Changeset 210829 in webkit
- Timestamp:
- Jan 17, 2017 3:52:55 PM (7 years ago)
- Location:
- trunk/Source
- Files:
-
- 60 edited
Legend:
- Unmodified
- Added
- Removed
-
trunk/Source/JavaScriptCore/API/JSAPIWrapperObject.mm
r210824 r210829 49 49 void JSAPIWrapperObjectHandleOwner::finalize(JSC::Handle<JSC::Unknown> handle, void*) 50 50 { 51 JSC::JSAPIWrapperObject* wrapperObject = JSC::jsCast<JSC::JSAPIWrapperObject*>(handle.get().asCell());51 JSC::JSAPIWrapperObject* wrapperObject = static_cast<JSC::JSAPIWrapperObject*>(handle.get().asCell()); 52 52 if (!wrapperObject->wrappedObject()) 53 53 return; -
trunk/Source/JavaScriptCore/API/JSCallbackObject.h
r210824 r210829 233 233 234 234 std::unique_ptr<JSCallbackObjectData> m_callbackObjectData; 235 const ClassInfo* m_classInfo; 235 236 }; 236 237 -
trunk/Source/JavaScriptCore/API/JSCallbackObjectFunctions.h
r210824 r210829 75 75 JSCallbackObject<Parent>::~JSCallbackObject() 76 76 { 77 VM* vm = this->HeapCell::vm(); 78 vm->currentlyDestructingCallbackObject = this; 79 ASSERT(m_classInfo); 80 vm->currentlyDestructingCallbackObjectClassInfo = m_classInfo; 77 81 JSObjectRef thisRef = toRef(static_cast<JSObject*>(this)); 78 82 for (JSClassRef jsClass = classRef(); jsClass; jsClass = jsClass->parentClass) { … … 80 84 finalize(thisRef); 81 85 } 86 vm->currentlyDestructingCallbackObject = nullptr; 87 vm->currentlyDestructingCallbackObjectClassInfo = nullptr; 82 88 } 83 89 … … 118 124 initialize(toRef(exec), toRef(this)); 119 125 } 126 127 m_classInfo = this->classInfo(); 120 128 } 121 129 -
trunk/Source/JavaScriptCore/API/JSObjectRef.cpp
r210824 r210829 381 381 } 382 382 383 // API objects have private properties, which may get accessed during destruction. This 384 // helper lets us get the ClassInfo of an API object from a function that may get called 385 // during destruction. 386 static const ClassInfo* classInfoPrivate(JSObject* jsObject) 387 { 388 VM* vm = jsObject->vm(); 389 390 if (vm->currentlyDestructingCallbackObject != jsObject) 391 return jsObject->classInfo(); 392 393 return vm->currentlyDestructingCallbackObjectClassInfo; 394 } 395 383 396 void* JSObjectGetPrivate(JSObjectRef object) 384 397 { 385 398 JSObject* jsObject = uncheckedToJS(object); 386 399 400 const ClassInfo* classInfo = classInfoPrivate(jsObject); 401 387 402 // Get wrapped object if proxied 388 if (jsObject->inherits(JSProxy::info())) 403 if (classInfo->isSubClassOf(JSProxy::info())) { 404 jsObject = static_cast<JSProxy*>(jsObject)->target(); 405 classInfo = jsObject->classInfo(); 406 } 407 408 if (classInfo->isSubClassOf(JSCallbackObject<JSGlobalObject>::info())) 409 return static_cast<JSCallbackObject<JSGlobalObject>*>(jsObject)->getPrivate(); 410 if (classInfo->isSubClassOf(JSCallbackObject<JSDestructibleObject>::info())) 411 return static_cast<JSCallbackObject<JSDestructibleObject>*>(jsObject)->getPrivate(); 412 #if JSC_OBJC_API_ENABLED 413 if (classInfo->isSubClassOf(JSCallbackObject<JSAPIWrapperObject>::info())) 414 return static_cast<JSCallbackObject<JSAPIWrapperObject>*>(jsObject)->getPrivate(); 415 #endif 416 417 return 0; 418 } 419 420 bool JSObjectSetPrivate(JSObjectRef object, void* data) 421 { 422 JSObject* jsObject = uncheckedToJS(object); 423 424 const ClassInfo* classInfo = classInfoPrivate(jsObject); 425 426 // Get wrapped object if proxied 427 if (classInfo->isSubClassOf(JSProxy::info())) { 389 428 jsObject = jsCast<JSProxy*>(jsObject)->target(); 390 391 if (jsObject->inherits(JSCallbackObject<JSGlobalObject>::info())) 392 return jsCast<JSCallbackObject<JSGlobalObject>*>(jsObject)->getPrivate(); 393 if (jsObject->inherits(JSCallbackObject<JSDestructibleObject>::info())) 394 return jsCast<JSCallbackObject<JSDestructibleObject>*>(jsObject)->getPrivate(); 429 classInfo = jsObject->classInfo(); 430 } 431 432 if (classInfo->isSubClassOf(JSCallbackObject<JSGlobalObject>::info())) { 433 jsCast<JSCallbackObject<JSGlobalObject>*>(jsObject)->setPrivate(data); 434 return true; 435 } 436 if (classInfo->isSubClassOf(JSCallbackObject<JSDestructibleObject>::info())) { 437 jsCast<JSCallbackObject<JSDestructibleObject>*>(jsObject)->setPrivate(data); 438 return true; 439 } 395 440 #if JSC_OBJC_API_ENABLED 396 if (jsObject->inherits(JSCallbackObject<JSAPIWrapperObject>::info())) 397 return jsCast<JSCallbackObject<JSAPIWrapperObject>*>(jsObject)->getPrivate(); 398 #endif 399 400 return 0; 401 } 402 403 bool JSObjectSetPrivate(JSObjectRef object, void* data) 404 { 405 JSObject* jsObject = uncheckedToJS(object); 406 407 // Get wrapped object if proxied 408 if (jsObject->inherits(JSProxy::info())) 409 jsObject = jsCast<JSProxy*>(jsObject)->target(); 410 411 if (jsObject->inherits(JSCallbackObject<JSGlobalObject>::info())) { 412 jsCast<JSCallbackObject<JSGlobalObject>*>(jsObject)->setPrivate(data); 413 return true; 414 } 415 if (jsObject->inherits(JSCallbackObject<JSDestructibleObject>::info())) { 416 jsCast<JSCallbackObject<JSDestructibleObject>*>(jsObject)->setPrivate(data); 417 return true; 418 } 419 #if JSC_OBJC_API_ENABLED 420 if (jsObject->inherits(JSCallbackObject<JSAPIWrapperObject>::info())) { 441 if (classInfo->isSubClassOf(JSCallbackObject<JSAPIWrapperObject>::info())) { 421 442 jsCast<JSCallbackObject<JSAPIWrapperObject>*>(jsObject)->setPrivate(data); 422 443 return true; -
