Changeset 86499 in webkit


Ignore:
Timestamp:
May 14, 2011 3:10:01 PM (13 years ago)
Author:
oliver@apple.com
Message:

2011-05-13 Oliver Hunt <​oliver@apple.com>

Reviewed by Geoffrey Garen.

Make GC validation more aggressive
​https://bugs.webkit.org/show_bug.cgi?id=60802

This patch makes the checks performed under GC_VALIDATION
much more aggressive, and adds the checks to more places
in order to allow us to catch GC bugs much closer to the
point of failure.

  • JavaScriptCore.exp:
  • JavaScriptCore.xcodeproj/project.pbxproj:
  • debugger/DebuggerActivation.cpp: (JSC::DebuggerActivation::visitChildren):
  • heap/MarkedBlock.cpp: (JSC::MarkedBlock::MarkedBlock):
  • heap/MarkedSpace.cpp:
  • runtime/Arguments.cpp: (JSC::Arguments::visitChildren):
  • runtime/Executable.cpp: (JSC::EvalExecutable::visitChildren): (JSC::ProgramExecutable::visitChildren): (JSC::FunctionExecutable::visitChildren):
  • runtime/Executable.h:
  • runtime/GetterSetter.cpp: (JSC::GetterSetter::visitChildren):
  • runtime/GetterSetter.h:
  • runtime/JSAPIValueWrapper.h: (JSC::JSAPIValueWrapper::createStructure): (JSC::JSAPIValueWrapper::JSAPIValueWrapper):
  • runtime/JSActivation.cpp: (JSC::JSActivation::visitChildren):
  • runtime/JSArray.cpp: (JSC::JSArray::visitChildren):
  • runtime/JSCell.cpp: (JSC::slowValidateCell):
  • runtime/JSCell.h: (JSC::JSCell::JSCell::unvalidatedStructure): (JSC::JSCell::JSCell::JSCell):
  • runtime/JSFunction.cpp: (JSC::JSFunction::visitChildren):
  • runtime/JSGlobalObject.cpp: (JSC::JSGlobalObject::visitChildren): (JSC::slowValidateCell):
  • runtime/JSONObject.h:
  • runtime/JSObject.cpp: (JSC::JSObject::visitChildren):
  • runtime/JSPropertyNameIterator.cpp: (JSC::JSPropertyNameIterator::visitChildren):
  • runtime/JSPropertyNameIterator.h:
  • runtime/JSStaticScopeObject.cpp: (JSC::JSStaticScopeObject::visitChildren):
  • runtime/JSString.h: (JSC::RopeBuilder::JSString):
  • runtime/JSWrapperObject.cpp: (JSC::JSWrapperObject::visitChildren):
  • runtime/NativeErrorConstructor.cpp: (JSC::NativeErrorConstructor::visitChildren):
  • runtime/PropertyMapHashTable.h: (JSC::PropertyMapEntry::PropertyMapEntry):
  • runtime/RegExpObject.cpp: (JSC::RegExpObject::visitChildren):
  • runtime/ScopeChain.cpp: (JSC::ScopeChainNode::visitChildren):
  • runtime/ScopeChain.h: (JSC::ScopeChainNode::ScopeChainNode):
  • runtime/Structure.cpp: (JSC::Structure::Structure): (JSC::Structure::addPropertyTransition): (JSC::Structure::visitChildren):
  • runtime/Structure.h: (JSC::JSCell::classInfo):
  • runtime/StructureChain.cpp: (JSC::StructureChain::visitChildren):
  • runtime/StructureChain.h:
  • runtime/WriteBarrier.h: (JSC::validateCell): (JSC::JSCell): (JSC::JSGlobalObject): (JSC::WriteBarrierBase::set): (JSC::WriteBarrierBase::setMayBeNull): (JSC::WriteBarrierBase::setEarlyValue): (JSC::WriteBarrierBase::get): (JSC::WriteBarrierBase::operator*): (JSC::WriteBarrierBase::operator->): (JSC::WriteBarrierBase::unvalidatedGet): (JSC::WriteBarrier::WriteBarrier):
  • wtf/Assertions.h:

2011-05-13 Oliver Hunt <​oliver@apple.com>

Reviewed by Geoffrey Garen.

Make GC validation more aggressive
​https://bugs.webkit.org/show_bug.cgi?id=60802

This makes GC_VALIDATION much more aggressive in webcore,
adding logic to every visitChildren method to ensure that
the structure still has correct flags.

Additionally every function generated for the dom bindings
makes use of the new GC_VALIDATION object assertions to further
ensure that the object appears to be sensible.

  • bindings/js/JSAttrCustom.cpp: (WebCore::JSAttr::visitChildren):
  • bindings/js/JSAudioContextCustom.cpp: (WebCore::JSAudioContext::visitChildren):
  • bindings/js/JSCSSRuleCustom.cpp: (WebCore::JSCSSRule::visitChildren):
  • bindings/js/JSCSSStyleDeclarationCustom.cpp: (WebCore::JSCSSStyleDeclaration::visitChildren):
  • bindings/js/JSCanvasRenderingContextCustom.cpp: (WebCore::JSCanvasRenderingContext::visitChildren):
  • bindings/js/JSDOMGlobalObject.cpp: (WebCore::JSDOMGlobalObject::visitChildren): (WebCore::JSDOMGlobalObject::setInjectedScript):
  • bindings/js/JSDOMWindowCustom.cpp: (WebCore::JSDOMWindow::visitChildren):
  • bindings/js/JSDOMWindowShell.cpp: (WebCore::JSDOMWindowShell::visitChildren):
  • bindings/js/JSEventListener.cpp: (WebCore::JSEventListener::JSEventListener):
  • bindings/js/JSEventListener.h: (WebCore::JSEventListener::jsFunction):
  • bindings/js/JSJavaScriptAudioNodeCustom.cpp: (WebCore::JSJavaScriptAudioNode::visitChildren):
  • bindings/js/JSMessageChannelCustom.cpp: (WebCore::JSMessageChannel::visitChildren):
  • bindings/js/JSMessagePortCustom.cpp: (WebCore::JSMessagePort::visitChildren):
  • bindings/js/JSNamedNodeMapCustom.cpp: (WebCore::JSNamedNodeMap::visitChildren):
  • bindings/js/JSNodeCustom.cpp: (WebCore::JSNode::visitChildren):
  • bindings/js/JSNodeFilterCustom.cpp: (WebCore::JSNodeFilter::visitChildren):
  • bindings/js/JSNodeIteratorCustom.cpp: (WebCore::JSNodeIterator::visitChildren):
  • bindings/js/JSSVGElementInstanceCustom.cpp: (WebCore::JSSVGElementInstance::visitChildren):
  • bindings/js/JSSharedWorkerCustom.cpp: (WebCore::JSSharedWorker::visitChildren):
  • bindings/js/JSStyleSheetCustom.cpp: (WebCore::JSStyleSheet::visitChildren):
  • bindings/js/JSTreeWalkerCustom.cpp: (WebCore::JSTreeWalker::visitChildren):
  • bindings/js/JSWebGLRenderingContextCustom.cpp: (WebCore::JSWebGLRenderingContext::visitChildren):
  • bindings/js/JSWorkerContextCustom.cpp: (WebCore::JSWorkerContext::visitChildren):
  • bindings/js/JSXMLHttpRequestCustom.cpp: (WebCore::JSXMLHttpRequest::visitChildren):
  • bindings/js/JSXPathResultCustom.cpp: (WebCore::JSXPathResult::visitChildren):
  • bindings/scripts/CodeGeneratorJS.pm:

2011-05-13 Oliver Hunt <​oliver@apple.com>

Reviewed by Geoffrey Garen.

Make GC validation more aggressive
​https://bugs.webkit.org/show_bug.cgi?id=60802

Add GC_VALIDATION calls to all the JSNPObject methods.

