Changeset 98302 in webkit

Timestamp:

Oct 24, 2011, 5:21:29 PM (14 years ago)

Author:

oliver@apple.com

Message:

Crash in void JSC::validateCell<JSC::RegExp*>(JSC::RegExp*)
​https://bugs.webkit.org/show_bug.cgi?id=70689

Reviewed by Filip Pizlo.

While performing codegen we need to make the GlobalData explicitly
aware of the codeblock being compiled, as compilation may trigger GC
and CodeBlock holds GC values, but has not yet been assigned to its
owner executable.

• bytecompiler/BytecodeGenerator.cpp:

(JSC::BytecodeGenerator::BytecodeGenerator):
(JSC::BytecodeGenerator::~BytecodeGenerator):

• bytecompiler/BytecodeGenerator.h:
• heap/AllocationSpace.cpp:

(JSC::AllocationSpace::allocateSlowCase):

• heap/Heap.cpp:

(JSC::Heap::markRoots):

• runtime/JSGlobalData.cpp:

(JSC::JSGlobalData::JSGlobalData):

• runtime/JSGlobalData.h:

(JSC::JSGlobalData::startedCompiling):
(JSC::JSGlobalData::finishedCompiling):

Location:

trunk/Source/JavaScriptCore

Files:

• ChangeLog (modified) (1 diff)
• bytecompiler/BytecodeGenerator.cpp (modified) (4 diffs)
• bytecompiler/BytecodeGenerator.h (modified) (1 diff)
• heap/AllocationSpace.cpp (modified) (1 diff)
• heap/Heap.cpp (modified) (1 diff)
• runtime/JSGlobalData.cpp (modified) (1 diff)
• runtime/JSGlobalData.h (modified) (1 diff)

trunk/Source/JavaScriptCore/ChangeLog

@@ +1 @@
+2011-10-24  Oliver Hunt  <oliver@apple.com>
+
+        Crash in void JSC::validateCell<JSC::RegExp*>(JSC::RegExp*)
+        https://bugs.webkit.org/show_bug.cgi?id=70689
+
+        Reviewed by Filip Pizlo.
+
+        While performing codegen we need to make the GlobalData explicitly
+        aware of the codeblock being compiled, as compilation may trigger GC
+        and CodeBlock holds GC values, but has not yet been assigned to its
+        owner executable.
+
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::BytecodeGenerator):
+        (JSC::BytecodeGenerator::~BytecodeGenerator):
+        * bytecompiler/BytecodeGenerator.h:
+        * heap/AllocationSpace.cpp:
+        (JSC::AllocationSpace::allocateSlowCase):
+        * heap/Heap.cpp:
+        (JSC::Heap::markRoots):
+        * runtime/JSGlobalData.cpp:
+        (JSC::JSGlobalData::JSGlobalData):
+        * runtime/JSGlobalData.h:
+        (JSC::JSGlobalData::startedCompiling):
+        (JSC::JSGlobalData::finishedCompiling):
+
 2011-10-24  Filip Pizlo  <fpizlo@apple.com>
 

trunk/Source/JavaScriptCore/bytecompiler/BytecodeGenerator.cpp

@@ -220 +220 @@
     , m_expressionTooDeep(false)
 {
+    m_globalData->startedCompiling(m_codeBlock);
     if (m_shouldEmitDebugHooks)
         m_codeBlock->setNeedsFullScopeChain(true);
@@ -290 +291 @@
     , m_expressionTooDeep(false)
 {
+    m_globalData->startedCompiling(m_codeBlock);
     if (m_shouldEmitDebugHooks)
         m_codeBlock->setNeedsFullScopeChain(true);
@@ -451 +453 @@
     , m_expressionTooDeep(false)
 {
+    m_globalData->startedCompiling(m_codeBlock);
     if (m_shouldEmitDebugHooks || m_baseScopeDepth)
         m_codeBlock->setNeedsFullScopeChain(true);
@@ -471 +474 @@
     codeBlock->m_numCapturedVars = codeBlock->m_numVars;
     preserveLastVar();
+}
+
+BytecodeGenerator::~BytecodeGenerator()
+{
+    m_globalData->finishedCompiling(m_codeBlock);
 }
 

trunk/Source/JavaScriptCore/bytecompiler/BytecodeGenerator.h

@@ -97 +97 @@
         BytecodeGenerator(EvalNode*, ScopeChainNode*, SymbolTable*, EvalCodeBlock*, CompilationKind);
 
+        ~BytecodeGenerator();
+        
         JSGlobalData* globalData() const { return m_globalData; }
         const CommonIdentifiers& propertyNames() const { return *m_globalData->propertyNames; }

trunk/Source/JavaScriptCore/heap/AllocationSpace.cpp

@@ -45 +45 @@
 {
 #if COLLECT_ON_EVERY_ALLOCATION
-    collectAllGarbage();
+    m_heap->collectAllGarbage();
     ASSERT(m_heap->m_operationInProgress == NoOperation);
 #endif

trunk/Source/JavaScriptCore/heap/Heap.cpp

@@ -601 +601 @@
     }
 #endif
-
+    
+    if (CodeBlock* codeBlock = m_globalData->codeBlockBeingCompiled) {
+        GCPHASE(VisitActiveCodeBlock);
+        codeBlock->visitAggregate(visitor);
+    }
+    
     {
         GCPHASE(VisitMachineRoots);

trunk/Source/JavaScriptCore/runtime/JSGlobalData.cpp

@@ -180 +180 @@
     , propertyNames(new CommonIdentifiers(this))
     , emptyList(new MarkedArgumentBuffer)
+    , codeBlockBeingCompiled(0)
 #if ENABLE(ASSEMBLER)
     , executableAllocator(*this)

trunk/Source/JavaScriptCore/runtime/JSGlobalData.h

@@ -189 +189 @@
         NumericStrings numericStrings;
         DateInstanceCache dateInstanceCache;
-        
+        CodeBlock* codeBlockBeingCompiled;
+        void startedCompiling(CodeBlock* codeBlock)
+        {
+            ASSERT(!codeBlockBeingCompiled);
+            codeBlockBeingCompiled = codeBlock;
+        }
+
+        void finishedCompiling(CodeBlock* codeBlock)
+        {
+            ASSERT_UNUSED(codeBlock, codeBlock == codeBlockBeingCompiled);
+            codeBlockBeingCompiled = 0;
+        }
+
 #if ENABLE(ASSEMBLER)
         ExecutableAllocator executableAllocator;