Changeset 98302 in webkit for trunk/Source/JavaScriptCore/heap

Timestamp:

Oct 24, 2011, 5:21:29 PM (14 years ago)

Author:

[email protected]

Message:

Crash in void JSC::validateCell<JSC::RegExp*>(JSC::RegExp*)
​https://bugs.webkit.org/show_bug.cgi?id=70689

Reviewed by Filip Pizlo.

While performing codegen we need to make the GlobalData explicitly
aware of the codeblock being compiled, as compilation may trigger GC
and CodeBlock holds GC values, but has not yet been assigned to its
owner executable.

• bytecompiler/BytecodeGenerator.cpp:

(JSC::BytecodeGenerator::BytecodeGenerator):
(JSC::BytecodeGenerator::~BytecodeGenerator):

• bytecompiler/BytecodeGenerator.h:
• heap/AllocationSpace.cpp:

(JSC::AllocationSpace::allocateSlowCase):

• heap/Heap.cpp:

(JSC::Heap::markRoots):

• runtime/JSGlobalData.cpp:

(JSC::JSGlobalData::JSGlobalData):

• runtime/JSGlobalData.h:

(JSC::JSGlobalData::startedCompiling):
(JSC::JSGlobalData::finishedCompiling):

Location:

trunk/Source/JavaScriptCore/heap

Files:

• AllocationSpace.cpp (modified) (1 diff)
• Heap.cpp (modified) (1 diff)

trunk/Source/JavaScriptCore/heap/AllocationSpace.cpp

@@ -45 +45 @@
 {
 #if COLLECT_ON_EVERY_ALLOCATION
-    collectAllGarbage();
+    m_heap->collectAllGarbage();
     ASSERT(m_heap->m_operationInProgress == NoOperation);
 #endif

trunk/Source/JavaScriptCore/heap/Heap.cpp

@@ -601 +601 @@
     }
 #endif
-
+    
+    if (CodeBlock* codeBlock = m_globalData->codeBlockBeingCompiled) {
+        GCPHASE(VisitActiveCodeBlock);
+        codeBlock->visitAggregate(visitor);
+    }
+    
     {
         GCPHASE(VisitMachineRoots);