  • WebProcess/Plugins/Netscape/JSNPObject.cpp: (WebKit::JSNPObject::invalidate): (WebKit::JSNPObject::callMethod): (WebKit::JSNPObject::callObject): (WebKit::JSNPObject::callConstructor): (WebKit::JSNPObject::getCallData): (WebKit::JSNPObject::getConstructData): (WebKit::JSNPObject::getOwnPropertySlot): (WebKit::JSNPObject::getOwnPropertyDescriptor): (WebKit::JSNPObject::put): (WebKit::JSNPObject::getOwnPropertyNames): (WebKit::JSNPObject::propertyGetter): (WebKit::JSNPObject::methodGetter):
Location:
trunk/Source
Files:
66 edited

Legend:

Unmodified
Added
Removed

  • trunk/Source/JavaScriptCore/ChangeLog

    r86482 r86499  
     12011-05-13  Oliver Hunt  <oliver@apple.com>
     2
     3        Reviewed by Geoffrey Garen.
     4
     5        Make GC validation more aggressive
     6        https://bugs.webkit.org/show_bug.cgi?id=60802
     7
     8        This patch makes the checks performed under GC_VALIDATION
     9        much more aggressive, and adds the checks to more places
     10        in order to allow us to catch GC bugs much closer to the
     11        point of failure.
     12
     13        * JavaScriptCore.exp:
     14        * JavaScriptCore.xcodeproj/project.pbxproj:
     15        * debugger/DebuggerActivation.cpp:
     16        (JSC::DebuggerActivation::visitChildren):
     17        * heap/MarkedBlock.cpp:
     18        (JSC::MarkedBlock::MarkedBlock):
     19        * heap/MarkedSpace.cpp:
     20        * runtime/Arguments.cpp:
     21        (JSC::Arguments::visitChildren):
     22        * runtime/Executable.cpp:
     23        (JSC::EvalExecutable::visitChildren):
     24        (JSC::ProgramExecutable::visitChildren):
     25        (JSC::FunctionExecutable::visitChildren):
     26        * runtime/Executable.h:
     27        * runtime/GetterSetter.cpp:
     28        (JSC::GetterSetter::visitChildren):
     29        * runtime/GetterSetter.h:
     30        * runtime/JSAPIValueWrapper.h:
     31        (JSC::JSAPIValueWrapper::createStructure):
     32        (JSC::JSAPIValueWrapper::JSAPIValueWrapper):
     33        * runtime/JSActivation.cpp:
     34        (JSC::JSActivation::visitChildren):
     35        * runtime/JSArray.cpp:
     36        (JSC::JSArray::visitChildren):
     37        * runtime/JSCell.cpp:
     38        (JSC::slowValidateCell):
     39        * runtime/JSCell.h:
     40        (JSC::JSCell::JSCell::unvalidatedStructure):
     41        (JSC::JSCell::JSCell::JSCell):
     42        * runtime/JSFunction.cpp:
     43        (JSC::JSFunction::visitChildren):
     44        * runtime/JSGlobalObject.cpp:
     45        (JSC::JSGlobalObject::visitChildren):
     46        (JSC::slowValidateCell):
     47        * runtime/JSONObject.h:
     48        * runtime/JSObject.cpp:
     49        (JSC::JSObject::visitChildren):
     50        * runtime/JSPropertyNameIterator.cpp:
     51        (JSC::JSPropertyNameIterator::visitChildren):
     52        * runtime/JSPropertyNameIterator.h:
     53        * runtime/JSStaticScopeObject.cpp:
     54        (JSC::JSStaticScopeObject::visitChildren):
     55        * runtime/JSString.h:
     56        (JSC::RopeBuilder::JSString):
     57        * runtime/JSWrapperObject.cpp:
     58        (JSC::JSWrapperObject::visitChildren):
     59        * runtime/NativeErrorConstructor.cpp:
     60        (JSC::NativeErrorConstructor::visitChildren):
     61        * runtime/PropertyMapHashTable.h:
     62        (JSC::PropertyMapEntry::PropertyMapEntry):
     63        * runtime/RegExpObject.cpp:
     64        (JSC::RegExpObject::visitChildren):
     65        * runtime/ScopeChain.cpp:
     66        (JSC::ScopeChainNode::visitChildren):
     67        * runtime/ScopeChain.h:
     68        (JSC::ScopeChainNode::ScopeChainNode):
     69        * runtime/Structure.cpp:
     70        (JSC::Structure::Structure):
     71        (JSC::Structure::addPropertyTransition):
     72        (JSC::Structure::visitChildren):
     73        * runtime/Structure.h:
     74        (JSC::JSCell::classInfo):
     75        * runtime/StructureChain.cpp:
     76        (JSC::StructureChain::visitChildren):
     77        * runtime/StructureChain.h:
     78        * runtime/WriteBarrier.h:
     79        (JSC::validateCell):
     80        (JSC::JSCell):
     81        (JSC::JSGlobalObject):
     82        (JSC::WriteBarrierBase::set):
     83        (JSC::WriteBarrierBase::setMayBeNull):
     84        (JSC::WriteBarrierBase::setEarlyValue):
     85        (JSC::WriteBarrierBase::get):
     86        (JSC::WriteBarrierBase::operator*):
     87        (JSC::WriteBarrierBase::operator->):
     88        (JSC::WriteBarrierBase::unvalidatedGet):
     89        (JSC::WriteBarrier::WriteBarrier):
     90        * wtf/Assertions.h:
     91
     922011-05-13  Oliver Hunt  <oliver@apple.com>
     93
     94        Reviewed by Geoffrey Garen.
     95
     96        Make GC validation more aggressive
     97        https://bugs.webkit.org/show_bug.cgi?id=60802
     98
     99        This patch makes the checks performed under GC_VALIDATION
     100        much more aggressive, and adds the checks to more places
     101        in order to allow us to catch GC bugs much closer to the
     102        point of failure.
     103
     104        * JavaScriptCore.exp:
     105        * JavaScriptCore.xcodeproj/project.pbxproj:
     106        * debugger/DebuggerActivation.cpp:
     107        (JSC::DebuggerActivation::visitChildren):
     108        * heap/MarkedBlock.cpp:
     109        (JSC::MarkedBlock::MarkedBlock):
     110        * heap/MarkedSpace.cpp:
     111        * runtime/Arguments.cpp:
     112        (JSC::Arguments::visitChildren):
     113        * runtime/Executable.cpp:
     114        (JSC::EvalExecutable::visitChildren):
     115        (JSC::ProgramExecutable::visitChildren):
     116        (JSC::FunctionExecutable::visitChildren):
     117        * runtime/Executable.h:
     118        * runtime/GetterSetter.cpp:
     119        (JSC::GetterSetter::visitChildren):
     120        * runtime/GetterSetter.h:
     121        * runtime/JSAPIValueWrapper.h:
     122        (JSC::JSAPIValueWrapper::createStructure):
     123        (JSC::JSAPIValueWrapper::JSAPIValueWrapper):
     124        * runtime/JSActivation.cpp:
     125        (JSC::JSActivation::visitChildren):
     126        * runtime/JSArray.cpp:
     127        (JSC::JSArray::visitChildren):
     128        * runtime/JSCell.cpp:
     129        (JSC::slowValidateCell):
     130        * runtime/JSCell.h:
     131        (JSC::JSCell::JSCell::unvalidatedStructure):
     132        (JSC::JSCell::JSCell::JSCell):
     133        * runtime/JSFunction.cpp:
     134        (JSC::JSFunction::visitChildren):
     135        * runtime/JSGlobalObject.cpp:
     136        (JSC::JSGlobalObject::visitChildren):
     137        (JSC::slowValidateCell):
     138        * runtime/JSONObject.h:
     139        * runtime/JSObject.cpp:
     140        (JSC::JSObject::visitChildren):
     141        * runtime/JSPropertyNameIterator.cpp:
     142        (JSC::JSPropertyNameIterator::visitChildren):
     143        * runtime/JSPropertyNameIterator.h:
     144        * runtime/JSStaticScopeObject.cpp:
     145        (JSC::JSStaticScopeObject::visitChildren):
     146        * runtime/JSString.h:
     147        (JSC::RopeBuilder::JSString):
     148        * runtime/JSWrapperObject.cpp:
     149        (JSC::JSWrapperObject::visitChildren):
     150        * runtime/NativeErrorConstructor.cpp:
     151        (JSC::NativeErrorConstructor::visitChildren):
     152        * runtime/PropertyMapHashTable.h:
     153        (JSC::PropertyMapEntry::PropertyMapEntry):
     154        * runtime/RegExpObject.cpp:
     155        (JSC::RegExpObject::visitChildren):
     156        * runtime/ScopeChain.cpp:
     157        (JSC::ScopeChainNode::visitChildren):
     158        * runtime/ScopeChain.h:
     159        (JSC::ScopeChainNode::ScopeChainNode):
     160        * runtime/Structure.cpp:
     161        (JSC::Structure::Structure):
     162        (JSC::Structure::addPropertyTransition):
     163        (JSC::Structure::visitChildren):
     164        * runtime/Structure.h:
     165        (JSC::JSCell::classInfo):
     166        * runtime/StructureChain.cpp:
     167        (JSC::StructureChain::visitChildren):
     168        * runtime/StructureChain.h:
     169        * runtime/WriteBarrier.h:
     170        (JSC::validateCell):
     171        (JSC::JSCell):
     172        (JSC::JSGlobalObject):
     173        (JSC::WriteBarrierBase::set):
     174        (JSC::WriteBarrierBase::setMayBeNull):
     175        (JSC::WriteBarrierBase::setEarlyValue):
     176        (JSC::WriteBarrierBase::get):
     177        (JSC::WriteBarrierBase::operator*):
     178        (JSC::WriteBarrierBase::operator->):
     179        (JSC::WriteBarrierBase::unvalidatedGet):
     180        (JSC::WriteBarrier::WriteBarrier):
     181        * wtf/Assertions.h:
     182
    11832011-05-14  Csaba Osztrogonác  <ossy@webkit.org>
    2184

