Changeset 64602 in webkit for trunk/JavaScriptCore/runtime/JSArray.h

Timestamp:

Aug 3, 2010, 3:55:34 PM (15 years ago)

Author:

[email protected]

Message:

Fixed a crash seen on the GTK 64bit buildbot.

Reviewed by Oliver Hunt.

When JSArray is allocated for the vptr stealing hack, it's not allocated
in the heap, so the JSArray constructor can't safely call Heap::heap().

Since this was subtle enough to confuse smart people, I've changed JSArray
to have an explicit vptr stealing constructor.

• JavaScriptCore.xcodeproj/project.pbxproj:
• runtime/JSArray.cpp:

(JSC::JSArray::JSArray):

• runtime/JSArray.h:

(JSC::JSArray::):

• runtime/JSGlobalData.cpp:

(JSC::JSGlobalData::storeVPtrs):

File:

• trunk/JavaScriptCore/runtime/JSArray.h (modified) (1 diff)

trunk/JavaScriptCore/runtime/JSArray.h

@@ -63 +63 @@
 
     public:
+        enum VPtrStealingHackType { VPtrStealingHack };
+        JSArray(VPtrStealingHackType);
+
         explicit JSArray(NonNullPassRefPtr<Structure>);
         JSArray(NonNullPassRefPtr<Structure>, unsigned initialLength, ArrayCreationMode);