trunk/Source/JavaScriptCore/ChangeLog
r210824 r210829 1 2017-01-16 Filip Pizlo <fpizlo@apple.com> 2 3 JSCell::classInfo() shouldn't have a bunch of mitigations for being called during destruction 4 https://bugs.webkit.org/show_bug.cgi?id=167066 5 6 Reviewed by Keith Miller and Michael Saboff. 7 8 This reduces the size of JSCell::classInfo() by half and removes some checks that 9 this function previously had to do in case it was called from destructors. 10 11 I changed all of the destructors so that they don't call JSCell::classInfo() and I 12 added an assertion to JSCell::classInfo() to catch cases where someone called it 13 from a destructor accidentally. 14 15 This means that we only have one place in destruction that needs to know the class: 16 the sweeper's call to the destructor. 17 18 One of the trickiest outcomes of this is the need to support inherits() tests in 19 JSObjectGetPrivate(), when it is called from the destructor callback on the object 20 being destructed. JSObjectGetPrivate() is undefined behavior anyway if you use it 21 on any dead-but-not-destructed object other than the one being destructed right 22 now. The purpose of the inherits() tests is to distinguish between different kinds 23 of CallbackObjects, which may have different kinds of base classes. I think that 24 this was always subtly wrong - for example, if the object being destructed is a 25 JSGlobalObject then it's not a DestructibleObject, is not in a destructor block, 26 but does not have an immortal Structure - so classInfo() is not valid. This fixes 27 the issue by having ~JSCallbackObject know its classInfo. It now stashes its 28 classInfo in VM so that JSObjectGetPrivate can use that classInfo if it detects 29 that it's being used on a currently-destructing object. 30 31 That was the only really weird part of this patch. The rest is mostly removing 32 illegal uses of jsCast<> in destructors. There were a few other genuine uses of 33 classInfo() but they were in code that already knew how to get its classInfo() 34 using other means: 35 36 - You can still say structure()->classInfo(), and I use this form in code that 37 knows that its StructureIsImmortal. 38 39 - You can use this->classInfo() if it's overridden, like in subclasses of 40 JSDestructibleObject. 41 42 Rolling this back in because I think I fixed the crashes. 43 44 * API/JSAPIWrapperObject.mm: 45 (JSAPIWrapperObjectHandleOwner::finalize): 46 * API/JSCallbackObject.h: 47 * API/JSCallbackObjectFunctions.h: 48 (JSC::JSCallbackObject<Parent>::~JSCallbackObject): 49 (JSC::JSCallbackObject<Parent>::init): 50 * API/JSObjectRef.cpp: 51 (classInfoPrivate): 52 (JSObjectGetPrivate): 53 (JSObjectSetPrivate): 54 * bytecode/EvalCodeBlock.cpp: 55 (JSC::EvalCodeBlock::destroy): 56 * bytecode/FunctionCodeBlock.cpp: 57 (JSC::FunctionCodeBlock::destroy): 58 * bytecode/ModuleProgramCodeBlock.cpp: 59 (JSC::ModuleProgramCodeBlock::destroy): 60 * bytecode/ProgramCodeBlock.cpp: 61 (JSC::ProgramCodeBlock::destroy): 62 * bytecode/UnlinkedEvalCodeBlock.cpp: 63 (JSC::UnlinkedEvalCodeBlock::destroy): 64 * bytecode/UnlinkedFunctionCodeBlock.cpp: 65 (JSC::UnlinkedFunctionCodeBlock::destroy): 66 * bytecode/UnlinkedFunctionExecutable.cpp: 67 (JSC::UnlinkedFunctionExecutable::destroy): 68 * bytecode/UnlinkedModuleProgramCodeBlock.cpp: 69 (JSC::UnlinkedModuleProgramCodeBlock::destroy): 70 * bytecode/UnlinkedProgramCodeBlock.cpp: 71 (JSC::UnlinkedProgramCodeBlock::destroy): 72 * heap/CodeBlockSet.cpp: 73 (JSC::CodeBlockSet::lastChanceToFinalize): 74 (JSC::CodeBlockSet::deleteUnmarkedAndUnreferenced): 75 * heap/MarkedAllocator.cpp: 76 (JSC::MarkedAllocator::allocateSlowCaseImpl): 77 * heap/MarkedBlock.cpp: 78 (JSC::MarkedBlock::Handle::sweep): 79 * jit/JITThunks.cpp: 80 (JSC::JITThunks::finalize): 81 * runtime/AbstractModuleRecord.cpp: 82 (JSC::AbstractModuleRecord::destroy): 83 * runtime/ExecutableBase.cpp: 84 (JSC::ExecutableBase::clearCode): 85 * runtime/JSCellInlines.h: 86 (JSC::JSCell::classInfo): 87 (JSC::JSCell::callDestructor): 88 * runtime/JSLock.h: 89 (JSC::JSLock::ownerThread): 90 * runtime/JSModuleNamespaceObject.cpp: 91 (JSC::JSModuleNamespaceObject::destroy): 92 * runtime/JSModuleRecord.cpp: 93 (JSC::JSModuleRecord::destroy): 94 * runtime/JSPropertyNameEnumerator.cpp: 95 (JSC::JSPropertyNameEnumerator::destroy): 96 * runtime/JSSegmentedVariableObject.h: 97 * runtime/SymbolTable.cpp: 98 (JSC::SymbolTable::destroy): 99 * runtime/VM.h: 100 * wasm/js/JSWebAssemblyCallee.cpp: 101 (JSC::JSWebAssemblyCallee::destroy): 102 * wasm/js/WebAssemblyModuleRecord.cpp: 103 (JSC::WebAssemblyModuleRecord::destroy): 104 * wasm/js/WebAssemblyToJSCallee.cpp: 105 (JSC::WebAssemblyToJSCallee::WebAssemblyToJSCallee): 106 (JSC::WebAssemblyToJSCallee::destroy): 107 1 108 2017-01-17 Filip Pizlo <fpizlo@apple.com> 2 109 -
