Changeset 53460 in webkit for trunk/JavaScriptCore/jsc.cpp

Timestamp:

Jan 19, 2010, 12:39:04 AM (15 years ago)

Author:

[email protected]

Message:

JavaScriptCore: REGRESSION (52082): Crash on worker thread when reloading ​http://radnan.public.iastate.edu/procedural/
​https://bugs.webkit.org/show_bug.cgi?id=33826

Reviewed by Oliver Hunt.

This bug was caused by a GC-protected object being destroyed early by
Heap::destroy. Clients of the GC protect APIs (reasonably) expect pointers
to GC-protected memory to be valid.

The solution is to do two passes of tear-down in Heap::destroy. The first
pass tears down all unprotected objects. The second pass ASSERTs that all
previously protected objects are now unprotected, and then tears down
all perviously protected objects. These two passes simulate the two passes
that would have been required to free a protected object during normal GC.

• API/JSContextRef.cpp: Removed some ASSERTs that have moved into Heap.

• runtime/Collector.cpp:

(JSC::Heap::destroy): Moved ASSERTs to here.
(JSC::Heap::freeBlock): Tidied up the use of didShrink by moving its
setter to the function that does the shrinking.
(JSC::Heap::freeBlocks): Implemented above algorithm.
(JSC::Heap::shrinkBlocks): Tidied up the use of didShrink.

WebCore: REGRESSION (52082): Crash on worker thread when reloading ​http://radnan.public.iastate.edu/procedural/
​https://bugs.webkit.org/show_bug.cgi?id=33826

Reviewed by Oliver Hunt.

Test: fast/workers/worker-gc2.html

• bindings/js/WorkerScriptController.cpp:

(WebCore::WorkerScriptController::~WorkerScriptController): Removed some
ASSERTs that have moved to JavaScriptCore.

LayoutTests: REGRESSION (52082): Crash on worker thread when reloading ​http://radnan.public.iastate.edu/procedural/
​https://bugs.webkit.org/show_bug.cgi?id=33826

Reviewed by Oliver Hunt.

Added a test for this edge case.

• fast/workers/resources/worker-gc2.js: Added.

(Dummy):

• fast/workers/worker-gc2.html: Added.

File:

• trunk/JavaScriptCore/jsc.cpp (modified) (1 diff)

trunk/JavaScriptCore/jsc.cpp

@@ -293 +293 @@
 JSValue JSC_HOST_CALL functionQuit(ExecState* exec, JSObject*, JSValue, const ArgList&)
 {
+    // Technically, destroying the heap in the middle of JS execution is a no-no,
+    // but we want to maintain compatibility with the Mozilla test suite, so
+    // we pretend that execution has terminated to avoid ASSERTs, then tear down the heap.
+    exec->globalData().dynamicGlobalObject = 0;
+
     cleanupGlobalData(&exec->globalData());
     exit(EXIT_SUCCESS);