Changeset 37631 in webkit
- Timestamp:
- Oct 16, 2008 1:00:53 AM (16 years ago)
- Location:
- trunk
- Files:
-
- 12 edited
Legend:
- Unmodified
- Added
- Removed
-
trunk/JavaScriptCore/ChangeLog
r37630 r37631 1 2008-10-15 Alexey Proskuryakov <ap@webkit.org> 2 3 Reviewed by Darin Adler. 4 5 https://bugs.webkit.org/show_bug.cgi?id=21609 6 Make MessagePorts protect their peers across heaps 7 8 * JavaScriptCore.exp: 9 * kjs/JSGlobalObject.cpp: 10 (JSC::JSGlobalObject::markCrossHeapDependentObjects): 11 * kjs/JSGlobalObject.h: 12 * kjs/collector.cpp: 13 (JSC::Heap::collect): 14 Before GC sweep phase, a function supplied by global object is now called for all global 15 objects in the heap, making it possible to implement cross-heap dependencies. 16 1 17 2008-10-15 Alexey Proskuryakov <ap@webkit.org> 2 18 -
trunk/JavaScriptCore/JavaScriptCore.exp
r37622 r37631 148 148 __ZN3JSC14JSGlobalObject17putWithAttributesEPNS_9ExecStateERKNS_10IdentifierEPNS_7JSValueEj 149 149 __ZN3JSC14JSGlobalObject17startTimeoutCheckEv 150 __ZN3JSC14JSGlobalObject29markCrossHeapDependentObjectsEv 150 151 __ZN3JSC14JSGlobalObject3putEPNS_9ExecStateERKNS_10IdentifierEPNS_7JSValueERNS_15PutPropertySlotE 151 152 __ZN3JSC14JSGlobalObject4initEPNS_8JSObjectE -
trunk/JavaScriptCore/kjs/JSGlobalObject.cpp
r37433 r37631 400 400 } 401 401 402 void JSGlobalObject::markCrossHeapDependentObjects() 403 { 404 // Overridden by subclasses. 405 } 406 402 407 JSGlobalObject* JSGlobalObject::toGlobalObject(ExecState*) const 403 408 { -
trunk/JavaScriptCore/kjs/JSGlobalObject.h
r37323 r37631 159 159 160 160 virtual void mark(); 161 virtual void markCrossHeapDependentObjects(); 161 162 162 163 virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&); -
trunk/JavaScriptCore/kjs/collector.cpp
r37622 r37631 970 970 m_globalData->smallStrings.mark(); 971 971 972 JSGlobalObject* globalObject = m_globalData->head; 973 do { 974 globalObject->markCrossHeapDependentObjects(); 975 globalObject = globalObject->next(); 976 } while (globalObject != m_globalData->head); 977 972 978 JAVASCRIPTCORE_GC_MARKED(); 973 979 -
trunk/WebCore/ChangeLog
r37628 r37631 1 2008-10-15 Alexey Proskuryakov <ap@webkit.org> 2 3 Reviewed by Darin Adler. 4 5 https://bugs.webkit.org/show_bug.cgi?id=21609 6 Make MessagePorts protect their peers across heaps 7 8 * dom/MessagePort.cpp: 9 (WebCore::MessagePort::MessagePort): 10 * dom/MessagePort.h: 11 (WebCore::MessagePort::setJSWrapperIsKnownToBeInaccessible): 12 (WebCore::MessagePort::jsWrapperIsKnownToBeInaccessible): 13 Track objects whose JS wrappers are no longer reachable in MessagePort. Unfortunately, this 14 means that the implementation object knows about JS bindings - but it is not possible to 15 access JS wrappers from another heap/thread. 16 17 * bindings/js/JSDOMBinding.cpp: 18 (WebCore::markCrossHeapDependentObjectsForDocument): 19 * bindings/js/JSDOMBinding.h: 20 * bindings/js/JSDOMWindowBase.cpp: 21 (WebCore::JSDOMWindowBase::markCrossHeapDependentObjects): 22 * bindings/js/JSDOMWindowBase.h: 23 Implement cross-heap dependency tracking for entangled MessagePorts. If a wrapper object 24 hasn't been marked normally, it is marked as inaccessible. It is then marked manually, 25 as long as its entangled port is accessible itself. 26 1 27 2008-10-15 Jon Honeycutt <jhoneycutt@apple.com> 2 28 -
trunk/WebCore/bindings/js/JSDOMBinding.cpp