trunk/Source/JavaScriptCore/bytecode/EvalCodeBlock.cpp
r210824 r210829 40 40 void EvalCodeBlock::destroy(JSCell* cell) 41 41 { 42 jsCast<EvalCodeBlock*>(cell)->~EvalCodeBlock();42 static_cast<EvalCodeBlock*>(cell)->~EvalCodeBlock(); 43 43 } 44 44 -
trunk/Source/JavaScriptCore/bytecode/FunctionCodeBlock.cpp
r210824 r210829 40 40 void FunctionCodeBlock::destroy(JSCell* cell) 41 41 { 42 jsCast<FunctionCodeBlock*>(cell)->~FunctionCodeBlock();42 static_cast<FunctionCodeBlock*>(cell)->~FunctionCodeBlock(); 43 43 } 44 44 -
trunk/Source/JavaScriptCore/bytecode/ModuleProgramCodeBlock.cpp
r210824 r210829 40 40 void ModuleProgramCodeBlock::destroy(JSCell* cell) 41 41 { 42 jsCast<ModuleProgramCodeBlock*>(cell)->~ModuleProgramCodeBlock();42 static_cast<ModuleProgramCodeBlock*>(cell)->~ModuleProgramCodeBlock(); 43 43 } 44 44 -
trunk/Source/JavaScriptCore/bytecode/ProgramCodeBlock.cpp
r210824 r210829 40 40 void ProgramCodeBlock::destroy(JSCell* cell) 41 41 { 42 jsCast<ProgramCodeBlock*>(cell)->~ProgramCodeBlock();42 static_cast<ProgramCodeBlock*>(cell)->~ProgramCodeBlock(); 43 43 } 44 44 -
trunk/Source/JavaScriptCore/bytecode/UnlinkedEvalCodeBlock.cpp
r210824 r210829 35 35 void UnlinkedEvalCodeBlock::destroy(JSCell* cell) 36 36 { 37 jsCast<UnlinkedEvalCodeBlock*>(cell)->~UnlinkedEvalCodeBlock();37 static_cast<UnlinkedEvalCodeBlock*>(cell)->~UnlinkedEvalCodeBlock(); 38 38 } 39 39 -
trunk/Source/JavaScriptCore/bytecode/UnlinkedFunctionCodeBlock.cpp
r210824 r210829 35 35 void UnlinkedFunctionCodeBlock::destroy(JSCell* cell) 36 36 { 37 jsCast<UnlinkedFunctionCodeBlock*>(cell)->~UnlinkedFunctionCodeBlock();37 static_cast<UnlinkedFunctionCodeBlock*>(cell)->~UnlinkedFunctionCodeBlock(); 38 38 } 39 39 -
trunk/Source/JavaScriptCore/bytecode/UnlinkedFunctionExecutable.cpp
r210824 r210829 120 120 void UnlinkedFunctionExecutable::destroy(JSCell* cell) 121 121 { 122 jsCast<UnlinkedFunctionExecutable*>(cell)->~UnlinkedFunctionExecutable();122 static_cast<UnlinkedFunctionExecutable*>(cell)->~UnlinkedFunctionExecutable(); 123 123 } 124 124 -
trunk/Source/JavaScriptCore/bytecode/UnlinkedModuleProgramCodeBlock.cpp
r210824 r210829 43 43 void UnlinkedModuleProgramCodeBlock::destroy(JSCell* cell) 44 44 { 45 jsCast<UnlinkedModuleProgramCodeBlock*>(cell)->~UnlinkedModuleProgramCodeBlock();45 static_cast<UnlinkedModuleProgramCodeBlock*>(cell)->~UnlinkedModuleProgramCodeBlock(); 46 46 } 47 47 -
trunk/Source/JavaScriptCore/bytecode/UnlinkedProgramCodeBlock.cpp
r210824 r210829 43 43 void UnlinkedProgramCodeBlock::destroy(JSCell* cell) 44 44 { 45 jsCast<UnlinkedProgramCodeBlock*>(cell)->~UnlinkedProgramCodeBlock();45 static_cast<UnlinkedProgramCodeBlock*>(cell)->~UnlinkedProgramCodeBlock(); 46 46 } 47 47 -
trunk/Source/JavaScriptCore/heap/CodeBlockSet.cpp
r210824 r210829 66 66 LockHolder locker(&m_lock); 67 67 for (CodeBlock* codeBlock : m_newCodeBlocks) 68 codeBlock-> classInfo()->methodTable.destroy(codeBlock);68 codeBlock->structure()->classInfo()->methodTable.destroy(codeBlock); 69 69 70 70 for (CodeBlock* codeBlock : m_oldCodeBlocks) 71 codeBlock-> classInfo()->methodTable.destroy(codeBlock);71 codeBlock->structure()->classInfo()->methodTable.destroy(codeBlock); 72 72 } 73 73 … … 84 84 } 85 85 for (CodeBlock* codeBlock : unmarked) { 86 codeBlock-> classInfo()->methodTable.destroy(codeBlock);86 codeBlock->structure()->classInfo()->methodTable.destroy(codeBlock); 87 87 set.remove(codeBlock); 88 88 } -
trunk/Source/JavaScriptCore/heap/MarkedAllocator.cpp
r210824 r210829 212 212 didConsumeFreeList(); 213 213 214 AllocatingScope he alpingHeap(*m_heap);214 AllocatingScope helpingHeap(*m_heap); 215 215 216 216 m_heap->collectIfNecessaryOrDefer(deferralContext); -
trunk/Source/JavaScriptCore/heap/MarkedBlock.cpp
r210824 r210829 27 27 #include "MarkedBlock.h" 28 28 29 #include "HelpingGCScope.h" 29 30 #include "JSCell.h" 30 31 #include "JSDestructibleObject.h" … … 196 197 FreeList MarkedBlock::Handle::sweep(SweepMode sweepMode) 197 198 { 199 // FIXME: Maybe HelpingGCScope should just be called SweepScope? 200 HelpingGCScope helpingGCScope(*heap()); 201 198 202 m_allocator->setIsUnswept(NoLockingNecessary, this, false); 199 203 -
trunk/Source/JavaScriptCore/jit/JITThunks.cpp
r210824 r210829 85 85 void JITThunks::finalize(Handle<Unknown> handle, void*) 86 86 { 87 auto* nativeExecutable = jsCast<NativeExecutable*>(handle.get().asCell());87 auto* nativeExecutable = static_cast<NativeExecutable*>(handle.get().asCell()); 88 88 weakRemove(*m_hostFunctionStubMap, std::make_tuple(nativeExecutable->function(), nativeExecutable->constructor(), nativeExecutable->name()), nativeExecutable); 89 89 } -
