Changeset 94623 in webkit for trunk/Source/JavaScriptCore/bytecode/CodeBlock.cpp

Timestamp:

Sep 6, 2011, 7:05:02 PM (14 years ago)

Author:

[email protected]

Message:

Accessibility tests crashing in BasicRawSentinelNode code
​https://bugs.webkit.org/show_bug.cgi?id=67682

Reviewed by Geoffrey Garen.

A CodeBlock should ensure that no other CodeBlocks have references to it after
it is destroyed.

• bytecode/CodeBlock.cpp:

(JSC::CodeBlock::~CodeBlock):

File:

• trunk/Source/JavaScriptCore/bytecode/CodeBlock.cpp (modified) (1 diff)

trunk/Source/JavaScriptCore/bytecode/CodeBlock.cpp

@@ -1449 +1449 @@
 #endif
     
-    // We should not be garbage collected if there are incoming calls. But
-    // if this is called during heap destruction, then there may still be
-    // incoming calls, which is harmless.
+    // We may be destroyed before any CodeBlocks that refer to us are destroyed.
+    // Consider that two CodeBlocks become unreachable at the same time. There
+    // is no guarantee about the order in which the CodeBlocks are destroyed.
+    // So, if we don't remove incoming calls, and get destroyed before the
+    // CodeBlock(s) that have calls into us, then the CallLinkInfo vector's
+    // destructor will try to remove nodes from our (no longer valid) linked list.
+    while (m_incomingCalls.begin() != m_incomingCalls.end())
+        m_incomingCalls.begin()->remove();
     
     // Note that our outgoing calls will be removed from other CodeBlocks'