Changeset 37631 in webkit for trunk/JavaScriptCore

Timestamp:

Oct 16, 2008, 1:00:53 AM (17 years ago)

Author:

[email protected]

Message:

Reviewed by Darin Adler.

​https://bugs.webkit.org/show_bug.cgi?id=21609
Make MessagePorts protect their peers across heaps

JavaScriptCore:

• JavaScriptCore.exp:
• kjs/JSGlobalObject.cpp: (JSC::JSGlobalObject::markCrossHeapDependentObjects):
• kjs/JSGlobalObject.h:
• kjs/collector.cpp: (JSC::Heap::collect): Before GC sweep phase, a function supplied by global object is now called for all global objects in the heap, making it possible to implement cross-heap dependencies.

WebCore:

• dom/MessagePort.cpp: (WebCore::MessagePort::MessagePort):
• dom/MessagePort.h: (WebCore::MessagePort::setJSWrapperIsKnownToBeInaccessible): (WebCore::MessagePort::jsWrapperIsKnownToBeInaccessible): Track objects whose JS wrappers are no longer reachable in MessagePort. Unfortunately, this means that the implementation object knows about JS bindings - but it is not possible to access JS wrappers from another heap/thread.

• bindings/js/JSDOMBinding.cpp: (WebCore::markCrossHeapDependentObjectsForDocument):
• bindings/js/JSDOMBinding.h:
• bindings/js/JSDOMWindowBase.cpp: (WebCore::JSDOMWindowBase::markCrossHeapDependentObjects):
• bindings/js/JSDOMWindowBase.h: Implement cross-heap dependency tracking for entangled MessagePorts. If a wrapper object hasn't been marked normally, it is marked as inaccessible. It is then marked manually, as long as its entangled port is accessible itself.

Location:

trunk/JavaScriptCore

Files:

• ChangeLog (modified) (1 diff)
• JavaScriptCore.exp (modified) (1 diff)
• kjs/JSGlobalObject.cpp (modified) (1 diff)
• kjs/JSGlobalObject.h (modified) (1 diff)
• kjs/collector.cpp (modified) (1 diff)

trunk/JavaScriptCore/ChangeLog

@@ +1 @@
+2008-10-15  Alexey Proskuryakov  <[email protected]>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=21609
+        Make MessagePorts protect their peers across heaps
+
+        * JavaScriptCore.exp:
+        * kjs/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::markCrossHeapDependentObjects):
+        * kjs/JSGlobalObject.h:
+        * kjs/collector.cpp:
+        (JSC::Heap::collect):
+        Before GC sweep phase, a function supplied by global object is now called for all global
+        objects in the heap, making it possible to implement cross-heap dependencies.
+
 2008-10-15  Alexey Proskuryakov  <[email protected]>
 

trunk/JavaScriptCore/JavaScriptCore.exp

@@ -148 +148 @@
 __ZN3JSC14JSGlobalObject17putWithAttributesEPNS_9ExecStateERKNS_10IdentifierEPNS_7JSValueEj
 __ZN3JSC14JSGlobalObject17startTimeoutCheckEv
+__ZN3JSC14JSGlobalObject29markCrossHeapDependentObjectsEv
 __ZN3JSC14JSGlobalObject3putEPNS_9ExecStateERKNS_10IdentifierEPNS_7JSValueERNS_15PutPropertySlotE
 __ZN3JSC14JSGlobalObject4initEPNS_8JSObjectE

trunk/JavaScriptCore/kjs/JSGlobalObject.cpp

@@ -400 +400 @@
 }
 
+void JSGlobalObject::markCrossHeapDependentObjects()
+{
+    // Overridden by subclasses.
+}
+
 JSGlobalObject* JSGlobalObject::toGlobalObject(ExecState*) const
 {

trunk/JavaScriptCore/kjs/JSGlobalObject.h

@@ -159 +159 @@
 
         virtual void mark();
+        virtual void markCrossHeapDependentObjects();
 
         virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);

trunk/JavaScriptCore/kjs/collector.cpp

@@ -970 +970 @@
     m_globalData->smallStrings.mark();
 
+    JSGlobalObject* globalObject = m_globalData->head;
+    do {
+        globalObject->markCrossHeapDependentObjects();
+        globalObject = globalObject->next();
+    } while (globalObject != m_globalData->head);
+
     JAVASCRIPTCORE_GC_MARKED();