trunk/Source/JavaScriptCore/runtime/AbstractModuleRecord.cpp
r210824 r210829 47 47 void AbstractModuleRecord::destroy(JSCell* cell) 48 48 { 49 AbstractModuleRecord* thisObject = jsCast<AbstractModuleRecord*>(cell);49 AbstractModuleRecord* thisObject = static_cast<AbstractModuleRecord*>(cell); 50 50 thisObject->AbstractModuleRecord::~AbstractModuleRecord(); 51 51 } -
trunk/Source/JavaScriptCore/runtime/ExecutableBase.cpp
r210824 r210829 61 61 m_numParametersForConstruct = NUM_PARAMETERS_NOT_COMPILED; 62 62 63 if ( classInfo() == FunctionExecutable::info()) {64 FunctionExecutable* executable = jsCast<FunctionExecutable*>(this);63 if (structure()->classInfo() == FunctionExecutable::info()) { 64 FunctionExecutable* executable = static_cast<FunctionExecutable*>(this); 65 65 executable->m_codeBlockForCall.clear(); 66 66 executable->m_codeBlockForConstruct.clear(); … … 68 68 } 69 69 70 if ( classInfo() == EvalExecutable::info()) {71 EvalExecutable* executable = jsCast<EvalExecutable*>(this);70 if (structure()->classInfo() == EvalExecutable::info()) { 71 EvalExecutable* executable = static_cast<EvalExecutable*>(this); 72 72 executable->m_evalCodeBlock.clear(); 73 73 executable->m_unlinkedEvalCodeBlock.clear(); … … 75 75 } 76 76 77 if ( classInfo() == ProgramExecutable::info()) {78 ProgramExecutable* executable = jsCast<ProgramExecutable*>(this);77 if (structure()->classInfo() == ProgramExecutable::info()) { 78 ProgramExecutable* executable = static_cast<ProgramExecutable*>(this); 79 79 executable->m_programCodeBlock.clear(); 80 80 executable->m_unlinkedProgramCodeBlock.clear(); … … 82 82 } 83 83 84 if ( classInfo() == ModuleProgramExecutable::info()) {85 ModuleProgramExecutable* executable = jsCast<ModuleProgramExecutable*>(this);84 if (structure()->classInfo() == ModuleProgramExecutable::info()) { 85 ModuleProgramExecutable* executable = static_cast<ModuleProgramExecutable*>(this); 86 86 executable->m_moduleProgramCodeBlock.clear(); 87 87 executable->m_unlinkedModuleProgramCodeBlock.clear(); … … 90 90 } 91 91 92 ASSERT( classInfo() == NativeExecutable::info());92 ASSERT(structure()->classInfo() == NativeExecutable::info()); 93 93 } 94 94 -
trunk/Source/JavaScriptCore/runtime/JSCellInlines.h
r210824 r210829 268 268 ALWAYS_INLINE const ClassInfo* JSCell::classInfo() const 269 269 { 270 if (isLargeAllocation()) { 271 LargeAllocation& allocation = largeAllocation(); 272 if (allocation.attributes().destruction == NeedsDestruction 273 && !(inlineTypeFlags() & StructureIsImmortal)) 274 return static_cast<const JSDestructibleObject*>(this)->classInfo(); 275 return structure(*allocation.vm())->classInfo(); 276 } 277 MarkedBlock& block = markedBlock(); 278 if (block.needsDestruction() && !(inlineTypeFlags() & StructureIsImmortal)) 279 return static_cast<const JSDestructibleObject*>(this)->classInfo(); 280 return structure(*block.vm())->classInfo(); 270 VM* vm; 271 if (isLargeAllocation()) 272 vm = largeAllocation().vm(); 273 else 274 vm = markedBlock().vm(); 275 ASSERT(vm->heap.mutatorState() == MutatorState::Running || vm->apiLock().ownerThread() != std::this_thread::get_id()); 276 return structure(*vm)->classInfo(); 281 277 } 282 278 … … 308 304 destroy(this); 309 305 } else 310 jsCast<JSDestructibleObject*>(this)->classInfo()->methodTable.destroy(this);306 static_cast<JSDestructibleObject*>(this)->classInfo()->methodTable.destroy(this); 311 307 zap(); 312 308 } -
trunk/Source/JavaScriptCore/runtime/JSLock.h
r210824 r210829 100 100 return m_ownerThreadID; 101 101 } 102 std::thread::id ownerThread() const { return m_ownerThreadID; } 102 103 JS_EXPORT_PRIVATE void setExclusiveThread(std::thread::id); 103 104 JS_EXPORT_PRIVATE bool currentThreadIsHoldingLock(); -
trunk/Source/JavaScriptCore/runtime/JSModuleNamespaceObject.cpp
r210824 r210829 84 84 void JSModuleNamespaceObject::destroy(JSCell* cell) 85 85 { 86 JSModuleNamespaceObject* thisObject = jsCast<JSModuleNamespaceObject*>(cell);86 JSModuleNamespaceObject* thisObject = static_cast<JSModuleNamespaceObject*>(cell); 87 87 thisObject->JSModuleNamespaceObject::~JSModuleNamespaceObject(); 88 88 } -
trunk/Source/JavaScriptCore/runtime/JSModuleRecord.cpp
r210824 r210829 60 60 void JSModuleRecord::destroy(JSCell* cell) 61 61 { 62 JSModuleRecord* thisObject = jsCast<JSModuleRecord*>(cell);62 JSModuleRecord* thisObject = static_cast<JSModuleRecord*>(cell); 63 63 thisObject->JSModuleRecord::~JSModuleRecord(); 64 64 } -
trunk/Source/JavaScriptCore/runtime/JSPropertyNameEnumerator.cpp
r210824 r210829 84 84 void JSPropertyNameEnumerator::destroy(JSCell* cell) 85 85 { 86 jsCast<JSPropertyNameEnumerator*>(cell)->JSPropertyNameEnumerator::~JSPropertyNameEnumerator();86 static_cast<JSPropertyNameEnumerator*>(cell)->JSPropertyNameEnumerator::~JSPropertyNameEnumerator(); 87 87 } 88 88 -
trunk/Source/JavaScriptCore/runtime/JSSegmentedVariableObject.h