  • trunk/Source/JavaScriptCore/JavaScriptCore.exp

    r86482 r86499  
    168168__ZN3JSC14SamplingThread4stopEv
    169169__ZN3JSC14SamplingThread5startEj
     170__ZN3JSC14ScopeChainNode6s_infoE
    170171__ZN3JSC14TimeoutChecker10didTimeOutEPNS_9ExecStateE
    171172__ZN3JSC14TimeoutChecker5resetEv
    … …  
    184185__ZN3JSC16JSVariableObject19getOwnPropertyNamesEPNS_9ExecStateERNS_17PropertyNameArrayENS_15EnumerationModeE
    185186__ZN3JSC16createRangeErrorEPNS_9ExecStateERKNS_7UStringE
     187__ZN3JSC16slowValidateCellEPNS_14JSGlobalObjectE
     188__ZN3JSC16slowValidateCellEPNS_6JSCellE
    186189__ZN3JSC16throwSyntaxErrorEPNS_9ExecStateE
    187190__ZN3JSC17BytecodeGenerator21setDumpsGeneratedCodeEb

  • trunk/Source/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def

    r86482 r86499  
    318318    ?size@Heap@JSC@@QBEIXZ
    319319    ?slowAppend@MarkedArgumentBuffer@JSC@@AAEXVJSValue@2@@Z
     320    ?slowValidateCell@JSC@@YAXPAVJSCell@1@@Z
     321    ?slowValidateCell@JSC@@YAXPAVJSGlobalObject@1@@Z
    320322    ?startProfiling@Profiler@JSC@@QAEXPAVExecState@2@ABVUString@2@@Z
    321323    ?startSampling@JSGlobalData@JSC@@QAEXXZ

  • trunk/Source/JavaScriptCore/JavaScriptCore.xcodeproj/project.pbxproj

    r86482 r86499  
    27012701                        attributes = {
    27022702                                BuildIndependentTargetsInParallel = YES;
     2703                                LastUpgradeCheck = 0420;
    27032704                        };
    27042705                        buildConfigurationList = 149C277108902AFE008A9EFC /* Build configuration list for PBXProject "JavaScriptCore" */;

  • trunk/Source/JavaScriptCore/debugger/DebuggerActivation.cpp

    r86482 r86499  
    4141void DebuggerActivation::visitChildren(SlotVisitor& visitor)
    4242{
     43    ASSERT_GC_OBJECT_INHERITS(this, &s_info);
     44    COMPILE_ASSERT(StructureFlags & OverridesVisitChildren, OverridesVisitChildrenWithoutSettingFlag);
     45    ASSERT(structure()->typeInfo().overridesVisitChildren());
    4346    JSObject::visitChildren(visitor);
    4447

  • trunk/Source/JavaScriptCore/heap/MarkedBlock.cpp

    r86482 r86499  
    6161    Structure* dummyMarkableCellStructure = globalData->dummyMarkableCellStructure.get();
    6262    for (size_t i = firstAtom(); i < m_endAtom; i += m_atomsPerCell)
    63         new (&atoms()[i]) JSCell(*globalData, dummyMarkableCellStructure);
     63        new (&atoms()[i]) JSCell(*globalData, dummyMarkableCellStructure, JSCell::CreatingEarlyCell);
    6464}
    6565

  • trunk/Source/JavaScriptCore/heap/MarkedSpace.cpp

    r86482 r86499  
    2222#include "MarkedSpace.h"
    2323
     24#include "JSGlobalObject.h"
    2425#include "JSCell.h"
    2526#include "JSGlobalData.h"

  • trunk/Source/JavaScriptCore/runtime/Arguments.cpp

    r86482 r86499  
    4646void Arguments::visitChildren(SlotVisitor& visitor)
    4747{
     48    ASSERT_GC_OBJECT_INHERITS(this, &s_info);
     49    COMPILE_ASSERT(StructureFlags & OverridesVisitChildren, OverridesVisitChildrenWithoutSettingFlag);
     50    ASSERT(structure()->typeInfo().overridesVisitChildren());
    4851    JSObject::visitChildren(visitor);
    4952

  • trunk/Source/JavaScriptCore/runtime/Executable.cpp

    r86482 r86499  
    146146void EvalExecutable::visitChildren(SlotVisitor& visitor)
    147147{
     148    ASSERT_GC_OBJECT_INHERITS(this, &s_info);
     149    COMPILE_ASSERT(StructureFlags & OverridesVisitChildren, OverridesVisitChildrenWithoutSettingFlag);
     150    ASSERT(structure()->typeInfo().overridesVisitChildren());
    148151    ScriptExecutable::visitChildren(visitor);
    149152    if (m_evalCodeBlock)
    … …  
    238241void ProgramExecutable::visitChildren(SlotVisitor& visitor)
    239242{
     243    ASSERT_GC_OBJECT_INHERITS(this, &s_info);
     244    COMPILE_ASSERT(StructureFlags & OverridesVisitChildren, OverridesVisitChildrenWithoutSettingFlag);
     245    ASSERT(structure()->typeInfo().overridesVisitChildren());
    240246    ScriptExecutable::visitChildren(visitor);
    241247    if (m_programCodeBlock)
    … …  
    350356void FunctionExecutable::visitChildren(SlotVisitor& visitor)
    351357{
     358    ASSERT_GC_OBJECT_INHERITS(this, &s_info);
     359    COMPILE_ASSERT(StructureFlags & OverridesVisitChildren, OverridesVisitChildrenWithoutSettingFlag);
     360    ASSERT(structure()->typeInfo().overridesVisitChildren());
    352361    ScriptExecutable::visitChildren(visitor);
    353362    if (m_codeBlockForCall)

  • trunk/Source/JavaScriptCore/runtime/Executable.h

    r86482 r86499  
    6767
    6868        static Structure* createStructure(JSGlobalData& globalData, JSValue proto) { return Structure::create(globalData, proto, TypeInfo(CompoundType, StructureFlags), AnonymousSlotCount, &s_info); }
     69       
     70        static const ClassInfo s_info;
    6971
    7072    protected:
    7173        static const unsigned StructureFlags = 0;
    72         static const ClassInfo s_info;
    7374        int m_numParametersForCall;
    7475        int m_numParametersForConstruct;
    … …  
    118119
    119120        static Structure* createStructure(JSGlobalData& globalData, JSValue proto) { return Structure::create(globalData, proto, TypeInfo(LeafType, StructureFlags), AnonymousSlotCount, &s_info); }
    120 
     121       
     122        static const ClassInfo s_info;
     123   
    121124    private:
    122125#if ENABLE(JIT)
    … …  
    144147        // trampoline. It may be easier to make NativeFunction be passed 'this' as a part of the ArgList.
    145148        NativeFunction m_constructor;
    146         static const ClassInfo s_info;
    147149    };
    148150
    … …  
    237239            return Structure::create(globalData, proto, TypeInfo(CompoundType, StructureFlags), AnonymousSlotCount, &s_info);
    238240        }
    239 
     241       
     242        static const ClassInfo s_info;
    240243    private:
    241244        static const unsigned StructureFlags = OverridesVisitChildren | ScriptExecutable::StructureFlags;
    242         static const ClassInfo s_info;
    243245        EvalExecutable(ExecState*, const SourceCode&, bool);
    244246
    … …  
    287289            return Structure::create(globalData, proto, TypeInfo(CompoundType, StructureFlags), AnonymousSlotCount, &s_info);
    288290        }
     291       
     292        static const ClassInfo s_info;
    289293
    290294    private:
    291295        static const unsigned StructureFlags = OverridesVisitChildren | ScriptExecutable::StructureFlags;
    292         static const ClassInfo s_info;
    293296        ProgramExecutable(ExecState*, const SourceCode&);
    294297
    … …  
    383386            return Structure::create(globalData, proto, TypeInfo(CompoundType, StructureFlags), AnonymousSlotCount, &s_info);
    384387        }
     388       
     389        static const ClassInfo s_info;
    385390
    386391    private:
    … …  
    392397       
    393398        static const unsigned StructureFlags = OverridesVisitChildren | ScriptExecutable::StructureFlags;
    394         static const ClassInfo s_info;
    395399        unsigned m_numCapturedVariables : 31;
    396400        bool m_forceUsesArguments : 1;

