Changeset 210829 in webkit


Ignore:
Timestamp:
Jan 17, 2017 3:52:55 PM (7 years ago)
Author:
fpizlo@apple.com
Message:

JSCell::classInfo() shouldn't have a bunch of mitigations for being called during destruction
​https://bugs.webkit.org/show_bug.cgi?id=167066

Reviewed by Keith Miller and Michael Saboff.
Source/JavaScriptCore:


This reduces the size of JSCell::classInfo() by half and removes some checks that
this function previously had to do in case it was called from destructors.

I changed all of the destructors so that they don't call JSCell::classInfo() and I
added an assertion to JSCell::classInfo() to catch cases where someone called it
from a destructor accidentally.

This means that we only have one place in destruction that needs to know the class:
the sweeper's call to the destructor.

One of the trickiest outcomes of this is the need to support inherits() tests in
JSObjectGetPrivate(), when it is called from the destructor callback on the object
being destructed. JSObjectGetPrivate() is undefined behavior anyway if you use it
on any dead-but-not-destructed object other than the one being destructed right
now. The purpose of the inherits() tests is to distinguish between different kinds
of CallbackObjects, which may have different kinds of base classes. I think that
this was always subtly wrong - for example, if the object being destructed is a
JSGlobalObject then it's not a DestructibleObject, is not in a destructor block,
but does not have an immortal Structure - so classInfo() is not valid. This fixes
the issue by having ~JSCallbackObject know its classInfo. It now stashes its
classInfo in VM so that JSObjectGetPrivate can use that classInfo if it detects
that it's being used on a currently-destructing object.

That was the only really weird part of this patch. The rest is mostly removing
illegal uses of jsCast<> in destructors. There were a few other genuine uses of
classInfo() but they were in code that already knew how to get its classInfo()
using other means:

  • You can still say structure()->classInfo(), and I use this form in code that knows that its StructureIsImmortal.


  • You can use this->classInfo() if it's overridden, like in subclasses of JSDestructibleObject.


Rolling this back in because I think I fixed the crashes.

  • API/JSAPIWrapperObject.mm:

(JSAPIWrapperObjectHandleOwner::finalize):

  • API/JSCallbackObject.h:
  • API/JSCallbackObjectFunctions.h:

(JSC::JSCallbackObject<Parent>::~JSCallbackObject):
(JSC::JSCallbackObject<Parent>::init):

  • API/JSObjectRef.cpp:

(classInfoPrivate):
(JSObjectGetPrivate):
(JSObjectSetPrivate):

  • bytecode/EvalCodeBlock.cpp:

(JSC::EvalCodeBlock::destroy):

  • bytecode/FunctionCodeBlock.cpp:

(JSC::FunctionCodeBlock::destroy):

  • bytecode/ModuleProgramCodeBlock.cpp:

(JSC::ModuleProgramCodeBlock::destroy):

  • bytecode/ProgramCodeBlock.cpp:

(JSC::ProgramCodeBlock::destroy):

  • bytecode/UnlinkedEvalCodeBlock.cpp:

(JSC::UnlinkedEvalCodeBlock::destroy):

  • bytecode/UnlinkedFunctionCodeBlock.cpp:

(JSC::UnlinkedFunctionCodeBlock::destroy):

  • bytecode/UnlinkedFunctionExecutable.cpp:

(JSC::UnlinkedFunctionExecutable::destroy):

  • bytecode/UnlinkedModuleProgramCodeBlock.cpp:

(JSC::UnlinkedModuleProgramCodeBlock::destroy):

  • bytecode/UnlinkedProgramCodeBlock.cpp:

(JSC::UnlinkedProgramCodeBlock::destroy):

  • heap/CodeBlockSet.cpp:

(JSC::CodeBlockSet::lastChanceToFinalize):
(JSC::CodeBlockSet::deleteUnmarkedAndUnreferenced):

  • heap/MarkedAllocator.cpp:

(JSC::MarkedAllocator::allocateSlowCaseImpl):

  • heap/MarkedBlock.cpp:

(JSC::MarkedBlock::Handle::sweep):

  • jit/JITThunks.cpp:

(JSC::JITThunks::finalize):

  • runtime/AbstractModuleRecord.cpp:

(JSC::AbstractModuleRecord::destroy):

  • runtime/ExecutableBase.cpp:

(JSC::ExecutableBase::clearCode):

  • runtime/JSCellInlines.h:

(JSC::JSCell::classInfo):
(JSC::JSCell::callDestructor):

  • runtime/JSLock.h:

(JSC::JSLock::ownerThread):

  • runtime/JSModuleNamespaceObject.cpp:

(JSC::JSModuleNamespaceObject::destroy):

  • runtime/JSModuleRecord.cpp:

(JSC::JSModuleRecord::destroy):

  • runtime/JSPropertyNameEnumerator.cpp:

(JSC::JSPropertyNameEnumerator::destroy):

  • runtime/JSSegmentedVariableObject.h:
  • runtime/SymbolTable.cpp:

(JSC::SymbolTable::destroy):

  • runtime/VM.h:
  • wasm/js/JSWebAssemblyCallee.cpp:

(JSC::JSWebAssemblyCallee::destroy):

  • wasm/js/WebAssemblyModuleRecord.cpp:

(JSC::WebAssemblyModuleRecord::destroy):

  • wasm/js/WebAssemblyToJSCallee.cpp:

(JSC::WebAssemblyToJSCallee::WebAssemblyToJSCallee):
(JSC::WebAssemblyToJSCallee::destroy):

Source/WebCore:

No new tests because no new behavior.

It's now necessary to avoid jsCast in destructors and finalizers. This was an easy
rule to introduce because this used to always be the rule.

  • bindings/js/JSCSSValueCustom.cpp:

(WebCore::JSDeprecatedCSSOMValueOwner::finalize):

  • bindings/js/JSDOMIterator.h:

(WebCore::IteratorTraits>::destroy):

  • bindings/scripts/CodeGeneratorJS.pm:

(GenerateImplementation):

Source/WebKit2:


Just remove now-erroneous use of jsCast<>.

  • WebProcess/Plugins/Netscape/NPRuntimeObjectMap.cpp:

(WebKit::NPRuntimeObjectMap::finalize):

Location:
trunk/Source
Files:
60 edited

Legend:

Unmodified
Added
Removed

  • trunk/Source/JavaScriptCore/API/JSAPIWrapperObject.mm

    r210824 r210829  
    4949void JSAPIWrapperObjectHandleOwner::finalize(JSC::Handle<JSC::Unknown> handle, void*)
    5050{
    51     JSC::JSAPIWrapperObject* wrapperObject = JSC::jsCast<JSC::JSAPIWrapperObject*>(handle.get().asCell());
     51    JSC::JSAPIWrapperObject* wrapperObject = static_cast<JSC::JSAPIWrapperObject*>(handle.get().asCell());
    5252    if (!wrapperObject->wrappedObject())
    5353        return;

  • trunk/Source/JavaScriptCore/API/JSCallbackObject.h

    r210824 r210829  
    233233
    234234    std::unique_ptr<JSCallbackObjectData> m_callbackObjectData;
     235    const ClassInfo* m_classInfo;
    235236};
    236237