r210824 r210829 47 47 // JSSegmentedVariableObject has its own GC tracing functionality, since it knows the 48 48 // exact dimensions of the variables array at all times. 49 50 // Except for JSGlobalObject, subclasses of this don't call the destructor and leak memory. 49 51 50 52 class JSSegmentedVariableObject : public JSSymbolTableObject { -
trunk/Source/JavaScriptCore/runtime/StructureInlines.h
r209570 r210829 260 260 return true; 261 261 262 RELEASE_ASSERT(numberOfSlotsForLastOffset(m_offset, m_inlineCapacity) == propertyTable->propertyStorageSize());263 262 unsigned totalSize = propertyTable->propertyStorageSize(); 264 RELEASE_ASSERT((totalSize < inlineCapacity() ? 0 : totalSize - inlineCapacity()) == numberOfOutOfLineSlotsForLastOffset(m_offset)); 263 unsigned inlineOverflowAccordingToTotalSize = totalSize < m_inlineCapacity ? 0 : totalSize - m_inlineCapacity; 264 265 auto fail = [&] (const char* description) { 266 dataLog("Detected offset inconsistency: ", description, "!\n"); 267 dataLog("this = ", RawPointer(this), "\n"); 268 dataLog("m_offset = ", m_offset, "\n"); 269 dataLog("m_inlineCapacity = ", m_inlineCapacity, "\n"); 270 dataLog("propertyTable = ", RawPointer(propertyTable), "\n"); 271 dataLog("numberOfSlotsForLastOffset = ", numberOfSlotsForLastOffset(m_offset, m_inlineCapacity), "\n"); 272 dataLog("totalSize = ", totalSize, "\n"); 273 dataLog("inlineOverflowAccordingToTotalSize = ", inlineOverflowAccordingToTotalSize, "\n"); 274 dataLog("numberOfOutOfLineSlotsForLastOffset = ", numberOfOutOfLineSlotsForLastOffset(m_offset), "\n"); 275 UNREACHABLE_FOR_PLATFORM(); 276 }; 277 278 if (numberOfSlotsForLastOffset(m_offset, m_inlineCapacity) != totalSize) 279 fail("numberOfSlotsForLastOffset doesn't match totalSize"); 280 if (inlineOverflowAccordingToTotalSize != numberOfOutOfLineSlotsForLastOffset(m_offset)) 281 fail("inlineOverflowAccordingToTotalSize doesn't match numberOfOutOfLineSlotsForLastOffset"); 265 282 266 283 return true; -
trunk/Source/JavaScriptCore/runtime/SymbolTable.cpp
r210824 r210829 50 50 void SymbolTable::destroy(JSCell* cell) 51 51 { 52 SymbolTable* thisObject = jsCast<SymbolTable*>(cell);52 SymbolTable* thisObject = static_cast<SymbolTable*>(cell); 53 53 thisObject->SymbolTable::~SymbolTable(); 54 54 } -
trunk/Source/JavaScriptCore/runtime/VM.h
r210824 r210829 364 364 std::unique_ptr<Wasm::SignatureInformation> m_wasmSignatureInformation; 365 365 #endif 366 367 JSCell* currentlyDestructingCallbackObject; 368 const ClassInfo* currentlyDestructingCallbackObjectClassInfo; 366 369 367 370 AtomicStringTable* m_atomicStringTable; -
trunk/Source/JavaScriptCore/wasm/js/JSWebAssemblyCallee.cpp
r210824 r210829 48 48 void JSWebAssemblyCallee::destroy(JSCell* cell) 49 49 { 50 JSWebAssemblyCallee* thisObject = jsCast<JSWebAssemblyCallee*>(cell);50 JSWebAssemblyCallee* thisObject = static_cast<JSWebAssemblyCallee*>(cell); 51 51 thisObject->JSWebAssemblyCallee::~JSWebAssemblyCallee(); 52 52 } -
trunk/Source/JavaScriptCore/wasm/js/WebAssemblyModuleRecord.cpp
r210824 r210829 65 65 void WebAssemblyModuleRecord::destroy(JSCell* cell) 66 66 { 67 WebAssemblyModuleRecord* thisObject = jsCast<WebAssemblyModuleRecord*>(cell);67 WebAssemblyModuleRecord* thisObject = static_cast<WebAssemblyModuleRecord*>(cell); 68 68 thisObject->WebAssemblyModuleRecord::~WebAssemblyModuleRecord(); 69 69 } -
trunk/Source/JavaScriptCore/wasm/js/WebAssemblyToJSCallee.cpp
r210824 r210829 49 49 WebAssemblyToJSCallee::WebAssemblyToJSCallee(VM& vm, Structure* structure) 50 50 : Base(vm, structure) 51 { } 51 { 52 } 52 53 53 54 void WebAssemblyToJSCallee::finishCreation(VM& vm) … … 58 59 void WebAssemblyToJSCallee::destroy(JSCell* cell) 59 60 { 60 WebAssemblyToJSCallee* thisObject = jsCast<WebAssemblyToJSCallee*>(cell);61 WebAssemblyToJSCallee* thisObject = static_cast<WebAssemblyToJSCallee*>(cell); 61 62 thisObject->WebAssemblyToJSCallee::~WebAssemblyToJSCallee(); 62 63 } -
trunk/Source/WebCore/ChangeLog
r210828 r210829 1 2017-01-16 Filip Pizlo <fpizlo@apple.com> 2 3 JSCell::classInfo() shouldn't have a bunch of mitigations for being called during destruction 4 https://bugs.webkit.org/show_bug.cgi?id=167066 5 6 Reviewed by Keith Miller and Michael Saboff. 7 8 No new tests because no new behavior. 9 10 It's now necessary to avoid jsCast in destructors and finalizers. This was an easy 11 rule to introduce because this used to always be the rule. 12 13 * bindings/js/JSCSSValueCustom.cpp: 14 (WebCore::JSDeprecatedCSSOMValueOwner::finalize): 15 * bindings/js/JSDOMIterator.h: 16 (WebCore::IteratorTraits>::destroy): 17 * bindings/scripts/CodeGeneratorJS.pm: 18 (GenerateImplementation): 19 1 20 2017-01-17 Joseph Pecoraro <pecoraro@apple.com> 2 21 -
trunk/Source/WebCore/bindings/js/JSCSSValueCustom.cpp
