Changeset 73545 in webkit for trunk/JavaScriptCore/runtime/MarkStack.h

Timestamp:

Dec 8, 2010, 1:44:38 PM (14 years ago)

Author:

[email protected]

Message:

2010-12-08 Oliver Hunt <​[email protected]>

Reviewed by Gavin Barraclough.

Marking the active global object re-enters through markConservatively
​https://bugs.webkit.org/show_bug.cgi?id=50711

draining of the MarkStack is not allowed to be re-entrant, we got away
with this simply due to the logic in MarkStack::drain implicitly handling
changes that could be triggered by the re-entry.

Just to be safe this patch removes the re-entry through markConservatively
so we don't accidentally introduce such an issue in future. I've also
added an assertion to catch such errors.

• runtime/Collector.cpp: (JSC::Heap::markConservatively): (JSC::Heap::markCurrentThreadConservativelyInternal): (JSC::Heap::markOtherThreadConservatively):
• runtime/JSArray.h: (JSC::MarkStack::drain):
• runtime/MarkStack.h: (JSC::MarkStack::MarkStack):

File:

• trunk/JavaScriptCore/runtime/MarkStack.h (modified) (2 diffs)

trunk/JavaScriptCore/runtime/MarkStack.h

@@ -42 +42 @@
         MarkStack(void* jsArrayVPtr)
             : m_jsArrayVPtr(jsArrayVPtr)
-#ifndef NDEBUG
+#if !ASSERT_DISABLED
             , m_isCheckingForDefaultMarkViolation(false)
+            , m_isDraining(false)
 #endif
         {
@@ -179 +180 @@
         static size_t s_pageSize;
 
-#ifndef NDEBUG
+#if !ASSERT_DISABLED
     public:
         bool m_isCheckingForDefaultMarkViolation;
+        bool m_isDraining;
 #endif
     };