  • trunk/Source/JavaScriptCore/API/JSCallbackObjectFunctions.h

    r210824 r210829  
    7575JSCallbackObject<Parent>::~JSCallbackObject()
    7676{
     77    VM* vm = this->HeapCell::vm();
     78    vm->currentlyDestructingCallbackObject = this;
     79    ASSERT(m_classInfo);
     80    vm->currentlyDestructingCallbackObjectClassInfo = m_classInfo;
    7781    JSObjectRef thisRef = toRef(static_cast<JSObject*>(this));
    7882    for (JSClassRef jsClass = classRef(); jsClass; jsClass = jsClass->parentClass) {
    … …  
    8084            finalize(thisRef);
    8185    }
     86    vm->currentlyDestructingCallbackObject = nullptr;
     87    vm->currentlyDestructingCallbackObjectClassInfo = nullptr;
    8288}
    8389   
    … …  
    118124        initialize(toRef(exec), toRef(this));
    119125    }
     126   
     127    m_classInfo = this->classInfo();
    120128}
    121129

  • trunk/Source/JavaScriptCore/API/JSObjectRef.cpp

    r210824 r210829  
    381381}
    382382
     383// API objects have private properties, which may get accessed during destruction. This
     384// helper lets us get the ClassInfo of an API object from a function that may get called
     385// during destruction.
     386static const ClassInfo* classInfoPrivate(JSObject* jsObject)
     387{
     388    VM* vm = jsObject->vm();
     389   
     390    if (vm->currentlyDestructingCallbackObject != jsObject)
     391        return jsObject->classInfo();
     392
     393    return vm->currentlyDestructingCallbackObjectClassInfo;
     394}
     395
    383396void* JSObjectGetPrivate(JSObjectRef object)
    384397{
    385398    JSObject* jsObject = uncheckedToJS(object);
    386399
     400    const ClassInfo* classInfo = classInfoPrivate(jsObject);
     401   
    387402    // Get wrapped object if proxied
    388     if (jsObject->inherits(JSProxy::info()))
     403    if (classInfo->isSubClassOf(JSProxy::info())) {
     404        jsObject = static_cast<JSProxy*>(jsObject)->target();
     405        classInfo = jsObject->classInfo();
     406    }
     407
     408    if (classInfo->isSubClassOf(JSCallbackObject<JSGlobalObject>::info()))
     409        return static_cast<JSCallbackObject<JSGlobalObject>*>(jsObject)->getPrivate();
     410    if (classInfo->isSubClassOf(JSCallbackObject<JSDestructibleObject>::info()))
     411        return static_cast<JSCallbackObject<JSDestructibleObject>*>(jsObject)->getPrivate();
     412#if JSC_OBJC_API_ENABLED
     413    if (classInfo->isSubClassOf(JSCallbackObject<JSAPIWrapperObject>::info()))
     414        return static_cast<JSCallbackObject<JSAPIWrapperObject>*>(jsObject)->getPrivate();
     415#endif
     416   
     417    return 0;
     418}
     419
     420bool JSObjectSetPrivate(JSObjectRef object, void* data)
     421{
     422    JSObject* jsObject = uncheckedToJS(object);
     423
     424    const ClassInfo* classInfo = classInfoPrivate(jsObject);
     425   
     426    // Get wrapped object if proxied
     427    if (classInfo->isSubClassOf(JSProxy::info())) {
    389428        jsObject = jsCast<JSProxy*>(jsObject)->target();
    390 
    391     if (jsObject->inherits(JSCallbackObject<JSGlobalObject>::info()))
    392         return jsCast<JSCallbackObject<JSGlobalObject>*>(jsObject)->getPrivate();
    393     if (jsObject->inherits(JSCallbackObject<JSDestructibleObject>::info()))
    394         return jsCast<JSCallbackObject<JSDestructibleObject>*>(jsObject)->getPrivate();
     429        classInfo = jsObject->classInfo();
     430    }
     431
     432    if (classInfo->isSubClassOf(JSCallbackObject<JSGlobalObject>::info())) {
     433        jsCast<JSCallbackObject<JSGlobalObject>*>(jsObject)->setPrivate(data);
     434        return true;
     435    }
     436    if (classInfo->isSubClassOf(JSCallbackObject<JSDestructibleObject>::info())) {
     437        jsCast<JSCallbackObject<JSDestructibleObject>*>(jsObject)->setPrivate(data);
     438        return true;
     439    }
    395440#if JSC_OBJC_API_ENABLED
    396     if (jsObject->inherits(JSCallbackObject<JSAPIWrapperObject>::info()))
    397         return jsCast<JSCallbackObject<JSAPIWrapperObject>*>(jsObject)->getPrivate();
    398 #endif
    399    
    400     return 0;
    401 }
    402 
    403 bool JSObjectSetPrivate(JSObjectRef object, void* data)
    404 {
    405     JSObject* jsObject = uncheckedToJS(object);
    406 
    407     // Get wrapped object if proxied
    408     if (jsObject->inherits(JSProxy::info()))
    409         jsObject = jsCast<JSProxy*>(jsObject)->target();
    410 
    411     if (jsObject->inherits(JSCallbackObject<JSGlobalObject>::info())) {
    412         jsCast<JSCallbackObject<JSGlobalObject>*>(jsObject)->setPrivate(data);
    413         return true;
    414     }
    415     if (jsObject->inherits(JSCallbackObject<JSDestructibleObject>::info())) {
    416         jsCast<JSCallbackObject<JSDestructibleObject>*>(jsObject)->setPrivate(data);
    417         return true;
    418     }
    419 #if JSC_OBJC_API_ENABLED
    420     if (jsObject->inherits(JSCallbackObject<JSAPIWrapperObject>::info())) {
     441    if (classInfo->isSubClassOf(JSCallbackObject<JSAPIWrapperObject>::info())) {
    421442        jsCast<JSCallbackObject<JSAPIWrapperObject>*>(jsObject)->setPrivate(data);
    422443        return true;