r210824 r210829 51 51 void JSDeprecatedCSSOMValueOwner::finalize(JSC::Handle<JSC::Unknown> handle, void* context) 52 52 { 53 JSDeprecatedCSSOMValue* jsCSSValue = jsCast<JSDeprecatedCSSOMValue*>(handle.slot()->asCell());53 JSDeprecatedCSSOMValue* jsCSSValue = static_cast<JSDeprecatedCSSOMValue*>(handle.slot()->asCell()); 54 54 DOMWrapperWorld& world = *static_cast<DOMWrapperWorld*>(context); 55 55 world.m_deprecatedCSSOMValueRoots.remove(&jsCSSValue->wrapped()); -
trunk/Source/WebCore/bindings/js/JSDOMIterator.h
r210824 r210829 226 226 void JSDOMIterator<JSWrapper, IteratorTraits>::destroy(JSCell* cell) 227 227 { 228 JSDOMIterator<JSWrapper, IteratorTraits>* thisObject = JSC::jsCast<JSDOMIterator<JSWrapper, IteratorTraits>*>(cell);228 JSDOMIterator<JSWrapper, IteratorTraits>* thisObject = static_cast<JSDOMIterator<JSWrapper, IteratorTraits>*>(cell); 229 229 thisObject->JSDOMIterator<JSWrapper, IteratorTraits>::~JSDOMIterator(); 230 230 } -
trunk/Source/WebCore/bindings/scripts/CodeGeneratorJS.pm
r210824 r210829 4244 4244 push(@implContent, "void JS${interfaceName}Owner::finalize(JSC::Handle<JSC::Unknown> handle, void* context)\n"); 4245 4245 push(@implContent, "{\n"); 4246 push(@implContent, " auto* js${interfaceName} = jsCast<JS${interfaceName}*>(handle.slot()->asCell());\n");4246 push(@implContent, " auto* js${interfaceName} = static_cast<JS${interfaceName}*>(handle.slot()->asCell());\n"); 4247 4247 push(@implContent, " auto& world = *static_cast<DOMWrapperWorld*>(context);\n"); 4248 4248 push(@implContent, " uncacheWrapper(world, &js${interfaceName}->wrapped(), js${interfaceName});\n"); -
trunk/Source/WebCore/bindings/scripts/test/JS/JSInterfaceName.cpp
r208613 r210829 175 175 void JSInterfaceNameOwner::finalize(JSC::Handle<JSC::Unknown> handle, void* context) 176 176 { 177 auto* jsInterfaceName = jsCast<JSInterfaceName*>(handle.slot()->asCell());177 auto* jsInterfaceName = static_cast<JSInterfaceName*>(handle.slot()->asCell()); 178 178 auto& world = *static_cast<DOMWrapperWorld*>(context); 179 179 uncacheWrapper(world, &jsInterfaceName->wrapped(), jsInterfaceName); -
trunk/Source/WebCore/bindings/scripts/test/JS/JSTestActiveDOMObject.cpp
r208688 r210829 256 256 void JSTestActiveDOMObjectOwner::finalize(JSC::Handle<JSC::Unknown> handle, void* context) 257 257 { 258 auto* jsTestActiveDOMObject = jsCast<JSTestActiveDOMObject*>(handle.slot()->asCell());258 auto* jsTestActiveDOMObject = static_cast<JSTestActiveDOMObject*>(handle.slot()->asCell()); 259 259 auto& world = *static_cast<DOMWrapperWorld*>(context); 260 260 uncacheWrapper(world, &jsTestActiveDOMObject->wrapped(), jsTestActiveDOMObject); -
trunk/Source/WebCore/bindings/scripts/test/JS/JSTestCEReactions.cpp
r208688 r210829 316 316 void JSTestCEReactionsOwner::finalize(JSC::Handle<JSC::Unknown> handle, void* context) 317 317 { 318 auto* jsTestCEReactions = jsCast<JSTestCEReactions*>(handle.slot()->asCell());318 auto* jsTestCEReactions = static_cast<JSTestCEReactions*>(handle.slot()->asCell()); 319 319 auto& world = *static_cast<DOMWrapperWorld*>(context); 320 320 uncacheWrapper(world, &jsTestCEReactions->wrapped(), jsTestCEReactions); -
trunk/Source/WebCore/bindings/scripts/test/JS/JSTestCEReactionsStringifier.cpp
r208688 r210829 233 233 void JSTestCEReactionsStringifierOwner::finalize(JSC::Handle<JSC::Unknown> handle, void* context) 234 234 { 235 auto* jsTestCEReactionsStringifier = jsCast<JSTestCEReactionsStringifier*>(handle.slot()->asCell());235 auto* jsTestCEReactionsStringifier = static_cast<JSTestCEReactionsStringifier*>(handle.slot()->asCell()); 236 236 auto& world = *static_cast<DOMWrapperWorld*>(context); 237 237 uncacheWrapper(world, &jsTestCEReactionsStringifier->wrapped(), jsTestCEReactionsStringifier); -
trunk/Source/WebCore/bindings/scripts/test/JS/JSTestClassWithJSBuiltinConstructor.cpp
r208613 r210829 174 174 void JSTestClassWithJSBuiltinConstructorOwner::finalize(JSC::Handle<JSC::Unknown> handle, void* context) 175 175 { 176 auto* jsTestClassWithJSBuiltinConstructor = jsCast<JSTestClassWithJSBuiltinConstructor*>(handle.slot()->asCell());176 auto* jsTestClassWithJSBuiltinConstructor = static_cast<JSTestClassWithJSBuiltinConstructor*>(handle.slot()->asCell()); 177 177 auto& world = *static_cast<DOMWrapperWorld*>(context); 178 178 uncacheWrapper(world, &jsTestClassWithJSBuiltinConstructor->wrapped(), jsTestClassWithJSBuiltinConstructor); -
trunk/Source/WebCore/bindings/scripts/test/JS/JSTestCustomConstructorWithNoInterfaceObject.cpp
r208613 r210829 165 165 void JSTestCustomConstructorWithNoInterfaceObjectOwner::finalize(JSC::Handle<JSC::Unknown> handle, void* context) 166 166 { 167 auto* jsTestCustomConstructorWithNoInterfaceObject = jsCast<JSTestCustomConstructorWithNoInterfaceObject*>(handle.slot()->asCell());167 auto* jsTestCustomConstructorWithNoInterfaceObject = static_cast<JSTestCustomConstructorWithNoInterfaceObject*>(handle.slot()->asCell()); 168 168 auto& world = *static_cast<DOMWrapperWorld*>(context); 169 169 uncacheWrapper(world, &jsTestCustomConstructorWithNoInterfaceObject->wrapped(), jsTestCustomConstructorWithNoInterfaceObject); -
