
-    , m_savedExec(0)
     , m_scopeNode(programNode)
     , m_function(0)
@@ -63 +83 @@
     // a script with a this object that's not the same as the global object is broken, and probably
     // has been for some time.
+    ASSERT(m_scopeNode);
+    activeExecStates().append(this);
     m_scopeChain.push(globalObject);
-    if (programNode)
-        globalObject->setCurrentExec(this);
 }
 
@@ -74 +94 @@
     , m_emptyList(callingExec->m_emptyList)
     , m_callingExec(callingExec)
-    , m_savedExec(globalObject->currentExec())
     , m_scopeNode(evalNode)
     , m_function(0)
@@ -87 +106 @@
     , m_codeType(EvalCode)
 {    
-    globalObject->setCurrentExec(this);
+    ASSERT(m_scopeNode);
+    activeExecStates().append(this);
 }
 
@@ -98 +118 @@
     , m_emptyList(callingExec->m_emptyList)
     , m_callingExec(callingExec)
-    , m_savedExec(globalObject->currentExec())
     , m_scopeNode(functionBodyNode)
     , m_function(func)
@@ -108 +127 @@
     , m_codeType(FunctionCode)
 {
+    ASSERT(m_scopeNode);
+    activeExecStates().append(this);
+
     ActivationImp* activation = globalObject->pushActivation(this);
     m_activation = activation;
@@ -113 +135 @@
     m_variableObject = activation;
     m_scopeChain.push(activation);
-    globalObject->setCurrentExec(this);
 }
 
 ExecState::~ExecState()
 {
-    if (m_codeType == FunctionCode && m_activation->needsPop())
+    ASSERT(m_scopeNode && activeExecStates().last() == this || !m_scopeNode);
+    if (m_scopeNode)
+        activeExecStates().removeLast();
+
+    if (m_activation && m_activation->needsPop())
         m_globalObject->popActivation();
-    
-    m_globalObject->setCurrentExec(m_savedExec);
-}
-
-void ExecState::mark()
-{
-    for (ExecState* exec = this; exec; exec = exec->m_callingExec) {
-        exec->m_scopeChain.mark();
-
-        if (exec->m_savedExec != exec->m_callingExec && exec->m_savedExec)
-            exec->m_savedExec->mark();
-    }
 }
 
@@ -146 +159 @@
 }
 
+void ExecState::markActiveExecStates() 
+{
+    ExecStateStack::const_iterator end = activeExecStates().end();
+    for (ExecStateStack::const_iterator it = activeExecStates().begin(); it != end; ++it)
+        (*it)->m_scopeChain.mark();
+}
+
+ExecStateStack& ExecState::activeExecStates()
+{
+    static ExecStateStack staticActiveExecStates;
+    return staticActiveExecStates;
+}
+
 } // namespace KJS