  • trunk/Source/JavaScriptCore/ChangeLog

    r210824 r210829  
     12017-01-16  Filip Pizlo  <fpizlo@apple.com>
     2
     3        JSCell::classInfo() shouldn't have a bunch of mitigations for being called during destruction
     4        https://bugs.webkit.org/show_bug.cgi?id=167066
     5
     6        Reviewed by Keith Miller and Michael Saboff.
     7       
     8        This reduces the size of JSCell::classInfo() by half and removes some checks that
     9        this function previously had to do in case it was called from destructors.
     10       
     11        I changed all of the destructors so that they don't call JSCell::classInfo() and I
     12        added an assertion to JSCell::classInfo() to catch cases where someone called it
     13        from a destructor accidentally.
     14       
     15        This means that we only have one place in destruction that needs to know the class:
     16        the sweeper's call to the destructor.
     17       
     18        One of the trickiest outcomes of this is the need to support inherits() tests in
     19        JSObjectGetPrivate(), when it is called from the destructor callback on the object
     20        being destructed. JSObjectGetPrivate() is undefined behavior anyway if you use it
     21        on any dead-but-not-destructed object other than the one being destructed right
     22        now. The purpose of the inherits() tests is to distinguish between different kinds
     23        of CallbackObjects, which may have different kinds of base classes. I think that
     24        this was always subtly wrong - for example, if the object being destructed is a
     25        JSGlobalObject then it's not a DestructibleObject, is not in a destructor block,
     26        but does not have an immortal Structure - so classInfo() is not valid. This fixes
     27        the issue by having ~JSCallbackObject know its classInfo. It now stashes its
     28        classInfo in VM so that JSObjectGetPrivate can use that classInfo if it detects
     29        that it's being used on a currently-destructing object.
     30       
     31        That was the only really weird part of this patch. The rest is mostly removing
     32        illegal uses of jsCast<> in destructors. There were a few other genuine uses of
     33        classInfo() but they were in code that already knew how to get its classInfo()
     34        using other means:
     35       
     36        - You can still say structure()->classInfo(), and I use this form in code that
     37          knows that its StructureIsImmortal.
     38       
     39        - You can use this->classInfo() if it's overridden, like in subclasses of
     40          JSDestructibleObject.
     41       
     42        Rolling this back in because I think I fixed the crashes.
     43
     44        * API/JSAPIWrapperObject.mm:
     45        (JSAPIWrapperObjectHandleOwner::finalize):
     46        * API/JSCallbackObject.h:
     47        * API/JSCallbackObjectFunctions.h:
     48        (JSC::JSCallbackObject<Parent>::~JSCallbackObject):
     49        (JSC::JSCallbackObject<Parent>::init):
     50        * API/JSObjectRef.cpp:
     51        (classInfoPrivate):
     52        (JSObjectGetPrivate):
     53        (JSObjectSetPrivate):
     54        * bytecode/EvalCodeBlock.cpp:
     55        (JSC::EvalCodeBlock::destroy):
     56        * bytecode/FunctionCodeBlock.cpp:
     57        (JSC::FunctionCodeBlock::destroy):
     58        * bytecode/ModuleProgramCodeBlock.cpp:
     59        (JSC::ModuleProgramCodeBlock::destroy):
     60        * bytecode/ProgramCodeBlock.cpp:
     61        (JSC::ProgramCodeBlock::destroy):
     62        * bytecode/UnlinkedEvalCodeBlock.cpp:
     63        (JSC::UnlinkedEvalCodeBlock::destroy):
     64        * bytecode/UnlinkedFunctionCodeBlock.cpp:
     65        (JSC::UnlinkedFunctionCodeBlock::destroy):
     66        * bytecode/UnlinkedFunctionExecutable.cpp:
     67        (JSC::UnlinkedFunctionExecutable::destroy):
     68        * bytecode/UnlinkedModuleProgramCodeBlock.cpp:
     69        (JSC::UnlinkedModuleProgramCodeBlock::destroy):
     70        * bytecode/UnlinkedProgramCodeBlock.cpp:
     71        (JSC::UnlinkedProgramCodeBlock::destroy):
     72        * heap/CodeBlockSet.cpp:
     73        (JSC::CodeBlockSet::lastChanceToFinalize):
     74        (JSC::CodeBlockSet::deleteUnmarkedAndUnreferenced):
     75        * heap/MarkedAllocator.cpp:
     76        (JSC::MarkedAllocator::allocateSlowCaseImpl):
     77        * heap/MarkedBlock.cpp:
     78        (JSC::MarkedBlock::Handle::sweep):
     79        * jit/JITThunks.cpp:
     80        (JSC::JITThunks::finalize):
     81        * runtime/AbstractModuleRecord.cpp:
     82        (JSC::AbstractModuleRecord::destroy):
     83        * runtime/ExecutableBase.cpp:
     84        (JSC::ExecutableBase::clearCode):
     85        * runtime/JSCellInlines.h:
     86        (JSC::JSCell::classInfo):
     87        (JSC::JSCell::callDestructor):
     88        * runtime/JSLock.h:
     89        (JSC::JSLock::ownerThread):
     90        * runtime/JSModuleNamespaceObject.cpp:
     91        (JSC::JSModuleNamespaceObject::destroy):
     92        * runtime/JSModuleRecord.cpp:
     93        (JSC::JSModuleRecord::destroy):
     94        * runtime/JSPropertyNameEnumerator.cpp:
     95        (JSC::JSPropertyNameEnumerator::destroy):
     96        * runtime/JSSegmentedVariableObject.h:
     97        * runtime/SymbolTable.cpp:
     98        (JSC::SymbolTable::destroy):
     99        * runtime/VM.h:
     100        * wasm/js/JSWebAssemblyCallee.cpp:
     101        (JSC::JSWebAssemblyCallee::destroy):
     102        * wasm/js/WebAssemblyModuleRecord.cpp:
     103        (JSC::WebAssemblyModuleRecord::destroy):
     104        * wasm/js/WebAssemblyToJSCallee.cpp:
     105        (JSC::WebAssemblyToJSCallee::WebAssemblyToJSCallee):
     106        (JSC::WebAssemblyToJSCallee::destroy):
     107
    11082017-01-17  Filip Pizlo  <fpizlo@apple.com>
    2109

  • trunk/Source/JavaScriptCore/bytecode/EvalCodeBlock.cpp

    r210824 r210829  
    4040void EvalCodeBlock::destroy(JSCell* cell)
    4141{
    42     jsCast<EvalCodeBlock*>(cell)->~EvalCodeBlock();
     42    static_cast<EvalCodeBlock*>(cell)->~EvalCodeBlock();
    4343}
    4444

  • trunk/Source/JavaScriptCore/bytecode/FunctionCodeBlock.cpp

    r210824 r210829  
    4040void FunctionCodeBlock::destroy(JSCell* cell)
    4141{
    42     jsCast<FunctionCodeBlock*>(cell)->~FunctionCodeBlock();
     42    static_cast<FunctionCodeBlock*>(cell)->~FunctionCodeBlock();
    4343}
    4444

  • trunk/Source/JavaScriptCore/bytecode/ModuleProgramCodeBlock.cpp

    r210824 r210829  
    4040void ModuleProgramCodeBlock::destroy(JSCell* cell)
    4141{
    42     jsCast<ModuleProgramCodeBlock*>(cell)->~ModuleProgramCodeBlock();
     42    static_cast<ModuleProgramCodeBlock*>(cell)->~ModuleProgramCodeBlock();
    4343}
    4444

  • trunk/Source/JavaScriptCore/bytecode/ProgramCodeBlock.cpp

    r210824 r210829  
    4040void ProgramCodeBlock::destroy(JSCell* cell)
    4141{
    42     jsCast<ProgramCodeBlock*>(cell)->~ProgramCodeBlock();
     42    static_cast<ProgramCodeBlock*>(cell)->~ProgramCodeBlock();
    4343}
    4444

  • trunk/Source/JavaScriptCore/bytecode/UnlinkedEvalCodeBlock.cpp

    r210824 r210829  
    3535void UnlinkedEvalCodeBlock::destroy(JSCell* cell)
    3636{
    37     jsCast<UnlinkedEvalCodeBlock*>(cell)->~UnlinkedEvalCodeBlock();
     37    static_cast<UnlinkedEvalCodeBlock*>(cell)->~UnlinkedEvalCodeBlock();
    3838}
    3939

  • trunk/Source/JavaScriptCore/bytecode/UnlinkedFunctionCodeBlock.cpp

    r210824 r210829  
    3535void UnlinkedFunctionCodeBlock::destroy(JSCell* cell)
    3636{
    37     jsCast<UnlinkedFunctionCodeBlock*>(cell)->~UnlinkedFunctionCodeBlock();
     37    static_cast<UnlinkedFunctionCodeBlock*>(cell)->~UnlinkedFunctionCodeBlock();
    3838}
    3939

