Changeset 64602 in webkit for trunk/JavaScriptCore/runtime/JSGlobalData.cpp

Timestamp:

Aug 3, 2010, 3:55:34 PM (15 years ago)

Author:

[email protected]

Message:

Fixed a crash seen on the GTK 64bit buildbot.

Reviewed by Oliver Hunt.

When JSArray is allocated for the vptr stealing hack, it's not allocated
in the heap, so the JSArray constructor can't safely call Heap::heap().

Since this was subtle enough to confuse smart people, I've changed JSArray
to have an explicit vptr stealing constructor.

• JavaScriptCore.xcodeproj/project.pbxproj:
• runtime/JSArray.cpp:

(JSC::JSArray::JSArray):

• runtime/JSArray.h:

(JSC::JSArray::):

• runtime/JSGlobalData.cpp:

(JSC::JSGlobalData::storeVPtrs):

File:

• trunk/JavaScriptCore/runtime/JSGlobalData.cpp (modified) (1 diff)

trunk/JavaScriptCore/runtime/JSGlobalData.cpp

@@ -86 +86 @@
 
     COMPILE_ASSERT(sizeof(JSArray) <= sizeof(CollectorCell), sizeof_JSArray_must_be_less_than_CollectorCell);
-    JSCell* jsArray = new (storage) JSArray(JSArray::createStructure(jsNull()));
+    JSCell* jsArray = new (storage) JSArray(JSArray::VPtrStealingHack);
     JSGlobalData::jsArrayVPtr = jsArray->vptr();
     jsArray->~JSCell();