Changeset 164448 in webkit

Timestamp:

Feb 20, 2014, 2:55:11 PM (11 years ago)

Author:

mhahnenberg@apple.com

Message:

CopiedBlock::pin can call into fastFree while forbidden
​https://bugs.webkit.org/show_bug.cgi?id=128654

Reviewed by Oliver Hunt.

A FullCollection that skips copying doesn't clear the CopyWorkList of the all the surviving
CopiedBlocks because we currently only call didSurviveGC() at the beginning of FullCollections.

EdenCollections always do copying, therefore they always clear all CopyWorkLists.

The fix is to call didSurviveGC() for all surviving CopiedBlocks at the end of FullCollections
as well at the beginning.

• heap/CopiedBlock.h:

(JSC::CopiedBlock::didSurviveGC):

• heap/CopiedSpace.cpp:

(JSC::CopiedSpace::doneCopying):

Location:

trunk/Source/JavaScriptCore

Files:

• ChangeLog (modified) (1 diff)
• heap/CopiedBlock.h (modified) (1 diff)
• heap/CopiedSpace.cpp (modified) (1 diff)

trunk/Source/JavaScriptCore/ChangeLog

@@ +1 @@
+2014-02-20  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        CopiedBlock::pin can call into fastFree while forbidden
+        https://bugs.webkit.org/show_bug.cgi?id=128654
+
+        Reviewed by Oliver Hunt.
+
+        A FullCollection that skips copying doesn't clear the CopyWorkList of the all the surviving 
+        CopiedBlocks because we currently only call didSurviveGC() at the beginning of FullCollections.
+
+        EdenCollections always do copying, therefore they always clear all CopyWorkLists.
+
+        The fix is to call didSurviveGC() for all surviving CopiedBlocks at the end of FullCollections 
+        as well at the beginning.
+
+        * heap/CopiedBlock.h:
+        (JSC::CopiedBlock::didSurviveGC):
+        * heap/CopiedSpace.cpp:
+        (JSC::CopiedSpace::doneCopying):
+
 2014-02-20  Mark Hahnenberg  <mhahnenberg@apple.com>
 

trunk/Source/JavaScriptCore/heap/CopiedBlock.h

@@ -148 +148 @@
 {
     checkConsistency();
+    ASSERT(isOld());
     m_liveBytes = 0;
 #ifndef NDEBUG

trunk/Source/JavaScriptCore/heap/CopiedSpace.cpp

@@ -254 +254 @@
         ASSERT(m_blockSet.contains(block));
         blockFilter->add(reinterpret_cast<Bits>(block));
+        block->didSurviveGC();
         toSpace->push(block);
     }