  • trunk/Source/JavaScriptCore/bytecode/UnlinkedFunctionExecutable.cpp

    r210824 r210829  
    120120void UnlinkedFunctionExecutable::destroy(JSCell* cell)
    121121{
    122     jsCast<UnlinkedFunctionExecutable*>(cell)->~UnlinkedFunctionExecutable();
     122    static_cast<UnlinkedFunctionExecutable*>(cell)->~UnlinkedFunctionExecutable();
    123123}
    124124

  • trunk/Source/JavaScriptCore/bytecode/UnlinkedModuleProgramCodeBlock.cpp

    r210824 r210829  
    4343void UnlinkedModuleProgramCodeBlock::destroy(JSCell* cell)
    4444{
    45     jsCast<UnlinkedModuleProgramCodeBlock*>(cell)->~UnlinkedModuleProgramCodeBlock();
     45    static_cast<UnlinkedModuleProgramCodeBlock*>(cell)->~UnlinkedModuleProgramCodeBlock();
    4646}
    4747

  • trunk/Source/JavaScriptCore/bytecode/UnlinkedProgramCodeBlock.cpp

    r210824 r210829  
    4343void UnlinkedProgramCodeBlock::destroy(JSCell* cell)
    4444{
    45     jsCast<UnlinkedProgramCodeBlock*>(cell)->~UnlinkedProgramCodeBlock();
     45    static_cast<UnlinkedProgramCodeBlock*>(cell)->~UnlinkedProgramCodeBlock();
    4646}
    4747

  • trunk/Source/JavaScriptCore/heap/CodeBlockSet.cpp

    r210824 r210829  
    6666    LockHolder locker(&m_lock);
    6767    for (CodeBlock* codeBlock : m_newCodeBlocks)
    68         codeBlock->classInfo()->methodTable.destroy(codeBlock);
     68        codeBlock->structure()->classInfo()->methodTable.destroy(codeBlock);
    6969
    7070    for (CodeBlock* codeBlock : m_oldCodeBlocks)
    71         codeBlock->classInfo()->methodTable.destroy(codeBlock);
     71        codeBlock->structure()->classInfo()->methodTable.destroy(codeBlock);
    7272}
    7373
    … …  
    8484        }
    8585        for (CodeBlock* codeBlock : unmarked) {
    86             codeBlock->classInfo()->methodTable.destroy(codeBlock);
     86            codeBlock->structure()->classInfo()->methodTable.destroy(codeBlock);
    8787            set.remove(codeBlock);
    8888        }

  • trunk/Source/JavaScriptCore/heap/MarkedAllocator.cpp

    r210824 r210829  
    212212    didConsumeFreeList();
    213213   
    214     AllocatingScope healpingHeap(*m_heap);
     214    AllocatingScope helpingHeap(*m_heap);
    215215
    216216    m_heap->collectIfNecessaryOrDefer(deferralContext);

  • trunk/Source/JavaScriptCore/heap/MarkedBlock.cpp

    r210824 r210829  
    2727#include "MarkedBlock.h"
    2828
     29#include "HelpingGCScope.h"
    2930#include "JSCell.h"
    3031#include "JSDestructibleObject.h"
    … …  
    196197FreeList MarkedBlock::Handle::sweep(SweepMode sweepMode)
    197198{
     199    // FIXME: Maybe HelpingGCScope should just be called SweepScope?
     200    HelpingGCScope helpingGCScope(*heap());
     201   
    198202    m_allocator->setIsUnswept(NoLockingNecessary, this, false);
    199203   

  • trunk/Source/JavaScriptCore/jit/JITThunks.cpp

    r210824 r210829  
    8585void JITThunks::finalize(Handle<Unknown> handle, void*)
    8686{
    87     auto* nativeExecutable = jsCast<NativeExecutable*>(handle.get().asCell());
     87    auto* nativeExecutable = static_cast<NativeExecutable*>(handle.get().asCell());
    8888    weakRemove(*m_hostFunctionStubMap, std::make_tuple(nativeExecutable->function(), nativeExecutable->constructor(), nativeExecutable->name()), nativeExecutable);
    8989}

  • trunk/Source/JavaScriptCore/runtime/AbstractModuleRecord.cpp

    r210824 r210829  
    4747void AbstractModuleRecord::destroy(JSCell* cell)
    4848{
    49     AbstractModuleRecord* thisObject = jsCast<AbstractModuleRecord*>(cell);
     49    AbstractModuleRecord* thisObject = static_cast<AbstractModuleRecord*>(cell);
    5050    thisObject->AbstractModuleRecord::~AbstractModuleRecord();
    5151}

  • trunk/Source/JavaScriptCore/runtime/ExecutableBase.cpp

    r210824 r210829  
    6161    m_numParametersForConstruct = NUM_PARAMETERS_NOT_COMPILED;
    6262
    63     if (classInfo() == FunctionExecutable::info()) {
    64         FunctionExecutable* executable = jsCast<FunctionExecutable*>(this);
     63    if (structure()->classInfo() == FunctionExecutable::info()) {
     64        FunctionExecutable* executable = static_cast<FunctionExecutable*>(this);
    6565        executable->m_codeBlockForCall.clear();
    6666        executable->m_codeBlockForConstruct.clear();
    … …  
    6868    }
    6969
    70     if (classInfo() == EvalExecutable::info()) {
    71         EvalExecutable* executable = jsCast<EvalExecutable*>(this);
     70    if (structure()->classInfo() == EvalExecutable::info()) {
     71        EvalExecutable* executable = static_cast<EvalExecutable*>(this);
    7272        executable->m_evalCodeBlock.clear();
    7373        executable->m_unlinkedEvalCodeBlock.clear();
    … …  
    7575    }
    7676   
    77     if (classInfo() == ProgramExecutable::info()) {
    78         ProgramExecutable* executable = jsCast<ProgramExecutable*>(this);
     77    if (structure()->classInfo() == ProgramExecutable::info()) {
     78        ProgramExecutable* executable = static_cast<ProgramExecutable*>(this);
    7979        executable->m_programCodeBlock.clear();
    8080        executable->m_unlinkedProgramCodeBlock.clear();
    … …  
    8282    }
    8383
    84     if (classInfo() == ModuleProgramExecutable::info()) {
    85         ModuleProgramExecutable* executable = jsCast<ModuleProgramExecutable*>(this);
     84    if (structure()->classInfo() == ModuleProgramExecutable::info()) {
     85        ModuleProgramExecutable* executable = static_cast<ModuleProgramExecutable*>(this);
    8686        executable->m_moduleProgramCodeBlock.clear();
    8787        executable->m_unlinkedModuleProgramCodeBlock.clear();
    … …  
    9090    }
    9191   
    92     ASSERT(classInfo() == NativeExecutable::info());
     92    ASSERT(structure()->classInfo() == NativeExecutable::info());
    9393}
    9494