  • trunk/Source/JavaScriptCore/runtime/GetterSetter.cpp

    r86482 r86499  
    3333void GetterSetter::visitChildren(SlotVisitor& visitor)
    3434{
     35    ASSERT_GC_OBJECT_INHERITS(this, &s_info);
     36    ASSERT(structure()->typeInfo().overridesVisitChildren());
    3537    JSCell::visitChildren(visitor);
    3638

  • trunk/Source/JavaScriptCore/runtime/GetterSetter.h

    r86482 r86499  
    5353            return Structure::create(globalData, prototype, TypeInfo(GetterSetterType, OverridesVisitChildren), AnonymousSlotCount, &s_info);
    5454        }
     55       
     56        static const ClassInfo s_info;
     57
    5558    private:
    5659        virtual bool isGetterSetter() const;
    57         static const ClassInfo s_info;
    5860
    5961        WriteBarrier<JSObject> m_getter;

  • trunk/Source/JavaScriptCore/runtime/JSAPIValueWrapper.h

    r86482 r86499  
    4141            return Structure::create(globalData, prototype, TypeInfo(CompoundType, OverridesVisitChildren | OverridesGetPropertyNames), AnonymousSlotCount, &s_info);
    4242        }
     43       
     44        static const ClassInfo s_info;
    4345
    44        
    4546    private:
    4647        JSAPIValueWrapper(ExecState* exec, JSValue value)
    … …  
    5051            ASSERT(!value.isCell());
    5152        }
    52         static const ClassInfo s_info;
    5353
    5454        WriteBarrier<Unknown> m_value;

  • trunk/Source/JavaScriptCore/runtime/JSActivation.cpp

    r86482 r86499  
    6161void JSActivation::visitChildren(SlotVisitor& visitor)
    6262{
     63    ASSERT_GC_OBJECT_INHERITS(this, &s_info);
     64    COMPILE_ASSERT(StructureFlags & OverridesVisitChildren, OverridesVisitChildrenWithoutSettingFlag);
     65    ASSERT(structure()->typeInfo().overridesVisitChildren());
    6366    Base::visitChildren(visitor);
    6467

  • trunk/Source/JavaScriptCore/runtime/JSArray.cpp

    r86482 r86499  
    860860void JSArray::visitChildren(SlotVisitor& visitor)
    861861{
     862    ASSERT_GC_OBJECT_INHERITS(this, &s_info);
     863    COMPILE_ASSERT(StructureFlags & OverridesVisitChildren, OverridesVisitChildrenWithoutSettingFlag);
     864    ASSERT(structure()->typeInfo().overridesVisitChildren());
    862865    visitChildrenDirect(visitor);
    863866}

  • trunk/Source/JavaScriptCore/runtime/JSCell.cpp

    r86482 r86499  
    222222}
    223223
     224void slowValidateCell(JSCell* cell)
     225{
     226    ASSERT_GC_OBJECT_LOOKS_VALID(cell);
     227}
     228
    224229} // namespace JSC

  • trunk/Source/JavaScriptCore/runtime/JSCell.h

    r86482 r86499  
    7272        friend class Structure;
    7373        friend class StructureChain;
     74        enum CreatingEarlyCellTag { CreatingEarlyCell };
    7475
    7576    protected:
    … …  
    7980        explicit JSCell(VPtrStealingHackType) { }
    8081        JSCell(JSGlobalData&, Structure*);
     82        JSCell(JSGlobalData&, Structure*, CreatingEarlyCellTag);
    8183        virtual ~JSCell();
    8284        static const ClassInfo s_dummyCellInfo;
    … …  
    149151        }
    150152
     153#if ENABLE(GC_VALIDATION)
     154        Structure* unvalidatedStructure() { return m_structure.unvalidatedGet(); }
     155#endif
     156       
    151157    protected:
    152158        static const unsigned AnonymousSlotCount = 0;
    … …  
    163169        : m_structure(globalData, this, structure)
    164170    {
     171        ASSERT(m_structure);
     172    }
     173
     174    inline JSCell::JSCell(JSGlobalData& globalData, Structure* structure, CreatingEarlyCellTag)
     175    {
     176#if ENABLE(GC_VALIDATION)
     177        if (structure)
     178#endif
     179            m_structure.setEarlyValue(globalData, this, structure);
    165180        // Very first set of allocations won't have a real structure.
    166181        ASSERT(m_structure || !globalData.dummyMarkableCellStructure);

  • trunk/Source/JavaScriptCore/runtime/JSFunction.cpp

    r86482 r86499  
    136136void JSFunction::visitChildren(SlotVisitor& visitor)
    137137{
     138    ASSERT_GC_OBJECT_INHERITS(this, &s_info);
     139    COMPILE_ASSERT(StructureFlags & OverridesVisitChildren, OverridesVisitChildrenWithoutSettingFlag);
     140    ASSERT(structure()->typeInfo().overridesVisitChildren());
    138141    Base::visitChildren(visitor);
    139142

  • trunk/Source/JavaScriptCore/runtime/JSGlobalObject.cpp

    r86482 r86499  
    311311void JSGlobalObject::visitChildren(SlotVisitor& visitor)
    312312{
     313    ASSERT_GC_OBJECT_INHERITS(this, &s_info);
     314    COMPILE_ASSERT(StructureFlags & OverridesVisitChildren, OverridesVisitChildrenWithoutSettingFlag);
     315    ASSERT(structure()->typeInfo().overridesVisitChildren());
    313316    JSVariableObject::visitChildren(visitor);
    314317
    … …  
    460463}
    461464
     465void slowValidateCell(JSGlobalObject* globalObject)
     466{
     467    if (!globalObject->isGlobalObject())
     468        CRASH();
     469    ASSERT_GC_OBJECT_INHERITS(globalObject, &JSGlobalObject::s_info);
     470}
     471
    462472} // namespace JSC

  • trunk/Source/JavaScriptCore/runtime/JSONObject.h

    r86482 r86499  
    4141            return Structure::create(globalData, prototype, TypeInfo(ObjectType, StructureFlags), AnonymousSlotCount, &s_info);
    4242        }
     43       
     44        static const ClassInfo s_info;
    4345
    4446    protected:
    … …  
    4951        virtual bool getOwnPropertyDescriptor(ExecState*, const Identifier&, PropertyDescriptor&);
    5052
    51         static const ClassInfo s_info;
    5253    };
    5354

  • trunk/Source/JavaScriptCore/runtime/JSObject.cpp

    r86482 r86499  
    7171void JSObject::visitChildren(SlotVisitor& visitor)
    7272{
     73    ASSERT_GC_OBJECT_INHERITS(this, &s_info);
    7374#ifndef NDEBUG
    7475    bool wasCheckingForDefaultMarkViolation = visitor.m_isCheckingForDefaultMarkViolation;

  • trunk/Source/JavaScriptCore/runtime/JSPropertyNameIterator.cpp

    r86482 r86499  
    9898void JSPropertyNameIterator::visitChildren(SlotVisitor& visitor)
    9999{
     100    ASSERT_GC_OBJECT_INHERITS(this, &s_info);
     101    ASSERT(structure()->typeInfo().overridesVisitChildren());
    100102    visitor.appendValues(m_jsStrings.get(), m_jsStringsSize, MayContainNullValues);
    101103    if (m_cachedPrototypeChain)

  • trunk/Source/JavaScriptCore/runtime/JSPropertyNameIterator.h

    r86482 r86499  
    7676        void setCachedPrototypeChain(JSGlobalData& globalData, StructureChain* cachedPrototypeChain) { m_cachedPrototypeChain.set(globalData, this, cachedPrototypeChain); }
    7777        StructureChain* cachedPrototypeChain() { return m_cachedPrototypeChain.get(); }
     78       
     79        static const ClassInfo s_info;
    7880
    7981    private:
    80         static const ClassInfo s_info;
    8182        JSPropertyNameIterator(ExecState*, PropertyNameArrayData* propertyNameArrayData, size_t numCacheableSlot);
    8283

