Changeset 47627 in webkit for trunk/JavaScriptCore/runtime

Timestamp:

Aug 21, 2009, 12:48:59 AM (16 years ago)

Author:

[email protected]

Message:

Browser hangs on opening Web Inspector.
​https://bugs.webkit.org/show_bug.cgi?id=28438

Reviewed by Maciej Stachowiak.

Code generation needs to be able to walk the entire scopechain in some
cases, however the symbol table used by activations was a member of the
codeblock. Following recompilation this may no longer exist, leading
to a crash or hang on lookup.

We fix this by introducing a refcounted SymbolTable subclass, SharedSymbolTable,
for the CodeBlocks used by function code. This allows activations to
maintain ownership of a copy of the symbol table even after recompilation so
they can continue to work.

Location:

trunk/JavaScriptCore/runtime

Files:

• Executable.cpp (modified) (4 diffs)
• JSActivation.h (modified) (1 diff)
• SymbolTable.h (modified) (1 diff)

trunk/JavaScriptCore/runtime/Executable.cpp

@@ -56 +56 @@
     ASSERT(!m_evalCodeBlock);
     m_evalCodeBlock = new EvalCodeBlock(this, globalObject, source().provider(), scopeChain.localDepth());
-    OwnPtr<BytecodeGenerator> generator(new BytecodeGenerator(evalNode(), globalObject->debugger(), scopeChain, &m_evalCodeBlock->symbolTable(), m_evalCodeBlock));
+    OwnPtr<BytecodeGenerator> generator(new BytecodeGenerator(evalNode(), globalObject->debugger(), scopeChain, m_evalCodeBlock->symbolTable(), m_evalCodeBlock));
     generator->generate();
     
@@ -84 +84 @@
     ASSERT(!m_codeBlock);
     m_codeBlock = new FunctionCodeBlock(this, FunctionCode, source().provider(), source().startOffset());
-    OwnPtr<BytecodeGenerator> generator(new BytecodeGenerator(body(), globalObject->debugger(), scopeChain, &m_codeBlock->symbolTable(), m_codeBlock));
+    OwnPtr<BytecodeGenerator> generator(new BytecodeGenerator(body(), globalObject->debugger(), scopeChain, m_codeBlock->symbolTable(), m_codeBlock));
     generator->generate();
     m_numParameters = m_codeBlock->m_numParameters;
@@ -148 +148 @@
     globalData->functionCodeBlockBeingReparsed = newCodeBlock.get();
 
-    OwnPtr<BytecodeGenerator> generator(new BytecodeGenerator(newFunctionBody.get(), globalObject->debugger(), scopeChain, &newCodeBlock->symbolTable(), newCodeBlock.get()));
+    OwnPtr<BytecodeGenerator> generator(new BytecodeGenerator(newFunctionBody.get(), globalObject->debugger(), scopeChain, newCodeBlock->symbolTable(), newCodeBlock.get()));
     generator->setRegeneratingForExceptionInfo(static_cast<FunctionCodeBlock*>(codeBlock));
     generator->generate();
@@ -173 +173 @@
     OwnPtr<EvalCodeBlock> newCodeBlock(new EvalCodeBlock(this, globalObject, source().provider(), scopeChain.localDepth()));
 
-    OwnPtr<BytecodeGenerator> generator(new BytecodeGenerator(newEvalBody.get(), globalObject->debugger(), scopeChain, &newCodeBlock->symbolTable(), newCodeBlock.get()));
+    OwnPtr<BytecodeGenerator> generator(new BytecodeGenerator(newEvalBody.get(), globalObject->debugger(), scopeChain, newCodeBlock->symbolTable(), newCodeBlock.get()));
     generator->setRegeneratingForExceptionInfo(static_cast<EvalCodeBlock*>(codeBlock));
     generator->generate();

trunk/JavaScriptCore/runtime/JSActivation.h

@@ -71 +71 @@
     private:
         struct JSActivationData : public JSVariableObjectData {
-            JSActivationData(PassRefPtr<FunctionExecutable> functionExecutable, Register* registers)
-                : JSVariableObjectData(&functionExecutable->generatedBytecode().symbolTable(), registers)
-                , functionExecutable(functionExecutable)
+            JSActivationData(PassRefPtr<FunctionExecutable> _functionExecutable, Register* registers)
+                : JSVariableObjectData(_functionExecutable->generatedBytecode().symbolTable(), registers)
+                , functionExecutable(_functionExecutable)
             {
+                // We have to manually ref and deref the symbol table as JSVariableObjectData
+                // doesn't know about SharedSymbolTable
+                functionExecutable->generatedBytecode().sharedSymbolTable()->ref();
+            }
+            ~JSActivationData()
+            {
+                static_cast<SharedSymbolTable*>(symbolTable)->deref();
             }
 

trunk/JavaScriptCore/runtime/SymbolTable.h

@@ -122 +122 @@
     typedef HashMap<RefPtr<UString::Rep>, SymbolTableEntry, IdentifierRepHash, HashTraits<RefPtr<UString::Rep> >, SymbolTableIndexHashTraits> SymbolTable;
 
+    class SharedSymbolTable : public SymbolTable, public RefCounted<SharedSymbolTable>
+    {
+    };
+    
 } // namespace JSC