  • trunk/Source/JavaScriptCore/runtime/JSCellInlines.h

    r210824 r210829  
    268268ALWAYS_INLINE const ClassInfo* JSCell::classInfo() const
    269269{
    270     if (isLargeAllocation()) {
    271         LargeAllocation& allocation = largeAllocation();
    272         if (allocation.attributes().destruction == NeedsDestruction
    273             && !(inlineTypeFlags() & StructureIsImmortal))
    274             return static_cast<const JSDestructibleObject*>(this)->classInfo();
    275         return structure(*allocation.vm())->classInfo();
    276     }
    277     MarkedBlock& block = markedBlock();
    278     if (block.needsDestruction() && !(inlineTypeFlags() & StructureIsImmortal))
    279         return static_cast<const JSDestructibleObject*>(this)->classInfo();
    280     return structure(*block.vm())->classInfo();
     270    VM* vm;
     271    if (isLargeAllocation())
     272        vm = largeAllocation().vm();
     273    else
     274        vm = markedBlock().vm();
     275    ASSERT(vm->heap.mutatorState() == MutatorState::Running || vm->apiLock().ownerThread() != std::this_thread::get_id());
     276    return structure(*vm)->classInfo();
    281277}
    282278
    … …  
    308304        destroy(this);
    309305    } else
    310         jsCast<JSDestructibleObject*>(this)->classInfo()->methodTable.destroy(this);
     306        static_cast<JSDestructibleObject*>(this)->classInfo()->methodTable.destroy(this);
    311307    zap();
    312308}

  • trunk/Source/JavaScriptCore/runtime/JSLock.h

    r210824 r210829  
    100100        return m_ownerThreadID;
    101101    }
     102    std::thread::id ownerThread() const { return m_ownerThreadID; }
    102103    JS_EXPORT_PRIVATE void setExclusiveThread(std::thread::id);
    103104    JS_EXPORT_PRIVATE bool currentThreadIsHoldingLock();

  • trunk/Source/JavaScriptCore/runtime/JSModuleNamespaceObject.cpp

    r210824 r210829  
    8484void JSModuleNamespaceObject::destroy(JSCell* cell)
    8585{
    86     JSModuleNamespaceObject* thisObject = jsCast<JSModuleNamespaceObject*>(cell);
     86    JSModuleNamespaceObject* thisObject = static_cast<JSModuleNamespaceObject*>(cell);
    8787    thisObject->JSModuleNamespaceObject::~JSModuleNamespaceObject();
    8888}

  • trunk/Source/JavaScriptCore/runtime/JSModuleRecord.cpp

    r210824 r210829  
    6060void JSModuleRecord::destroy(JSCell* cell)
    6161{
    62     JSModuleRecord* thisObject = jsCast<JSModuleRecord*>(cell);
     62    JSModuleRecord* thisObject = static_cast<JSModuleRecord*>(cell);
    6363    thisObject->JSModuleRecord::~JSModuleRecord();
    6464}

  • trunk/Source/JavaScriptCore/runtime/JSPropertyNameEnumerator.cpp

    r210824 r210829  
    8484void JSPropertyNameEnumerator::destroy(JSCell* cell)
    8585{
    86     jsCast<JSPropertyNameEnumerator*>(cell)->JSPropertyNameEnumerator::~JSPropertyNameEnumerator();
     86    static_cast<JSPropertyNameEnumerator*>(cell)->JSPropertyNameEnumerator::~JSPropertyNameEnumerator();
    8787}
    8888

  • trunk/Source/JavaScriptCore/runtime/JSSegmentedVariableObject.h

    r210824 r210829  
    4747// JSSegmentedVariableObject has its own GC tracing functionality, since it knows the
    4848// exact dimensions of the variables array at all times.
     49
     50// Except for JSGlobalObject, subclasses of this don't call the destructor and leak memory.
    4951
    5052class JSSegmentedVariableObject : public JSSymbolTableObject {

  • trunk/Source/JavaScriptCore/runtime/StructureInlines.h

    r209570 r210829  
    260260        return true;
    261261   
    262     RELEASE_ASSERT(numberOfSlotsForLastOffset(m_offset, m_inlineCapacity) == propertyTable->propertyStorageSize());
    263262    unsigned totalSize = propertyTable->propertyStorageSize();
    264     RELEASE_ASSERT((totalSize < inlineCapacity() ? 0 : totalSize - inlineCapacity()) == numberOfOutOfLineSlotsForLastOffset(m_offset));
     263    unsigned inlineOverflowAccordingToTotalSize = totalSize < m_inlineCapacity ? 0 : totalSize - m_inlineCapacity;
     264
     265    auto fail = [&] (const char* description) {
     266        dataLog("Detected offset inconsistency: ", description, "!\n");
     267        dataLog("this = ", RawPointer(this), "\n");
     268        dataLog("m_offset = ", m_offset, "\n");
     269        dataLog("m_inlineCapacity = ", m_inlineCapacity, "\n");
     270        dataLog("propertyTable = ", RawPointer(propertyTable), "\n");
     271        dataLog("numberOfSlotsForLastOffset = ", numberOfSlotsForLastOffset(m_offset, m_inlineCapacity), "\n");
     272        dataLog("totalSize = ", totalSize, "\n");
     273        dataLog("inlineOverflowAccordingToTotalSize = ", inlineOverflowAccordingToTotalSize, "\n");
     274        dataLog("numberOfOutOfLineSlotsForLastOffset = ", numberOfOutOfLineSlotsForLastOffset(m_offset), "\n");
     275        UNREACHABLE_FOR_PLATFORM();
     276    };
     277   
     278    if (numberOfSlotsForLastOffset(m_offset, m_inlineCapacity) != totalSize)
     279        fail("numberOfSlotsForLastOffset doesn't match totalSize");
     280    if (inlineOverflowAccordingToTotalSize != numberOfOutOfLineSlotsForLastOffset(m_offset))
     281        fail("inlineOverflowAccordingToTotalSize doesn't match numberOfOutOfLineSlotsForLastOffset");
    265282
    266283    return true;

  • trunk/Source/JavaScriptCore/runtime/SymbolTable.cpp

    r210824 r210829  
    5050void SymbolTable::destroy(JSCell* cell)
    5151{
    52     SymbolTable* thisObject = jsCast<SymbolTable*>(cell);
     52    SymbolTable* thisObject = static_cast<SymbolTable*>(cell);
    5353    thisObject->SymbolTable::~SymbolTable();
    5454}

  • trunk/Source/JavaScriptCore/runtime/VM.h

    r210824 r210829  
    364364    std::unique_ptr<Wasm::SignatureInformation> m_wasmSignatureInformation;
    365365#endif
     366   
     367    JSCell* currentlyDestructingCallbackObject;
     368    const ClassInfo* currentlyDestructingCallbackObjectClassInfo;
    366369
    367370    AtomicStringTable* m_atomicStringTable;

  • trunk/Source/JavaScriptCore/wasm/js/JSWebAssemblyCallee.cpp

    r210824 r210829  
    4848void JSWebAssemblyCallee::destroy(JSCell* cell)
    4949{
    50     JSWebAssemblyCallee* thisObject = jsCast<JSWebAssemblyCallee*>(cell);
     50    JSWebAssemblyCallee* thisObject = static_cast<JSWebAssemblyCallee*>(cell);
    5151    thisObject->JSWebAssemblyCallee::~JSWebAssemblyCallee();
    5252}

