Changeset 35663 in webkit for trunk/JavaScriptCore

Timestamp:

Aug 11, 2008, 5:01:26 AM (17 years ago)

Author:

[email protected]

Message:

Reviewed by Mark Rowe.

<rdar://problem/6130393> REGRESSION: PhotoBooth hangs after launching under TOT Webkit

• API/JSContextRef.cpp: (JSGlobalContextRelease): Corrected a comment.

• kjs/collector.cpp: (KJS::Heap::~Heap): Ensure that JSGlobalData is not deleted while sweeping the heap.

Location:

trunk/JavaScriptCore

Files:

• API/JSContextRef.cpp (modified) (1 diff)
• ChangeLog (modified) (1 diff)
• kjs/collector.cpp (modified) (1 diff)

trunk/JavaScriptCore/API/JSContextRef.cpp

@@ -102 +102 @@
         ASSERT(!heap->isBusy());
 
-        // Heap::destroy() will delete JSGlobalObject, which will in turn delete JSGlobalData, which will
+        // Heap destructor will delete JSGlobalObject, which will in turn delete JSGlobalData, which will
         // delete the heap, which would cause a crash if allowed.
         globalData.heap = 0;

trunk/JavaScriptCore/ChangeLog

@@ +1 @@
+2008-08-11  Alexey Proskuryakov  <[email protected]>
+
+        Reviewed by Mark Rowe.
+
+        <rdar://problem/6130393> REGRESSION: PhotoBooth hangs after launching under TOT Webkit
+
+        * API/JSContextRef.cpp: (JSGlobalContextRelease): Corrected a comment.
+
+        * kjs/collector.cpp: (KJS::Heap::~Heap): Ensure that JSGlobalData is not deleted while
+        sweeping the heap.
+
 == Rolled over to ChangeLog-2008-08-10 ==

trunk/JavaScriptCore/kjs/collector.cpp

@@ -135 +135 @@
 Heap::~Heap()
 {
+    // The global object is not GC protected at this point, so sweeping may delete it (and thus the global data)
+    // before other objects that may use the global data.
+    RefPtr<JSGlobalData> protect(m_globalData);
+
     delete m_markListSet;
+    m_markListSet = 0;
+
     sweep<PrimaryHeap>();
     // No need to sweep number heap, because the JSNumber destructor doesn't do anything.