Changeset 53572 in webkit for trunk/JavaScriptCore/runtime/Collector.cpp

Timestamp:

Jan 20, 2010, 3:30:02 PM (15 years ago)

Author:

[email protected]

Message:

<rdar://problem/7562708> REGRESSION(53460): Heap::destroy may not run
all destructors

Reviewed by Oliver Hunt.

• runtime/Collector.cpp:

(JSC::Heap::freeBlocks): Instead of fully marking protected objects,
just set their mark bits. This prevents protected objects from keeping
unprotected objects alive. Destructor order is not guaranteed, so it's
OK to destroy objects pointed to by protected objects before destroying
protected objects.

File:

• trunk/JavaScriptCore/runtime/Collector.cpp (modified) (2 diffs)

trunk/JavaScriptCore/runtime/Collector.cpp

@@ -338 +338 @@
 
     clearMarkBits();
-    markProtectedObjects(m_globalData->markStack);
+    ProtectCountSet::iterator protectedValuesEnd = protectedValuesCopy.end();
+    for (ProtectCountSet::iterator it = protectedValuesCopy.begin(); it != protectedValuesEnd; ++it)
+        markCell(it->first);
 
     m_heap.nextCell = 0;
@@ -349 +351 @@
     ASSERT(!protectedObjectCount());
 
-    ProtectCountSet::iterator protectedValuesEnd = protectedValuesCopy.end();
-    for (ProtectCountSet::iterator protectedValuesIt = protectedValuesCopy.begin(); protectedValuesIt != protectedValuesEnd; ++protectedValuesIt)
-        protectedValuesIt->first->~JSCell();
+    protectedValuesEnd = protectedValuesCopy.end();
+    for (ProtectCountSet::iterator it = protectedValuesCopy.begin(); it != protectedValuesEnd; ++it)
+        it->first->~JSCell();
 
     for (size_t block = 0; block < m_heap.usedBlocks; ++block)