  • trunk/Source/JavaScriptCore/runtime/JSStaticScopeObject.cpp

    r86482 r86499  
    3535void JSStaticScopeObject::visitChildren(SlotVisitor& visitor)
    3636{
     37    ASSERT_GC_OBJECT_INHERITS(this, &s_info);
     38    COMPILE_ASSERT(StructureFlags & OverridesVisitChildren, OverridesVisitChildrenWithoutSettingFlag);
     39    ASSERT(structure()->typeInfo().overridesVisitChildren());
    3740    JSVariableObject::visitChildren(visitor);
    3841    visitor.append(&m_registerStore);

  • trunk/Source/JavaScriptCore/runtime/JSString.h

    r86482 r86499  
    331331            return Structure::create(globalData, proto, TypeInfo(StringType, OverridesGetOwnPropertySlot | NeedsThisConversion), AnonymousSlotCount, &s_info);
    332332        }
     333       
     334        static const ClassInfo s_info;
    333335
    334336    private:
    … …  
    338340        {
    339341        }
    340         static const ClassInfo s_info;
    341342
    342343        void resolveRope(ExecState*) const;

  • trunk/Source/JavaScriptCore/runtime/JSWrapperObject.cpp

    r86482 r86499  
    2929void JSWrapperObject::visitChildren(SlotVisitor& visitor)
    3030{
     31    ASSERT_GC_OBJECT_INHERITS(this, &s_info);
     32    COMPILE_ASSERT(StructureFlags & OverridesVisitChildren, OverridesVisitChildrenWithoutSettingFlag);
     33    ASSERT(structure()->typeInfo().overridesVisitChildren());
    3134    JSObject::visitChildren(visitor);
    3235    if (m_internalValue)

  • trunk/Source/JavaScriptCore/runtime/NativeErrorConstructor.cpp

    r86482 r86499  
    4949void NativeErrorConstructor::visitChildren(SlotVisitor& visitor)
    5050{
     51    ASSERT_GC_OBJECT_INHERITS(this, &s_info);
     52    COMPILE_ASSERT(StructureFlags & OverridesVisitChildren, OverridesVisitChildrenWithoutSettingFlag);
     53    ASSERT(structure()->typeInfo().overridesVisitChildren());
    5154    InternalFunction::visitChildren(visitor);
    5255    if (m_errorStructure)

  • trunk/Source/JavaScriptCore/runtime/PropertyMapHashTable.h

    r86482 r86499  
    8181        , offset(offset)
    8282        , attributes(attributes)
    83         , specificValue(globalData, owner, specificValue)
     83        , specificValue(globalData, owner, specificValue, WriteBarrier<JSCell>::MayBeNull)
    8484    {
    8585    }

  • trunk/Source/JavaScriptCore/runtime/RegExpObject.cpp

    r86482 r86499  
    7575void RegExpObject::visitChildren(SlotVisitor& visitor)
    7676{
     77    ASSERT_GC_OBJECT_INHERITS(this, &s_info);
     78    COMPILE_ASSERT(StructureFlags & OverridesVisitChildren, OverridesVisitChildrenWithoutSettingFlag);
     79    ASSERT(structure()->typeInfo().overridesVisitChildren());
    7780    Base::visitChildren(visitor);
    7881    if (UNLIKELY(!d->lastIndex.get().isInt32()))

  • trunk/Source/JavaScriptCore/runtime/ScopeChain.cpp

    r86482 r86499  
    7070void ScopeChainNode::visitChildren(SlotVisitor& visitor)
    7171{
     72    ASSERT_GC_OBJECT_INHERITS(this, &s_info);
     73    COMPILE_ASSERT(StructureFlags & OverridesVisitChildren, OverridesVisitChildrenWithoutSettingFlag);
     74    ASSERT(structure()->typeInfo().overridesVisitChildren());
    7275    if (next)
    7376        visitor.append(&next);

  • trunk/Source/JavaScriptCore/runtime/ScopeChain.h

    r86482 r86499  
    4040            : JSCell(*globalData, globalData->scopeChainNodeStructure.get())
    4141            , globalData(globalData)
    42             , next(*globalData, this, next)
     42            , next(*globalData, this, next, WriteBarrier<ScopeChainNode>::MayBeNull)
    4343            , object(*globalData, this, object)
    4444            , globalObject(*globalData, this, globalObject)
    … …  
    6969        static Structure* createStructure(JSGlobalData& globalData, JSValue proto) { return Structure::create(globalData, proto, TypeInfo(CompoundType, StructureFlags), AnonymousSlotCount, &s_info); }
    7070        virtual void visitChildren(SlotVisitor&);
     71        static JS_EXPORTDATA const ClassInfo s_info;
     72
    7173    private:
    7274        static const unsigned StructureFlags = OverridesVisitChildren;
    73         static const ClassInfo s_info;
    7475    };
    7576

  • trunk/Source/JavaScriptCore/runtime/Structure.cpp

    r86482 r86499  
    207207
    208208Structure::Structure(JSGlobalData& globalData)
    209     : JSCell(globalData, this)
     209    : JSCell(globalData, this, CreatingEarlyCell)
    210210    , m_typeInfo(CompoundType, OverridesVisitChildren)
    211211    , m_prototype(globalData, this, jsNull())
    … …  
    359359    Structure* transition = create(globalData, structure);
    360360
    361     transition->m_cachedPrototypeChain.set(globalData, transition, structure->m_cachedPrototypeChain.get());
     361    transition->m_cachedPrototypeChain.setMayBeNull(globalData, transition, structure->m_cachedPrototypeChain.get());
    362362    transition->m_previous.set(globalData, transition, structure);
    363363    transition->m_nameInPrevious = propertyName.impl();
    364364    transition->m_attributesInPrevious = attributes;
    365     transition->m_specificValueInPrevious.set(globalData, transition, specificValue);
     365    transition->m_specificValueInPrevious.setMayBeNull(globalData, transition, specificValue);
    366366
    367367    if (structure->m_propertyTable) {
    … …  
    780780void Structure::visitChildren(SlotVisitor& visitor)
    781781{
     782    ASSERT_GC_OBJECT_INHERITS(this, &s_info);
     783    ASSERT(structure()->typeInfo().overridesVisitChildren());
    782784    JSCell::visitChildren(visitor);
    783785    if (m_prototype)

  • trunk/Source/JavaScriptCore/runtime/Structure.h

    r86482 r86499  
    161161            return new (&globalData) Structure(globalData);
    162162        }
     163       
     164        static JS_EXPORTDATA const ClassInfo s_info;
    163165
    164166    private:
    … …  
    173175        }
    174176       
    175         static JS_EXPORTDATA const ClassInfo s_info;
    176 
    177177        typedef enum {
    178178            NoneDictionaryKind = 0,
    … …  
    279279    inline const ClassInfo* JSCell::classInfo() const
    280280    {
     281#if ENABLE(GC_VALIDATION)
     282        return m_structure.unvalidatedGet()->classInfo();
     283#else
    281284        return m_structure->classInfo();
     285#endif
    282286    }
    283287

  • trunk/Source/JavaScriptCore/runtime/StructureChain.cpp

    r86482 r86499  
    5656void StructureChain::visitChildren(SlotVisitor& visitor)
    5757{
     58    ASSERT_GC_OBJECT_INHERITS(this, &s_info);
     59    ASSERT(structure()->typeInfo().overridesVisitChildren());
    5860    size_t i = 0;
    5961    while (m_vector[i])

  • trunk/Source/JavaScriptCore/runtime/StructureChain.h

    r86482 r86499  
    4848
    4949        static Structure* createStructure(JSGlobalData& globalData, JSValue prototype) { return Structure::create(globalData, prototype, TypeInfo(CompoundType, OverridesVisitChildren), 0, &s_info); }
     50       
     51        static ClassInfo s_info;
    5052
    5153    private:
    … …  
    5355        ~StructureChain();
    5456        OwnArrayPtr<WriteBarrier<Structure> > m_vector;
    55         static ClassInfo s_info;
    5657    };
    5758

