Changeset 92788 in webkit for trunk/Source/JavaScriptCore/heap/HandleHeap.h

Timestamp:

Aug 10, 2011, 12:52:27 PM (14 years ago)

Author:

[email protected]

Message:

Make GC checks more aggressive in release builds
​https://bugs.webkit.org/show_bug.cgi?id=66001

Reviewed by Gavin Barraclough.

../../../../Volumes/Data/git/WebKit/OpenSource/Source/JavaScriptCore:

• heap/HandleHeap.cpp:

(JSC::HandleHeap::visitStrongHandles):
(JSC::HandleHeap::visitWeakHandles):
(JSC::HandleHeap::finalizeWeakHandles):
(JSC::HandleHeap::writeBarrier):
(JSC::HandleHeap::isLiveNode):
(JSC::HandleHeap::isValidWeakNode):

Increase handle heap validation logic, and make some of
the crashes trigger in release builds as well as debug.

• heap/HandleHeap.h:

(JSC::HandleHeap::allocate):
(JSC::HandleHeap::makeWeak):

Ditto

• runtime/JSGlobalData.cpp:

(WTF::Recompiler::operator()):

• runtime/JSGlobalObject.cpp:

(JSC::JSGlobalObject::visitChildren):

Fix GC bugs found while testing this patch

../../../../Volumes/Data/git/WebKit/OpenSource/Source/WebCore:

Fix GC bugs found while testing increased validation logic

• bindings/js/JSDOMWindowShell.cpp:

(WebCore::JSDOMWindowShell::JSDOMWindowShell):

• bindings/js/JSDOMWindowShell.h:
• bindings/js/ScriptController.cpp:

(WebCore::ScriptController::createWindowShell):

• bridge/objc/ObjCRuntimeObject.h:

(JSC::Bindings::ObjCRuntimeObject::create):

• bridge/objc/ObjCRuntimeObject.mm:

(JSC::Bindings::ObjCRuntimeObject::ObjCRuntimeObject):

• bridge/objc/objc_instance.mm:

File:

• trunk/Source/JavaScriptCore/heap/HandleHeap.h (modified) (3 diffs)

trunk/Source/JavaScriptCore/heap/HandleHeap.h

@@ -114 +114 @@
     void grow();
     
-#if !ASSERT_DISABLED
+#if ENABLE(GC_VALIDATION) || !ASSERT_DISABLED
     bool isValidWeakNode(Node*);
+    bool isLiveNode(Node*);
 #endif
 
@@ -150 +151 @@
 inline HandleSlot HandleHeap::allocate()
 {
+    // Forbid assignment to handles during the finalization phase, since it would violate many GC invariants.
+    // File a bug with stack trace if you hit this.
+    if (m_nextToFinalize)
+        CRASH();
     if (m_freeList.isEmpty())
         grow();
@@ -182 +187 @@
 inline void HandleHeap::makeWeak(HandleSlot handle, WeakHandleOwner* weakOwner, void* context)
 {
+    // Forbid assignment to handles during the finalization phase, since it would violate many GC invariants.
+    // File a bug with stack trace if you hit this.
+    if (m_nextToFinalize)
+        CRASH();
     Node* node = toNode(handle);
     node->makeWeak(weakOwner, context);