Changeset 130611 in webkit

Timestamp:

Oct 7, 2012, 3:56:50 PM (14 years ago)

Author:

ggaren@apple.com

Message:

REGRESSION (r130584): Crashes in JSC::MarkedAllocator::allocateSlowCase, failing fast/dom/gc-dom-tree-lifetime.html
​https://bugs.webkit.org/show_bug.cgi?id=98612

Reviewed by Darin Adler.

Since DOM modification can happen outside of JS, calls into JS due to
DOM modification need to take the JS lock.

• bindings/js/JSNodeCustom.cpp:

(WebCore::willCreatePossiblyOrphanedTreeByRemovalSlowCase): Take the JS
lock before doing a JS allocation, since this may be a JS entrypoint.

• bindings/js/JSNodeCustom.h:

(WebCore::willCreatePossiblyOrphanedTreeByRemoval): Split out a slow case
to help the inliner.

Location:

trunk/Source/WebCore

Files:

• ChangeLog (modified) (1 diff)
• bindings/js/JSNodeCustom.cpp (modified) (1 diff)
• bindings/js/JSNodeCustom.h (modified) (2 diffs)

trunk/Source/WebCore/ChangeLog

@@ +1 @@
+2012-10-07  Geoffrey Garen  <ggaren@apple.com>
+
+        REGRESSION (r130584): Crashes in JSC::MarkedAllocator::allocateSlowCase, failing fast/dom/gc-dom-tree-lifetime.html
+        https://bugs.webkit.org/show_bug.cgi?id=98612
+
+        Reviewed by Darin Adler.
+
+        Since DOM modification can happen outside of JS, calls into JS due to
+        DOM modification need to take the JS lock.
+
+        * bindings/js/JSNodeCustom.cpp:
+        (WebCore::willCreatePossiblyOrphanedTreeByRemovalSlowCase): Take the JS
+        lock before doing a JS allocation, since this may be a JS entrypoint.
+
+        * bindings/js/JSNodeCustom.h:
+        (WebCore::willCreatePossiblyOrphanedTreeByRemoval): Split out a slow case
+        to help the inliner.
+
 2012-10-07  Nick Carter  <nick@chromium.org>
 

trunk/Source/WebCore/bindings/js/JSNodeCustom.cpp

@@ -277 +277 @@
 }
 
+void willCreatePossiblyOrphanedTreeByRemovalSlowCase(Node* root)
+{
+    ScriptState* scriptState = mainWorldScriptState(root->document()->frame());
+    if (!scriptState)
+        return;
+
+    JSLockHolder lock(scriptState);
+    toJS(scriptState, static_cast<JSDOMGlobalObject*>(scriptState->lexicalGlobalObject()), root);
+}
+
 } // namespace WebCore

trunk/Source/WebCore/bindings/js/JSNodeCustom.h

@@ -74 +74 @@
 // reference to any node in the tree. To model the JavaScript DOM on top of
 // the C++ DOM, we ensure that the root of every tree has a JavaScript wrapper.
+void willCreatePossiblyOrphanedTreeByRemovalSlowCase(Node* root);
 inline void willCreatePossiblyOrphanedTreeByRemoval(Node* root)
 {
@@ -82 +83 @@
         return;
 
-    ScriptState* scriptState = mainWorldScriptState(root->document()->frame());
-    if (!scriptState)
-        return;
-
-    toJS(scriptState, static_cast<JSDOMGlobalObject*>(scriptState->lexicalGlobalObject()), root);
+    willCreatePossiblyOrphanedTreeByRemovalSlowCase(root);
 }