  • trunk/Source/JavaScriptCore/wasm/js/WebAssemblyModuleRecord.cpp

    r210824 r210829  
    6565void WebAssemblyModuleRecord::destroy(JSCell* cell)
    6666{
    67     WebAssemblyModuleRecord* thisObject = jsCast<WebAssemblyModuleRecord*>(cell);
     67    WebAssemblyModuleRecord* thisObject = static_cast<WebAssemblyModuleRecord*>(cell);
    6868    thisObject->WebAssemblyModuleRecord::~WebAssemblyModuleRecord();
    6969}

  • trunk/Source/JavaScriptCore/wasm/js/WebAssemblyToJSCallee.cpp

    r210824 r210829  
    4949WebAssemblyToJSCallee::WebAssemblyToJSCallee(VM& vm, Structure* structure)
    5050    : Base(vm, structure)
    51 { }
     51{
     52}
    5253
    5354void WebAssemblyToJSCallee::finishCreation(VM& vm)
    … …  
    5859void WebAssemblyToJSCallee::destroy(JSCell* cell)
    5960{
    60     WebAssemblyToJSCallee* thisObject = jsCast<WebAssemblyToJSCallee*>(cell);
     61    WebAssemblyToJSCallee* thisObject = static_cast<WebAssemblyToJSCallee*>(cell);
    6162    thisObject->WebAssemblyToJSCallee::~WebAssemblyToJSCallee();
    6263}

  • trunk/Source/WebCore/ChangeLog

    r210828 r210829  
     12017-01-16  Filip Pizlo  <fpizlo@apple.com>
     2
     3        JSCell::classInfo() shouldn't have a bunch of mitigations for being called during destruction
     4        https://bugs.webkit.org/show_bug.cgi?id=167066
     5
     6        Reviewed by Keith Miller and Michael Saboff.
     7
     8        No new tests because no new behavior.
     9       
     10        It's now necessary to avoid jsCast in destructors and finalizers. This was an easy
     11        rule to introduce because this used to always be the rule.
     12
     13        * bindings/js/JSCSSValueCustom.cpp:
     14        (WebCore::JSDeprecatedCSSOMValueOwner::finalize):
     15        * bindings/js/JSDOMIterator.h:
     16        (WebCore::IteratorTraits>::destroy):
     17        * bindings/scripts/CodeGeneratorJS.pm:
     18        (GenerateImplementation):
     19
    1202017-01-17  Joseph Pecoraro  <pecoraro@apple.com>
    221

  • trunk/Source/WebCore/bindings/js/JSCSSValueCustom.cpp

    r210824 r210829  
    5151void JSDeprecatedCSSOMValueOwner::finalize(JSC::Handle<JSC::Unknown> handle, void* context)
    5252{
    53     JSDeprecatedCSSOMValue* jsCSSValue = jsCast<JSDeprecatedCSSOMValue*>(handle.slot()->asCell());
     53    JSDeprecatedCSSOMValue* jsCSSValue = static_cast<JSDeprecatedCSSOMValue*>(handle.slot()->asCell());
    5454    DOMWrapperWorld& world = *static_cast<DOMWrapperWorld*>(context);
    5555    world.m_deprecatedCSSOMValueRoots.remove(&jsCSSValue->wrapped());

  • trunk/Source/WebCore/bindings/js/JSDOMIterator.h

    r210824 r210829  
    226226void JSDOMIterator<JSWrapper, IteratorTraits>::destroy(JSCell* cell)
    227227{
    228     JSDOMIterator<JSWrapper, IteratorTraits>* thisObject = JSC::jsCast<JSDOMIterator<JSWrapper, IteratorTraits>*>(cell);
     228    JSDOMIterator<JSWrapper, IteratorTraits>* thisObject = static_cast<JSDOMIterator<JSWrapper, IteratorTraits>*>(cell);
    229229    thisObject->JSDOMIterator<JSWrapper, IteratorTraits>::~JSDOMIterator();
    230230}

  • trunk/Source/WebCore/bindings/scripts/CodeGeneratorJS.pm

    r210824 r210829  
    42444244        push(@implContent, "void JS${interfaceName}Owner::finalize(JSC::Handle<JSC::Unknown> handle, void* context)\n");
    42454245        push(@implContent, "{\n");
    4246         push(@implContent, "    auto* js${interfaceName} = jsCast<JS${interfaceName}*>(handle.slot()->asCell());\n");
     4246        push(@implContent, "    auto* js${interfaceName} = static_cast<JS${interfaceName}*>(handle.slot()->asCell());\n");
    42474247        push(@implContent, "    auto& world = *static_cast<DOMWrapperWorld*>(context);\n");
    42484248        push(@implContent, "    uncacheWrapper(world, &js${interfaceName}->wrapped(), js${interfaceName});\n");

  • trunk/Source/WebCore/bindings/scripts/test/JS/JSInterfaceName.cpp

    r208613 r210829  
    175175void JSInterfaceNameOwner::finalize(JSC::Handle<JSC::Unknown> handle, void* context)
    176176{
    177     auto* jsInterfaceName = jsCast<JSInterfaceName*>(handle.slot()->asCell());
     177    auto* jsInterfaceName = static_cast<JSInterfaceName*>(handle.slot()->asCell());
    178178    auto& world = *static_cast<DOMWrapperWorld*>(context);
    179179    uncacheWrapper(world, &jsInterfaceName->wrapped(), jsInterfaceName);

  • trunk/Source/WebCore/bindings/scripts/test/JS/JSTestActiveDOMObject.cpp

    r208688 r210829  
    256256void JSTestActiveDOMObjectOwner::finalize(JSC::Handle<JSC::Unknown> handle, void* context)
    257257{
    258     auto* jsTestActiveDOMObject = jsCast<JSTestActiveDOMObject*>(handle.slot()->asCell());
     258    auto* jsTestActiveDOMObject = static_cast<JSTestActiveDOMObject*>(handle.slot()->asCell());
    259259    auto& world = *static_cast<DOMWrapperWorld*>(context);
    260260    uncacheWrapper(world, &jsTestActiveDOMObject->wrapped(), jsTestActiveDOMObject);

  • trunk/Source/WebCore/bindings/scripts/test/JS/JSTestCEReactions.cpp

    r208688 r210829  
    316316void JSTestCEReactionsOwner::finalize(JSC::Handle<JSC::Unknown> handle, void* context)
    317317{
    318     auto* jsTestCEReactions = jsCast<JSTestCEReactions*>(handle.slot()->asCell());
     318    auto* jsTestCEReactions = static_cast<JSTestCEReactions*>(handle.slot()->asCell());
    319319    auto& world = *static_cast<DOMWrapperWorld*>(context);
    320320    uncacheWrapper(world, &jsTestCEReactions->wrapped(), jsTestCEReactions);

  • trunk/Source/WebCore/bindings/scripts/test/JS/JSTestCEReactionsStringifier.cpp

    r208688 r210829  
    233233void JSTestCEReactionsStringifierOwner::finalize(JSC::Handle<JSC::Unknown> handle, void* context)
    234234{
    235     auto* jsTestCEReactionsStringifier = jsCast<JSTestCEReactionsStringifier*>(handle.slot()->asCell());
     235    auto* jsTestCEReactionsStringifier = static_cast<JSTestCEReactionsStringifier*>(handle.slot()->asCell());
    236236    auto& world = *static_cast<DOMWrapperWorld*>(context);
    237237    uncacheWrapper(world, &jsTestCEReactionsStringifier->wrapped(), jsTestCEReactionsStringifier);