trunk/Source/WebCore/bindings/scripts/test/JS/JSTestCustomNamedGetter.cpp
r210675 r210829 228 228 void JSTestCustomNamedGetterOwner::finalize(JSC::Handle<JSC::Unknown> handle, void* context) 229 229 { 230 auto* jsTestCustomNamedGetter = jsCast<JSTestCustomNamedGetter*>(handle.slot()->asCell());230 auto* jsTestCustomNamedGetter = static_cast<JSTestCustomNamedGetter*>(handle.slot()->asCell()); 231 231 auto& world = *static_cast<DOMWrapperWorld*>(context); 232 232 uncacheWrapper(world, &jsTestCustomNamedGetter->wrapped(), jsTestCustomNamedGetter); -
trunk/Source/WebCore/bindings/scripts/test/JS/JSTestException.cpp
r208613 r210829 198 198 void JSTestExceptionOwner::finalize(JSC::Handle<JSC::Unknown> handle, void* context) 199 199 { 200 auto* jsTestException = jsCast<JSTestException*>(handle.slot()->asCell());200 auto* jsTestException = static_cast<JSTestException*>(handle.slot()->asCell()); 201 201 auto& world = *static_cast<DOMWrapperWorld*>(context); 202 202 uncacheWrapper(world, &jsTestException->wrapped(), jsTestException); -
trunk/Source/WebCore/bindings/scripts/test/JS/JSTestGenerateIsReachable.cpp
r208613 r210829 161 161 void JSTestGenerateIsReachableOwner::finalize(JSC::Handle<JSC::Unknown> handle, void* context) 162 162 { 163 auto* jsTestGenerateIsReachable = jsCast<JSTestGenerateIsReachable*>(handle.slot()->asCell());163 auto* jsTestGenerateIsReachable = static_cast<JSTestGenerateIsReachable*>(handle.slot()->asCell()); 164 164 auto& world = *static_cast<DOMWrapperWorld*>(context); 165 165 uncacheWrapper(world, &jsTestGenerateIsReachable->wrapped(), jsTestGenerateIsReachable); -
trunk/Source/WebCore/bindings/scripts/test/JS/JSTestGlobalObject.cpp
r208878 r210829 503 503 void JSTestGlobalObjectOwner::finalize(JSC::Handle<JSC::Unknown> handle, void* context) 504 504 { 505 auto* jsTestGlobalObject = jsCast<JSTestGlobalObject*>(handle.slot()->asCell());505 auto* jsTestGlobalObject = static_cast<JSTestGlobalObject*>(handle.slot()->asCell()); 506 506 auto& world = *static_cast<DOMWrapperWorld*>(context); 507 507 uncacheWrapper(world, &jsTestGlobalObject->wrapped(), jsTestGlobalObject); -
trunk/Source/WebCore/bindings/scripts/test/JS/JSTestInterface.cpp
r210675 r210829 991 991 void JSTestInterfaceOwner::finalize(JSC::Handle<JSC::Unknown> handle, void* context) 992 992 { 993 auto* jsTestInterface = jsCast<JSTestInterface*>(handle.slot()->asCell());993 auto* jsTestInterface = static_cast<JSTestInterface*>(handle.slot()->asCell()); 994 994 auto& world = *static_cast<DOMWrapperWorld*>(context); 995 995 uncacheWrapper(world, &jsTestInterface->wrapped(), jsTestInterface); -
trunk/Source/WebCore/bindings/scripts/test/JS/JSTestInterfaceLeadingUnderscore.cpp
r208613 r210829 185 185 void JSTestInterfaceLeadingUnderscoreOwner::finalize(JSC::Handle<JSC::Unknown> handle, void* context) 186 186 { 187 auto* jsTestInterfaceLeadingUnderscore = jsCast<JSTestInterfaceLeadingUnderscore*>(handle.slot()->asCell());187 auto* jsTestInterfaceLeadingUnderscore = static_cast<JSTestInterfaceLeadingUnderscore*>(handle.slot()->asCell()); 188 188 auto& world = *static_cast<DOMWrapperWorld*>(context); 189 189 uncacheWrapper(world, &jsTestInterfaceLeadingUnderscore->wrapped(), jsTestInterfaceLeadingUnderscore); -
trunk/Source/WebCore/bindings/scripts/test/JS/JSTestIterable.cpp
r208613 r210829 245 245 void JSTestIterableOwner::finalize(JSC::Handle<JSC::Unknown> handle, void* context) 246 246 { 247 auto* jsTestIterable = jsCast<JSTestIterable*>(handle.slot()->asCell());247 auto* jsTestIterable = static_cast<JSTestIterable*>(handle.slot()->asCell()); 248 248 auto& world = *static_cast<DOMWrapperWorld*>(context); 249 249 uncacheWrapper(world, &jsTestIterable->wrapped(), jsTestIterable); -
trunk/Source/WebCore/bindings/scripts/test/JS/JSTestMediaQueryListListener.cpp
r209153 r210829 194 194 void JSTestMediaQueryListListenerOwner::finalize(JSC::Handle<JSC::Unknown> handle, void* context) 195 195 { 196 auto* jsTestMediaQueryListListener = jsCast<JSTestMediaQueryListListener*>(handle.slot()->asCell());196 auto* jsTestMediaQueryListListener = static_cast<JSTestMediaQueryListListener*>(handle.slot()->asCell()); 197 197 auto& world = *static_cast<DOMWrapperWorld*>(context); 198 198 uncacheWrapper(world, &jsTestMediaQueryListListener->wrapped(), jsTestMediaQueryListListener); -
trunk/Source/WebCore/bindings/scripts/test/JS/JSTestNamedConstructor.cpp
r210025 r210829 205 205 void JSTestNamedConstructorOwner::finalize(JSC::Handle<JSC::Unknown> handle, void* context) 206 206 { 207 auto* jsTestNamedConstructor = jsCast<JSTestNamedConstructor*>(handle.slot()->asCell());207 auto* jsTestNamedConstructor = static_cast<JSTestNamedConstructor*>(handle.slot()->asCell()); 208 208 auto& world = *static_cast<DOMWrapperWorld*>(context); 209 209 uncacheWrapper(world, &jsTestNamedConstructor->wrapped(), jsTestNamedConstructor); -
trunk/Source/WebCore/bindings/scripts/test/JS/JSTestObj.cpp