  • trunk/Source/JavaScriptCore/runtime/WriteBarrier.h

    r86482 r86499  
    2929#include "HandleTypes.h"
    3030#include "Heap.h"
     31#include "TypeTraits.h"
    3132
    3233namespace JSC {
    … …  
    3435class JSCell;
    3536class JSGlobalData;
     37class JSGlobalObject;
    3638
    3739template<class T> class WriteBarrierBase;
    3840template<> class WriteBarrierBase<JSValue>;
    3941
     42void slowValidateCell(JSCell*);
     43void slowValidateCell(JSGlobalObject*);
     44   
     45#if ENABLE(GC_VALIDATION)
     46template<class T> inline void validateCell(T cell)
     47{
     48    ASSERT_GC_OBJECT_INHERITS(cell, &WTF::RemovePointer<T>::Type::s_info);
     49}
     50
     51template<> inline void validateCell<JSCell*>(JSCell* cell)
     52{
     53    slowValidateCell(cell);
     54}
     55
     56template<> inline void validateCell<JSGlobalObject*>(JSGlobalObject* globalObject)
     57{
     58    slowValidateCell(globalObject);
     59}
     60#else
     61template<class T> inline void validateCell(T)
     62{
     63}
     64#endif
     65
    4066// We have a separate base class with no constructors for use in Unions.
    4167template <typename T> class WriteBarrierBase {
    4268public:
    43     void set(JSGlobalData&, const JSCell* owner, T* value)
     69    void set(JSGlobalData& globalData, const JSCell* owner, T* value)
     70    {
     71        ASSERT(value);
     72        validateCell(value);
     73        setEarlyValue(globalData, owner, value);
     74    }
     75
     76    void setMayBeNull(JSGlobalData& globalData, const JSCell* owner, T* value)
     77    {
     78        if (value)
     79            validateCell(value);
     80        setEarlyValue(globalData, owner, value);
     81    }
     82
     83    // Should only be used by JSCell during early initialisation
     84    // when some basic types aren't yet completely instantiated
     85    void setEarlyValue(JSGlobalData&, const JSCell* owner, T* value)
    4486    {
    4587        this->m_cell = reinterpret_cast<JSCell*>(value);
    … …  
    5395    T* get() const
    5496    {
     97        if (m_cell)
     98            validateCell(m_cell);
    5599        return reinterpret_cast<T*>(m_cell);
    56100    }
    … …  
    62106        ASSERT(!isZombie(m_cell));
    63107#endif
     108        validateCell<T>(static_cast<T*>(m_cell));
    64109        return static_cast<T*>(m_cell);
    65110    }
    … …  
    68113    {
    69114        ASSERT(m_cell);
     115        validateCell(static_cast<T*>(m_cell));
    70116        return static_cast<T*>(m_cell);
    71117    }
    … …  
    87133#endif
    88134    }
     135
     136#if ENABLE(GC_VALIDATION)
     137    T* unvalidatedGet() const { return reinterpret_cast<T*>(m_cell); }
     138#endif
    89139
    90140private:
    … …  
    152202        this->set(globalData, owner, value);
    153203    }
     204
     205    enum MayBeNullTag { MayBeNull };
     206    WriteBarrier(JSGlobalData& globalData, const JSCell* owner, T* value, MayBeNullTag)
     207    {
     208        this->setMayBeNull(globalData, owner, value);
     209    }
    154210};
    155211

  • trunk/Source/JavaScriptCore/wtf/Assertions.h

    r86482 r86499  
    380380#endif
    381381
     382#if ENABLE(GC_VALIDATION)
     383#define ASSERT_GC_OBJECT_LOOKS_VALID(cell) do { \
     384    if (!(cell))\
     385        CRASH();\
     386    if (cell->unvalidatedStructure()->unvalidatedStructure() != cell->unvalidatedStructure()->unvalidatedStructure()->unvalidatedStructure())\
     387        CRASH();\
     388} while (0)
     389
     390#define ASSERT_GC_OBJECT_INHERITS(object, classInfo) do {\
     391    ASSERT_GC_OBJECT_LOOKS_VALID(object); \
     392    if (!object->inherits(classInfo)) \
     393        CRASH();\
     394} while (0)
     395
     396#else
     397#define ASSERT_GC_OBJECT_LOOKS_VALID(cell) do { (void)cell; } while (0)
     398#define ASSERT_GC_OBJECT_INHERITS(object, classInfo) do { (void)object; (void)classInfo; } while (0)
     399#endif
     400
    382401#endif /* WTF_Assertions_h */

  • trunk/Source/WebCore/ChangeLog

    r86498 r86499  
     12011-05-13  Oliver Hunt  <oliver@apple.com>
     2
     3        Reviewed by Geoffrey Garen.
     4
     5        Make GC validation more aggressive
     6        https://bugs.webkit.org/show_bug.cgi?id=60802
     7
     8        This makes GC_VALIDATION much more aggressive in webcore,
     9        adding logic to every visitChildren method to ensure that
     10        the structure still has correct flags.
     11
     12        Additionally every function generated for the dom bindings
     13        makes use of the new GC_VALIDATION object assertions to further
     14        ensure that the object appears to be sensible.
     15
     16        * bindings/js/JSAttrCustom.cpp:
     17        (WebCore::JSAttr::visitChildren):
     18        * bindings/js/JSAudioContextCustom.cpp:
     19        (WebCore::JSAudioContext::visitChildren):
     20        * bindings/js/JSCSSRuleCustom.cpp:
     21        (WebCore::JSCSSRule::visitChildren):
     22        * bindings/js/JSCSSStyleDeclarationCustom.cpp:
     23        (WebCore::JSCSSStyleDeclaration::visitChildren):
     24        * bindings/js/JSCanvasRenderingContextCustom.cpp:
     25        (WebCore::JSCanvasRenderingContext::visitChildren):
     26        * bindings/js/JSDOMGlobalObject.cpp:
     27        (WebCore::JSDOMGlobalObject::visitChildren):
     28        (WebCore::JSDOMGlobalObject::setInjectedScript):
     29        * bindings/js/JSDOMWindowCustom.cpp:
     30        (WebCore::JSDOMWindow::visitChildren):
     31        * bindings/js/JSDOMWindowShell.cpp:
     32        (WebCore::JSDOMWindowShell::visitChildren):
     33        * bindings/js/JSEventListener.cpp:
     34        (WebCore::JSEventListener::JSEventListener):
     35        * bindings/js/JSEventListener.h:
     36        (WebCore::JSEventListener::jsFunction):
     37        * bindings/js/JSJavaScriptAudioNodeCustom.cpp:
     38        (WebCore::JSJavaScriptAudioNode::visitChildren):
     39        * bindings/js/JSMessageChannelCustom.cpp:
     40        (WebCore::JSMessageChannel::visitChildren):
     41        * bindings/js/JSMessagePortCustom.cpp:
     42        (WebCore::JSMessagePort::visitChildren):
     43        * bindings/js/JSNamedNodeMapCustom.cpp:
     44        (WebCore::JSNamedNodeMap::visitChildren):
     45        * bindings/js/JSNodeCustom.cpp:
     46        (WebCore::JSNode::visitChildren):
     47        * bindings/js/JSNodeFilterCustom.cpp:
     48        (WebCore::JSNodeFilter::visitChildren):
     49        * bindings/js/JSNodeIteratorCustom.cpp:
     50        (WebCore::JSNodeIterator::visitChildren):
     51        * bindings/js/JSSVGElementInstanceCustom.cpp:
     52        (WebCore::JSSVGElementInstance::visitChildren):
     53        * bindings/js/JSSharedWorkerCustom.cpp:
     54        (WebCore::JSSharedWorker::visitChildren):
     55        * bindings/js/JSStyleSheetCustom.cpp:
     56        (WebCore::JSStyleSheet::visitChildren):
     57        * bindings/js/JSTreeWalkerCustom.cpp:
     58        (WebCore::JSTreeWalker::visitChildren):
     59        * bindings/js/JSWebGLRenderingContextCustom.cpp:
     60        (WebCore::JSWebGLRenderingContext::visitChildren):
     61        * bindings/js/JSWorkerContextCustom.cpp:
     62        (WebCore::JSWorkerContext::visitChildren):
     63        * bindings/js/JSXMLHttpRequestCustom.cpp:
     64        (WebCore::JSXMLHttpRequest::visitChildren):
     65        * bindings/js/JSXPathResultCustom.cpp:
     66        (WebCore::JSXPathResult::visitChildren):
     67        * bindings/scripts/CodeGeneratorJS.pm:
     68
     692011-05-13  Oliver Hunt  <oliver@apple.com>
     70
     71        Reviewed by Geoffrey Garen.
     72
     73        Make GC validation more aggressive
     74        https://bugs.webkit.org/show_bug.cgi?id=60802
     75
     76        This makes GC_VALIDATION much more aggressive in webcore,
     77        adding logic to every visitChildren method to ensure that
     78        the structure still has correct flags.
     79
     80        Additionally every function generated for the dom bindings
     81        makes use of the new GC_VALIDATION object assertions to further
     82        ensure that the object appears to be sensible.
     83
     84        * bindings/js/JSAttrCustom.cpp:
     85        (WebCore::JSAttr::visitChildren):
     86        * bindings/js/JSAudioContextCustom.cpp:
     87        (WebCore::JSAudioContext::visitChildren):
     88        * bindings/js/JSCSSRuleCustom.cpp:
     89        (WebCore::JSCSSRule::visitChildren):
     90        * bindings/js/JSCSSStyleDeclarationCustom.cpp:
     91        (WebCore::JSCSSStyleDeclaration::visitChildren):
     92        * bindings/js/JSCanvasRenderingContextCustom.cpp:
     93        (WebCore::JSCanvasRenderingContext::visitChildren):
     94        * bindings/js/JSDOMGlobalObject.cpp:
     95        (WebCore::JSDOMGlobalObject::visitChildren):
     96        (WebCore::JSDOMGlobalObject::setInjectedScript):
     97        * bindings/js/JSDOMWindowCustom.cpp:
     98        (WebCore::JSDOMWindow::visitChildren):
     99        * bindings/js/JSDOMWindowShell.cpp:
     100        (WebCore::JSDOMWindowShell::visitChildren):
     101        * bindings/js/JSEventListener.cpp:
     102        (WebCore::JSEventListener::JSEventListener):
     103        * bindings/js/JSEventListener.h:
     104        (WebCore::JSEventListener::jsFunction):
     105        * bindings/js/JSJavaScriptAudioNodeCustom.cpp:
     106        (WebCore::JSJavaScriptAudioNode::visitChildren):
     107        * bindings/js/JSMessageChannelCustom.cpp:
     108        (WebCore::JSMessageChannel::visitChildren):
     109        * bindings/js/JSMessagePortCustom.cpp:
     110        (WebCore::JSMessagePort::visitChildren):
     111        * bindings/js/JSNamedNodeMapCustom.cpp:
     112        (WebCore::JSNamedNodeMap::visitChildren):
     113        * bindings/js/JSNodeCustom.cpp:
     114        (WebCore::JSNode::visitChildren):
     115        * bindings/js/JSNodeFilterCustom.cpp:
     116        (WebCore::JSNodeFilter::visitChildren):
     117        * bindings/js/JSNodeIteratorCustom.cpp:
     118        (WebCore::JSNodeIterator::visitChildren):
     119        * bindings/js/JSSVGElementInstanceCustom.cpp:
     120        (WebCore::JSSVGElementInstance::visitChildren):
     121        * bindings/js/JSSharedWorkerCustom.cpp:
     122        (WebCore::JSSharedWorker::visitChildren):
     123        * bindings/js/JSStyleSheetCustom.cpp:
     124        (WebCore::JSStyleSheet::visitChildren):
     125        * bindings/js/JSTreeWalkerCustom.cpp:
     126        (WebCore::JSTreeWalker::visitChildren):
     127        * bindings/js/JSWebGLRenderingContextCustom.cpp:
     128        (WebCore::JSWebGLRenderingContext::visitChildren):
     129        * bindings/js/JSWorkerContextCustom.cpp:
     130        (WebCore::JSWorkerContext::visitChildren):
     131        * bindings/js/JSXMLHttpRequestCustom.cpp:
     132        (WebCore::JSXMLHttpRequest::visitChildren):
     133        * bindings/js/JSXPathResultCustom.cpp:
     134        (WebCore::JSXPathResult::visitChildren):
     135        * bindings/scripts/CodeGeneratorJS.pm:
     136
    11372011-05-14  Oliver Hunt  <oliver@apple.com>
    2138