r37199 r37631 269 269 } 270 270 271 void markCrossHeapDependentObjectsForDocument(JSGlobalData& globalData, Document* document) 272 { 273 const HashSet<MessagePort*>& messagePorts = document->messagePorts(); 274 HashSet<MessagePort*>::const_iterator portsEnd = messagePorts.end(); 275 for (HashSet<MessagePort*>::const_iterator iter = messagePorts.begin(); iter != portsEnd; ++iter) { 276 MessagePort* port = *iter; 277 RefPtr<MessagePort> entangledPort = port->entangledPort(); 278 if (entangledPort) { 279 // No wrapper, or wrapper is already marked - no need to examine cross-heap dependencies. 280 DOMObject* wrapper = getCachedDOMObjectWrapper(globalData, port); 281 if (!wrapper || wrapper->marked()) 282 continue; 283 284 // If the wrapper hasn't been marked during the mark phase of GC, then the port shouldn't protect its entangled one. 285 // It's important not to call this when there is no wrapper. E.g., if GC is triggered after a MessageChannel is created, but before its ports are used from JS, 286 // irreversibly telling the object that its (not yet existing) wrapper is inaccessible would be wrong. Similarly, ports posted via postMessage() may not 287 // have wrappers until delivered. 288 port->setJSWrapperIsInaccessible(); 289 290 // If the port is protected by its entangled one, mark it. 291 // This is an atomic read of a boolean value, no synchronization between threads is required (at least on platforms that guarantee cache coherency). 292 if (!entangledPort->jsWrapperIsInaccessible()) 293 wrapper->mark(); 294 } 295 } 296 } 297 271 298 void updateDOMNodeDocument(Node* node, Document* oldDocument, Document* newDocument) 272 299 { -
trunk/WebCore/bindings/js/JSDOMBinding.h
r37190 r37631 70 70 void markDOMNodesForDocument(Document*); 71 71 void markActiveObjectsForDocument(JSC::JSGlobalData&, Document*); 72 void markCrossHeapDependentObjectsForDocument(JSC::JSGlobalData&, Document*); 72 73 73 74 JSC::StructureID* getCachedDOMStructure(JSC::ExecState*, const JSC::ClassInfo*); -
trunk/WebCore/bindings/js/JSDOMWindowBase.cpp
r37563 r37631 508 508 } 509 509 510 void JSDOMWindowBase::markCrossHeapDependentObjects() 511 { 512 Document* document = impl()->document(); 513 if (!document) 514 return; 515 516 markCrossHeapDependentObjectsForDocument(*globalData(), document); 517 } 518 510 519 bool JSDOMWindowBase::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot) 511 520 { -
trunk/WebCore/bindings/js/JSDOMWindowBase.h
r37257 r37631 64 64 65 65 void disconnectFrame(); 66 67 virtual void markCrossHeapDependentObjects(); 66 68 67 69 virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&); -
trunk/WebCore/dom/MessagePort.cpp
r37190 r37631 69 69 , m_document(document) 70 70 , m_pendingActivity(0) 71 , m_jsWrapperIsInaccessible(false) 71 72 { 72 73 document->createdMessagePort(this); -
trunk/WebCore/dom/MessagePort.h
r37190 r37631 34 34 #include <wtf/MessageQueue.h> 35 35 #include <wtf/PassRefPtr.h> 36 #include <wtf/RefCounted.h>37 36 #include <wtf/RefPtr.h> 37 #include <wtf/Threading.h> 38 38 #include <wtf/Vector.h> 39 39 … … 46 46 class String; 47 47 48 class MessagePort : public RefCounted<MessagePort>, public EventTarget {48 class MessagePort : public ThreadSafeShared<MessagePort>, public EventTarget { 49 49 public: 50 50 static PassRefPtr<MessagePort> create(Document* document) { return adoptRef(new MessagePort(document)); } … … 84 84 EventListenersMap& eventListeners() { return m_eventListeners; } 85 85 86 using RefCounted<MessagePort>::ref;87 using RefCounted<MessagePort>::deref;86 using ThreadSafeShared<MessagePort>::ref; 87 using ThreadSafeShared<MessagePort>::deref; 88 88 89 89 bool hasPendingActivity() { return m_pendingActivity; } … … 94 94 void setOnclose(PassRefPtr<EventListener> eventListener) { m_onCloseListener = eventListener; } 95 95 EventListener* onclose() const { return m_onCloseListener.get(); } 96 97 void setJSWrapperIsInaccessible() { m_jsWrapperIsInaccessible = true; } 98 bool jsWrapperIsInaccessible() const { return m_jsWrapperIsInaccessible; } 96 99 97 100 private: … … 120 123 121 124 unsigned m_pendingActivity; 125 bool m_jsWrapperIsInaccessible; 122 126 }; 123 127
Note: See TracChangeset
for help on using the changeset viewer.