Changeset 53455 in webkit for trunk/JavaScriptCore/API/JSContextRef.cpp

Timestamp:

Jan 18, 2010, 11:00:38 PM (15 years ago)

Author:

[email protected]

Message:

2010-01-18 Geoffrey Garen <​[email protected]>

Reviewed by Oliver Hunt.

REGRESSION (52082): Crash on worker thread when reloading ​http://radnan.public.iastate.edu/procedural/
​https://bugs.webkit.org/show_bug.cgi?id=33826

This bug was caused by a GC-protected object being destroyed early by
Heap::destroy. Clients of the GC protect APIs (reasonably) expect pointers
to GC-protected memory to be valid.

The solution is to do two passes of tear-down in Heap::destroy. The first
pass tears down all unprotected objects. The second pass ASSERTs that all
previously protected objects are now unprotected, and then tears down
all perviously protected objects. These two passes simulate the two passes
that would have been required to free a protected object during normal GC.

• API/JSContextRef.cpp: Removed some ASSERTs that have moved into Heap.

• runtime/Collector.cpp: (JSC::Heap::destroy): Moved ASSERTs to here. (JSC::Heap::freeBlock): Tidied up the use of didShrink by moving its setter to the function that does the shrinking. (JSC::Heap::freeBlocks): Implemented above algorithm. (JSC::Heap::shrinkBlocks): Tidied up the use of didShrink.

2010-01-18 Geoffrey Garen <​[email protected]>

Reviewed by Oliver Hunt.

REGRESSION (52082): Crash on worker thread when reloading ​http://radnan.public.iastate.edu/procedural/
​https://bugs.webkit.org/show_bug.cgi?id=33826

Test: fast/workers/worker-gc2.html

• bindings/js/WorkerScriptController.cpp: (WebCore::WorkerScriptController::~WorkerScriptController): Removed some ASSERTs that have moved to JavaScriptCore.

2010-01-18 Geoffrey Garen <​[email protected]>

Reviewed by Oliver Hunt.

REGRESSION (52082): Crash on worker thread when reloading ​http://radnan.public.iastate.edu/procedural/
​https://bugs.webkit.org/show_bug.cgi?id=33826

Added a test for this edge case.

• fast/workers/resources/worker-gc2.js: Added. (Dummy):
• fast/workers/worker-gc2.html: Added.

File:

• trunk/JavaScriptCore/API/JSContextRef.cpp (modified) (1 diff)

trunk/JavaScriptCore/API/JSContextRef.cpp

@@ -128 +128 @@
     if (globalData.refCount() == 2) { // One reference is held by JSGlobalObject, another added by JSGlobalContextRetain().
         // The last reference was released, this is our last chance to collect.
-        ASSERT(!globalData.heap.protectedObjectCount());
-        ASSERT(!globalData.heap.isBusy());
         globalData.heap.destroy();
     } else