  • trunk/Source/WebCore/bindings/js/JSAttrCustom.cpp

    r86482 r86499  
    4242void JSAttr::visitChildren(SlotVisitor& visitor)
    4343{
     44    ASSERT_GC_OBJECT_INHERITS(this, &s_info);
     45    COMPILE_ASSERT(StructureFlags & OverridesVisitChildren, OverridesVisitChildrenWithoutSettingFlag);
     46    ASSERT(structure()->typeInfo().overridesVisitChildren());
    4447    Base::visitChildren(visitor);
    4548

  • trunk/Source/WebCore/bindings/js/JSAudioContextCustom.cpp

    r86482 r86499  
    4242void JSAudioContext::visitChildren(SlotVisitor& visitor)
    4343{
     44    ASSERT_GC_OBJECT_INHERITS(this, &s_info);
     45    COMPILE_ASSERT(StructureFlags & OverridesVisitChildren, OverridesVisitChildrenWithoutSettingFlag);
     46    ASSERT(structure()->typeInfo().overridesVisitChildren());
    4447    Base::visitChildren(visitor);
    4548    m_impl->visitJSEventListeners(visitor);

  • trunk/Source/WebCore/bindings/js/JSCSSRuleCustom.cpp

    r86482 r86499  
    5151void JSCSSRule::visitChildren(SlotVisitor& visitor)
    5252{
     53    ASSERT_GC_OBJECT_INHERITS(this, &s_info);
     54    COMPILE_ASSERT(StructureFlags & OverridesVisitChildren, OverridesVisitChildrenWithoutSettingFlag);
     55    ASSERT(structure()->typeInfo().overridesVisitChildren());
    5356    Base::visitChildren(visitor);
    5457    visitor.addOpaqueRoot(root(impl()));

  • trunk/Source/WebCore/bindings/js/JSCSSStyleDeclarationCustom.cpp

    r86482 r86499  
    4747void JSCSSStyleDeclaration::visitChildren(SlotVisitor& visitor)
    4848{
     49    ASSERT_GC_OBJECT_INHERITS(this, &s_info);
     50    COMPILE_ASSERT(StructureFlags & OverridesVisitChildren, OverridesVisitChildrenWithoutSettingFlag);
     51    ASSERT(structure()->typeInfo().overridesVisitChildren());
    4952    Base::visitChildren(visitor);
    5053    visitor.addOpaqueRoot(root(impl()));

  • trunk/Source/WebCore/bindings/js/JSCanvasRenderingContextCustom.cpp

    r86482 r86499  
    4242void JSCanvasRenderingContext::visitChildren(SlotVisitor& visitor)
    4343{
     44    ASSERT_GC_OBJECT_INHERITS(this, &s_info);
     45    COMPILE_ASSERT(StructureFlags & OverridesVisitChildren, OverridesVisitChildrenWithoutSettingFlag);
     46    ASSERT(structure()->typeInfo().overridesVisitChildren());
    4447    Base::visitChildren(visitor);
    4548

  • trunk/Source/WebCore/bindings/js/JSDOMGlobalObject.cpp

    r86482 r86499  
    5353void JSDOMGlobalObject::visitChildren(SlotVisitor& visitor)
    5454{
     55    ASSERT_GC_OBJECT_INHERITS(this, &s_info);
     56    COMPILE_ASSERT(StructureFlags & OverridesVisitChildren, OverridesVisitChildrenWithoutSettingFlag);
     57    ASSERT(structure()->typeInfo().overridesVisitChildren());
    5558    Base::visitChildren(visitor);
    5659
    … …  
    7982void JSDOMGlobalObject::setInjectedScript(JSObject* injectedScript)
    8083{
    81     m_injectedScript.set(globalData(), this, injectedScript);
     84    m_injectedScript.setMayBeNull(globalData(), this, injectedScript);
    8285}
    8386

  • trunk/Source/WebCore/bindings/js/JSDOMWindowCustom.cpp

    r86482 r86499  
    7575void JSDOMWindow::visitChildren(SlotVisitor& visitor)
    7676{
     77    ASSERT_GC_OBJECT_INHERITS(this, &s_info);
     78    COMPILE_ASSERT(StructureFlags & OverridesVisitChildren, OverridesVisitChildrenWithoutSettingFlag);
     79    ASSERT(structure()->typeInfo().overridesVisitChildren());
    7780    Base::visitChildren(visitor);
    7881

  • trunk/Source/WebCore/bindings/js/JSDOMWindowShell.cpp

    r86482 r86499  
    7676void JSDOMWindowShell::visitChildren(SlotVisitor& visitor)
    7777{
     78    ASSERT_GC_OBJECT_INHERITS(this, &s_info);
     79    COMPILE_ASSERT(StructureFlags & OverridesVisitChildren, OverridesVisitChildrenWithoutSettingFlag);
     80    ASSERT(structure()->typeInfo().overridesVisitChildren());
    7881    Base::visitChildren(visitor);
    7982    if (m_window)