  • trunk/Source/WebCore/bindings/scripts/test/JS/JSTestClassWithJSBuiltinConstructor.cpp

    r208613 r210829  
    174174void JSTestClassWithJSBuiltinConstructorOwner::finalize(JSC::Handle<JSC::Unknown> handle, void* context)
    175175{
    176     auto* jsTestClassWithJSBuiltinConstructor = jsCast<JSTestClassWithJSBuiltinConstructor*>(handle.slot()->asCell());
     176    auto* jsTestClassWithJSBuiltinConstructor = static_cast<JSTestClassWithJSBuiltinConstructor*>(handle.slot()->asCell());
    177177    auto& world = *static_cast<DOMWrapperWorld*>(context);
    178178    uncacheWrapper(world, &jsTestClassWithJSBuiltinConstructor->wrapped(), jsTestClassWithJSBuiltinConstructor);

  • trunk/Source/WebCore/bindings/scripts/test/JS/JSTestCustomConstructorWithNoInterfaceObject.cpp

    r208613 r210829  
    165165void JSTestCustomConstructorWithNoInterfaceObjectOwner::finalize(JSC::Handle<JSC::Unknown> handle, void* context)
    166166{
    167     auto* jsTestCustomConstructorWithNoInterfaceObject = jsCast<JSTestCustomConstructorWithNoInterfaceObject*>(handle.slot()->asCell());
     167    auto* jsTestCustomConstructorWithNoInterfaceObject = static_cast<JSTestCustomConstructorWithNoInterfaceObject*>(handle.slot()->asCell());
    168168    auto& world = *static_cast<DOMWrapperWorld*>(context);
    169169    uncacheWrapper(world, &jsTestCustomConstructorWithNoInterfaceObject->wrapped(), jsTestCustomConstructorWithNoInterfaceObject);

  • trunk/Source/WebCore/bindings/scripts/test/JS/JSTestCustomNamedGetter.cpp

    r210675 r210829  
    228228void JSTestCustomNamedGetterOwner::finalize(JSC::Handle<JSC::Unknown> handle, void* context)
    229229{
    230     auto* jsTestCustomNamedGetter = jsCast<JSTestCustomNamedGetter*>(handle.slot()->asCell());
     230    auto* jsTestCustomNamedGetter = static_cast<JSTestCustomNamedGetter*>(handle.slot()->asCell());
    231231    auto& world = *static_cast<DOMWrapperWorld*>(context);
    232232    uncacheWrapper(world, &jsTestCustomNamedGetter->wrapped(), jsTestCustomNamedGetter);

  • trunk/Source/WebCore/bindings/scripts/test/JS/JSTestException.cpp

    r208613 r210829  
    198198void JSTestExceptionOwner::finalize(JSC::Handle<JSC::Unknown> handle, void* context)
    199199{
    200     auto* jsTestException = jsCast<JSTestException*>(handle.slot()->asCell());
     200    auto* jsTestException = static_cast<JSTestException*>(handle.slot()->asCell());
    201201    auto& world = *static_cast<DOMWrapperWorld*>(context);
    202202    uncacheWrapper(world, &jsTestException->wrapped(), jsTestException);

  • trunk/Source/WebCore/bindings/scripts/test/JS/JSTestGenerateIsReachable.cpp

    r208613 r210829  
    161161void JSTestGenerateIsReachableOwner::finalize(JSC::Handle<JSC::Unknown> handle, void* context)
    162162{
    163     auto* jsTestGenerateIsReachable = jsCast<JSTestGenerateIsReachable*>(handle.slot()->asCell());
     163    auto* jsTestGenerateIsReachable = static_cast<JSTestGenerateIsReachable*>(handle.slot()->asCell());
    164164    auto& world = *static_cast<DOMWrapperWorld*>(context);
    165165    uncacheWrapper(world, &jsTestGenerateIsReachable->wrapped(), jsTestGenerateIsReachable);

  • trunk/Source/WebCore/bindings/scripts/test/JS/JSTestGlobalObject.cpp

    r208878 r210829  
    503503void JSTestGlobalObjectOwner::finalize(JSC::Handle<JSC::Unknown> handle, void* context)
    504504{
    505     auto* jsTestGlobalObject = jsCast<JSTestGlobalObject*>(handle.slot()->asCell());
     505    auto* jsTestGlobalObject = static_cast<JSTestGlobalObject*>(handle.slot()->asCell());
    506506    auto& world = *static_cast<DOMWrapperWorld*>(context);
    507507    uncacheWrapper(world, &jsTestGlobalObject->wrapped(), jsTestGlobalObject);

  • trunk/Source/WebCore/bindings/scripts/test/JS/JSTestInterface.cpp

    r210675 r210829  
    991991void JSTestInterfaceOwner::finalize(JSC::Handle<JSC::Unknown> handle, void* context)
    992992{
    993     auto* jsTestInterface = jsCast<JSTestInterface*>(handle.slot()->asCell());
     993    auto* jsTestInterface = static_cast<JSTestInterface*>(handle.slot()->asCell());
    994994    auto& world = *static_cast<DOMWrapperWorld*>(context);
    995995    uncacheWrapper(world, &jsTestInterface->wrapped(), jsTestInterface);

  • trunk/Source/WebCore/bindings/scripts/test/JS/JSTestInterfaceLeadingUnderscore.cpp

    r208613 r210829  
    185185void JSTestInterfaceLeadingUnderscoreOwner::finalize(JSC::Handle<JSC::Unknown> handle, void* context)
    186186{
    187     auto* jsTestInterfaceLeadingUnderscore = jsCast<JSTestInterfaceLeadingUnderscore*>(handle.slot()->asCell());
     187    auto* jsTestInterfaceLeadingUnderscore = static_cast<JSTestInterfaceLeadingUnderscore*>(handle.slot()->asCell());
    188188    auto& world = *static_cast<DOMWrapperWorld*>(context);
    189189    uncacheWrapper(world, &jsTestInterfaceLeadingUnderscore->wrapped(), jsTestInterfaceLeadingUnderscore);

  • trunk/Source/WebCore/bindings/scripts/test/JS/JSTestIterable.cpp

    r208613 r210829  
    245245void JSTestIterableOwner::finalize(JSC::Handle<JSC::Unknown> handle, void* context)
    246246{
    247     auto* jsTestIterable = jsCast<JSTestIterable*>(handle.slot()->asCell());
     247    auto* jsTestIterable = static_cast<JSTestIterable*>(handle.slot()->asCell());
    248248    auto& world = *static_cast<DOMWrapperWorld*>(context);
    249249    uncacheWrapper(world, &jsTestIterable->wrapped(), jsTestIterable);

  • trunk/Source/WebCore/bindings/scripts/test/JS/JSTestMediaQueryListListener.cpp

    r209153 r210829  
    194194void JSTestMediaQueryListListenerOwner::finalize(JSC::Handle<JSC::Unknown> handle, void* context)
    195195{
    196     auto* jsTestMediaQueryListListener = jsCast<JSTestMediaQueryListListener*>(handle.slot()->asCell());
     196    auto* jsTestMediaQueryListListener = static_cast<JSTestMediaQueryListListener*>(handle.slot()->asCell());
    197197    auto& world = *static_cast<DOMWrapperWorld*>(context);
    198198    uncacheWrapper(world, &jsTestMediaQueryListListener->wrapped(), jsTestMediaQueryListListener);