r210675 r210829 8618 8618 void JSTestObjOwner::finalize(JSC::Handle<JSC::Unknown> handle, void* context) 8619 8619 { 8620 auto* jsTestObj = jsCast<JSTestObj*>(handle.slot()->asCell());8620 auto* jsTestObj = static_cast<JSTestObj*>(handle.slot()->asCell()); 8621 8621 auto& world = *static_cast<DOMWrapperWorld*>(context); 8622 8622 uncacheWrapper(world, &jsTestObj->wrapped(), jsTestObj); -
trunk/Source/WebCore/bindings/scripts/test/JS/JSTestOverloadedConstructors.cpp
r210025 r210829 261 261 void JSTestOverloadedConstructorsOwner::finalize(JSC::Handle<JSC::Unknown> handle, void* context) 262 262 { 263 auto* jsTestOverloadedConstructors = jsCast<JSTestOverloadedConstructors*>(handle.slot()->asCell());263 auto* jsTestOverloadedConstructors = static_cast<JSTestOverloadedConstructors*>(handle.slot()->asCell()); 264 264 auto& world = *static_cast<DOMWrapperWorld*>(context); 265 265 uncacheWrapper(world, &jsTestOverloadedConstructors->wrapped(), jsTestOverloadedConstructors); -
trunk/Source/WebCore/bindings/scripts/test/JS/JSTestOverloadedConstructorsWithSequence.cpp
r210025 r210829 212 212 void JSTestOverloadedConstructorsWithSequenceOwner::finalize(JSC::Handle<JSC::Unknown> handle, void* context) 213 213 { 214 auto* jsTestOverloadedConstructorsWithSequence = jsCast<JSTestOverloadedConstructorsWithSequence*>(handle.slot()->asCell());214 auto* jsTestOverloadedConstructorsWithSequence = static_cast<JSTestOverloadedConstructorsWithSequence*>(handle.slot()->asCell()); 215 215 auto& world = *static_cast<DOMWrapperWorld*>(context); 216 216 uncacheWrapper(world, &jsTestOverloadedConstructorsWithSequence->wrapped(), jsTestOverloadedConstructorsWithSequence); -
trunk/Source/WebCore/bindings/scripts/test/JS/JSTestOverrideBuiltins.cpp
r210675 r210829 233 233 void JSTestOverrideBuiltinsOwner::finalize(JSC::Handle<JSC::Unknown> handle, void* context) 234 234 { 235 auto* jsTestOverrideBuiltins = jsCast<JSTestOverrideBuiltins*>(handle.slot()->asCell());235 auto* jsTestOverrideBuiltins = static_cast<JSTestOverrideBuiltins*>(handle.slot()->asCell()); 236 236 auto& world = *static_cast<DOMWrapperWorld*>(context); 237 237 uncacheWrapper(world, &jsTestOverrideBuiltins->wrapped(), jsTestOverrideBuiltins); -
trunk/Source/WebCore/bindings/scripts/test/JS/JSTestSerialization.cpp
r208613 r210829 398 398 void JSTestSerializationOwner::finalize(JSC::Handle<JSC::Unknown> handle, void* context) 399 399 { 400 auto* jsTestSerialization = jsCast<JSTestSerialization*>(handle.slot()->asCell());400 auto* jsTestSerialization = static_cast<JSTestSerialization*>(handle.slot()->asCell()); 401 401 auto& world = *static_cast<DOMWrapperWorld*>(context); 402 402 uncacheWrapper(world, &jsTestSerialization->wrapped(), jsTestSerialization); -
trunk/Source/WebCore/bindings/scripts/test/JS/JSTestSerializedScriptValueInterface.cpp
r209925 r210829 366 366 void JSTestSerializedScriptValueInterfaceOwner::finalize(JSC::Handle<JSC::Unknown> handle, void* context) 367 367 { 368 auto* jsTestSerializedScriptValueInterface = jsCast<JSTestSerializedScriptValueInterface*>(handle.slot()->asCell());368 auto* jsTestSerializedScriptValueInterface = static_cast<JSTestSerializedScriptValueInterface*>(handle.slot()->asCell()); 369 369 auto& world = *static_cast<DOMWrapperWorld*>(context); 370 370 uncacheWrapper(world, &jsTestSerializedScriptValueInterface->wrapped(), jsTestSerializedScriptValueInterface); -
trunk/Source/WebCore/bindings/scripts/test/JS/JSTestTypedefs.cpp
r210025 r210829 771 771 void JSTestTypedefsOwner::finalize(JSC::Handle<JSC::Unknown> handle, void* context) 772 772 { 773 auto* jsTestTypedefs = jsCast<JSTestTypedefs*>(handle.slot()->asCell());773 auto* jsTestTypedefs = static_cast<JSTestTypedefs*>(handle.slot()->asCell()); 774 774 auto& world = *static_cast<DOMWrapperWorld*>(context); 775 775 uncacheWrapper(world, &jsTestTypedefs->wrapped(), jsTestTypedefs); -
trunk/Source/WebKit2/ChangeLog
r210828 r210829 1 2017-01-17 Filip Pizlo <fpizlo@apple.com> 2 3 JSCell::classInfo() shouldn't have a bunch of mitigations for being called during destruction 4 https://bugs.webkit.org/show_bug.cgi?id=167066 5 6 Reviewed by Keith Miller and Michael Saboff. 7 8 Just remove now-erroneous use of jsCast<>. 9 10 * WebProcess/Plugins/Netscape/NPRuntimeObjectMap.cpp: 11 (WebKit::NPRuntimeObjectMap::finalize): 12 1 13 2017-01-17 Joseph Pecoraro <pecoraro@apple.com> 2 14 -
trunk/Source/WebKit2/WebProcess/Plugins/Netscape/NPRuntimeObjectMap.cpp
r210697 r210829 300 300 void NPRuntimeObjectMap::finalize(JSC::Handle<JSC::Unknown> handle, void* context) 301 301 { 302 JSNPObject* object = jsCast<JSNPObject*>(handle.get().asCell());302 JSNPObject* object = static_cast<JSNPObject*>(handle.get().asCell()); 303 303 weakRemove(m_jsNPObjects, static_cast<NPObject*>(context), object); 304 304 addToInvalidationQueue(object->leakNPObject());
Note: See TracChangeset
for help on using the changeset viewer.