  • trunk/Source/WebCore/bindings/scripts/test/JS/JSTestNamedConstructor.cpp

    r210025 r210829  
    205205void JSTestNamedConstructorOwner::finalize(JSC::Handle<JSC::Unknown> handle, void* context)
    206206{
    207     auto* jsTestNamedConstructor = jsCast<JSTestNamedConstructor*>(handle.slot()->asCell());
     207    auto* jsTestNamedConstructor = static_cast<JSTestNamedConstructor*>(handle.slot()->asCell());
    208208    auto& world = *static_cast<DOMWrapperWorld*>(context);
    209209    uncacheWrapper(world, &jsTestNamedConstructor->wrapped(), jsTestNamedConstructor);

  • trunk/Source/WebCore/bindings/scripts/test/JS/JSTestObj.cpp

    r210675 r210829  
    86188618void JSTestObjOwner::finalize(JSC::Handle<JSC::Unknown> handle, void* context)
    86198619{
    8620     auto* jsTestObj = jsCast<JSTestObj*>(handle.slot()->asCell());
     8620    auto* jsTestObj = static_cast<JSTestObj*>(handle.slot()->asCell());
    86218621    auto& world = *static_cast<DOMWrapperWorld*>(context);
    86228622    uncacheWrapper(world, &jsTestObj->wrapped(), jsTestObj);

  • trunk/Source/WebCore/bindings/scripts/test/JS/JSTestOverloadedConstructors.cpp

    r210025 r210829  
    261261void JSTestOverloadedConstructorsOwner::finalize(JSC::Handle<JSC::Unknown> handle, void* context)
    262262{
    263     auto* jsTestOverloadedConstructors = jsCast<JSTestOverloadedConstructors*>(handle.slot()->asCell());
     263    auto* jsTestOverloadedConstructors = static_cast<JSTestOverloadedConstructors*>(handle.slot()->asCell());
    264264    auto& world = *static_cast<DOMWrapperWorld*>(context);
    265265    uncacheWrapper(world, &jsTestOverloadedConstructors->wrapped(), jsTestOverloadedConstructors);

  • trunk/Source/WebCore/bindings/scripts/test/JS/JSTestOverloadedConstructorsWithSequence.cpp

    r210025 r210829  
    212212void JSTestOverloadedConstructorsWithSequenceOwner::finalize(JSC::Handle<JSC::Unknown> handle, void* context)
    213213{
    214     auto* jsTestOverloadedConstructorsWithSequence = jsCast<JSTestOverloadedConstructorsWithSequence*>(handle.slot()->asCell());
     214    auto* jsTestOverloadedConstructorsWithSequence = static_cast<JSTestOverloadedConstructorsWithSequence*>(handle.slot()->asCell());
    215215    auto& world = *static_cast<DOMWrapperWorld*>(context);
    216216    uncacheWrapper(world, &jsTestOverloadedConstructorsWithSequence->wrapped(), jsTestOverloadedConstructorsWithSequence);

  • trunk/Source/WebCore/bindings/scripts/test/JS/JSTestOverrideBuiltins.cpp

    r210675 r210829  
    233233void JSTestOverrideBuiltinsOwner::finalize(JSC::Handle<JSC::Unknown> handle, void* context)
    234234{
    235     auto* jsTestOverrideBuiltins = jsCast<JSTestOverrideBuiltins*>(handle.slot()->asCell());
     235    auto* jsTestOverrideBuiltins = static_cast<JSTestOverrideBuiltins*>(handle.slot()->asCell());
    236236    auto& world = *static_cast<DOMWrapperWorld*>(context);
    237237    uncacheWrapper(world, &jsTestOverrideBuiltins->wrapped(), jsTestOverrideBuiltins);

  • trunk/Source/WebCore/bindings/scripts/test/JS/JSTestSerialization.cpp

    r208613 r210829  
    398398void JSTestSerializationOwner::finalize(JSC::Handle<JSC::Unknown> handle, void* context)
    399399{
    400     auto* jsTestSerialization = jsCast<JSTestSerialization*>(handle.slot()->asCell());
     400    auto* jsTestSerialization = static_cast<JSTestSerialization*>(handle.slot()->asCell());
    401401    auto& world = *static_cast<DOMWrapperWorld*>(context);
    402402    uncacheWrapper(world, &jsTestSerialization->wrapped(), jsTestSerialization);

  • trunk/Source/WebCore/bindings/scripts/test/JS/JSTestSerializedScriptValueInterface.cpp

    r209925 r210829  
    366366void JSTestSerializedScriptValueInterfaceOwner::finalize(JSC::Handle<JSC::Unknown> handle, void* context)
    367367{
    368     auto* jsTestSerializedScriptValueInterface = jsCast<JSTestSerializedScriptValueInterface*>(handle.slot()->asCell());
     368    auto* jsTestSerializedScriptValueInterface = static_cast<JSTestSerializedScriptValueInterface*>(handle.slot()->asCell());
    369369    auto& world = *static_cast<DOMWrapperWorld*>(context);
    370370    uncacheWrapper(world, &jsTestSerializedScriptValueInterface->wrapped(), jsTestSerializedScriptValueInterface);

  • trunk/Source/WebCore/bindings/scripts/test/JS/JSTestTypedefs.cpp

    r210025 r210829  
    771771void JSTestTypedefsOwner::finalize(JSC::Handle<JSC::Unknown> handle, void* context)
    772772{
    773     auto* jsTestTypedefs = jsCast<JSTestTypedefs*>(handle.slot()->asCell());
     773    auto* jsTestTypedefs = static_cast<JSTestTypedefs*>(handle.slot()->asCell());
    774774    auto& world = *static_cast<DOMWrapperWorld*>(context);
    775775    uncacheWrapper(world, &jsTestTypedefs->wrapped(), jsTestTypedefs);

  • trunk/Source/WebKit2/ChangeLog

    r210828 r210829  
     12017-01-17  Filip Pizlo  <fpizlo@apple.com>
     2
     3        JSCell::classInfo() shouldn't have a bunch of mitigations for being called during destruction
     4        https://bugs.webkit.org/show_bug.cgi?id=167066
     5
     6        Reviewed by Keith Miller and Michael Saboff.
     7       
     8        Just remove now-erroneous use of jsCast<>.
     9
     10        * WebProcess/Plugins/Netscape/NPRuntimeObjectMap.cpp:
     11        (WebKit::NPRuntimeObjectMap::finalize):
     12
    1132017-01-17  Joseph Pecoraro  <pecoraro@apple.com>
    214

  • trunk/Source/WebKit2/WebProcess/Plugins/Netscape/NPRuntimeObjectMap.cpp

    r210697 r210829  
    300300void NPRuntimeObjectMap::finalize(JSC::Handle<JSC::Unknown> handle, void* context)
    301301{
    302     JSNPObject* object = jsCast<JSNPObject*>(handle.get().asCell());
     302    JSNPObject* object = static_cast<JSNPObject*>(handle.get().asCell());
    303303    weakRemove(m_jsNPObjects, static_cast<NPObject*>(context), object);
    304304    addToInvalidationQueue(object->leakNPObject());
Note: See TracChangeset for help on using the changeset viewer.