  • trunk/Source/WebCore/bindings/js/JSEventListener.cpp

    r86482 r86499  
    4141{
    4242    if (wrapper)
    43         m_jsFunction.set(*m_isolatedWorld->globalData(), wrapper, function);
     43        m_jsFunction.setMayBeNull(*m_isolatedWorld->globalData(), wrapper, function);
    4444    else
    4545        ASSERT(!function);

  • trunk/Source/WebCore/bindings/js/JSEventListener.h

    r86482 r86499  
    7676    {
    7777        if (!m_jsFunction)
    78             m_jsFunction.set(*scriptExecutionContext->globalData(), m_wrapper.get(), initializeJSFunction(scriptExecutionContext));
     78            m_jsFunction.setMayBeNull(*scriptExecutionContext->globalData(), m_wrapper.get(), initializeJSFunction(scriptExecutionContext));
    7979
    8080        // Verify that we have a valid wrapper protecting our function from

  • trunk/Source/WebCore/bindings/js/JSJavaScriptAudioNodeCustom.cpp

    r86482 r86499  
    3737void JSJavaScriptAudioNode::visitChildren(SlotVisitor& visitor)
    3838{
     39    ASSERT_GC_OBJECT_INHERITS(this, &s_info);
     40    COMPILE_ASSERT(StructureFlags & OverridesVisitChildren, OverridesVisitChildrenWithoutSettingFlag);
     41    ASSERT(structure()->typeInfo().overridesVisitChildren());
    3942    Base::visitChildren(visitor);
    4043    static_cast<JavaScriptAudioNode*>(impl())->visitJSEventListeners(visitor);

  • trunk/Source/WebCore/bindings/js/JSMessageChannelCustom.cpp

    r86482 r86499  
    3636void JSMessageChannel::visitChildren(SlotVisitor& visitor)
    3737{
     38    ASSERT_GC_OBJECT_INHERITS(this, &s_info);
     39    COMPILE_ASSERT(StructureFlags & OverridesVisitChildren, OverridesVisitChildrenWithoutSettingFlag);
     40    ASSERT(structure()->typeInfo().overridesVisitChildren());
    3841    Base::visitChildren(visitor);
    3942

  • trunk/Source/WebCore/bindings/js/JSMessagePortCustom.cpp

    r86482 r86499  
    4444void JSMessagePort::visitChildren(SlotVisitor& visitor)
    4545{
     46    ASSERT_GC_OBJECT_INHERITS(this, &s_info);
     47    COMPILE_ASSERT(StructureFlags & OverridesVisitChildren, OverridesVisitChildrenWithoutSettingFlag);
     48    ASSERT(structure()->typeInfo().overridesVisitChildren());
    4649    Base::visitChildren(visitor);
    4750

  • trunk/Source/WebCore/bindings/js/JSNamedNodeMapCustom.cpp

    r86482 r86499  
    4949void JSNamedNodeMap::visitChildren(SlotVisitor& visitor)
    5050{
     51    ASSERT_GC_OBJECT_INHERITS(this, &s_info);
     52    COMPILE_ASSERT(StructureFlags & OverridesVisitChildren, OverridesVisitChildrenWithoutSettingFlag);
     53    ASSERT(structure()->typeInfo().overridesVisitChildren());
    5154    Base::visitChildren(visitor);
    5255

  • trunk/Source/WebCore/bindings/js/JSNodeCustom.cpp

    r86482 r86499  
    195195void JSNode::visitChildren(SlotVisitor& visitor)
    196196{
     197    ASSERT_GC_OBJECT_INHERITS(this, &s_info);
     198    COMPILE_ASSERT(StructureFlags & OverridesVisitChildren, OverridesVisitChildrenWithoutSettingFlag);
     199    ASSERT(structure()->typeInfo().overridesVisitChildren());
    197200    Base::visitChildren(visitor);
    198201

  • trunk/Source/WebCore/bindings/js/JSNodeFilterCustom.cpp

    r86482 r86499  
    3939void JSNodeFilter::visitChildren(SlotVisitor& visitor)
    4040{
     41    ASSERT_GC_OBJECT_INHERITS(this, &s_info);
     42    COMPILE_ASSERT(StructureFlags & OverridesVisitChildren, OverridesVisitChildrenWithoutSettingFlag);
     43    ASSERT(structure()->typeInfo().overridesVisitChildren());
    4144    Base::visitChildren(visitor);
    4245    visitor.addOpaqueRoot(impl());

  • trunk/Source/WebCore/bindings/js/JSNodeIteratorCustom.cpp

    r86482 r86499  
    3232void JSNodeIterator::visitChildren(SlotVisitor& visitor)
    3333{
     34    ASSERT_GC_OBJECT_INHERITS(this, &s_info);
     35    COMPILE_ASSERT(StructureFlags & OverridesVisitChildren, OverridesVisitChildrenWithoutSettingFlag);
     36    ASSERT(structure()->typeInfo().overridesVisitChildren());
    3437    Base::visitChildren(visitor);
    3538

  • trunk/Source/WebCore/bindings/js/JSSVGElementInstanceCustom.cpp

    r86482 r86499  
    3636void JSSVGElementInstance::visitChildren(JSC::SlotVisitor& visitor)
    3737{
     38    ASSERT_GC_OBJECT_INHERITS(this, &s_info);
     39    COMPILE_ASSERT(StructureFlags & JSC::OverridesVisitChildren, OverridesVisitChildrenWithoutSettingFlag);
     40    ASSERT(structure()->typeInfo().overridesVisitChildren());
    3841    Base::visitChildren(visitor);
    3942    visitor.addOpaqueRoot(root(impl()->correspondingElement()));

  • trunk/Source/WebCore/bindings/js/JSSharedWorkerCustom.cpp

    r86482 r86499  
    4646void JSSharedWorker::visitChildren(SlotVisitor& visitor)
    4747{
     48    ASSERT_GC_OBJECT_INHERITS(this, &s_info);
     49    COMPILE_ASSERT(StructureFlags & OverridesVisitChildren, OverridesVisitChildrenWithoutSettingFlag);
     50    ASSERT(structure()->typeInfo().overridesVisitChildren());
    4851    Base::visitChildren(visitor);
    4952

  • trunk/Source/WebCore/bindings/js/JSStyleSheetCustom.cpp

    r86482 r86499  
    3838void JSStyleSheet::visitChildren(SlotVisitor& visitor)
    3939{
     40    ASSERT_GC_OBJECT_INHERITS(this, &s_info);
     41    COMPILE_ASSERT(StructureFlags & OverridesVisitChildren, OverridesVisitChildrenWithoutSettingFlag);
     42    ASSERT(structure()->typeInfo().overridesVisitChildren());
    4043    Base::visitChildren(visitor);
    4144    visitor.addOpaqueRoot(root(impl()));

  • trunk/Source/WebCore/bindings/js/JSTreeWalkerCustom.cpp

    r86482 r86499  
    3232void JSTreeWalker::visitChildren(SlotVisitor& visitor)
    3333{
     34    ASSERT_GC_OBJECT_INHERITS(this, &s_info);
     35    COMPILE_ASSERT(StructureFlags & OverridesVisitChildren, OverridesVisitChildrenWithoutSettingFlag);
     36    ASSERT(structure()->typeInfo().overridesVisitChildren());
    3437    Base::visitChildren(visitor);
    3538

  • trunk/Source/WebCore/bindings/js/JSWebGLRenderingContextCustom.cpp

    r86482 r86499  
    195195void JSWebGLRenderingContext::visitChildren(SlotVisitor& visitor)
    196196{
     197    ASSERT_GC_OBJECT_INHERITS(this, &s_info);
     198    COMPILE_ASSERT(StructureFlags & OverridesVisitChildren, OverridesVisitChildrenWithoutSettingFlag);
     199    ASSERT(structure()->typeInfo().overridesVisitChildren());
    197200    Base::visitChildren(visitor);
    198201    visitor.addOpaqueRoot(impl());

  • trunk/Source/WebCore/bindings/js/JSWorkerContextCustom.cpp

    r86482 r86499  
    5656void JSWorkerContext::visitChildren(SlotVisitor& visitor)
    5757{
     58    ASSERT_GC_OBJECT_INHERITS(this, &s_info);
     59    COMPILE_ASSERT(StructureFlags & OverridesVisitChildren, OverridesVisitChildrenWithoutSettingFlag);
     60    ASSERT(structure()->typeInfo().overridesVisitChildren());
    5861    Base::visitChildren(visitor);
    5962

  • trunk/Source/WebCore/bindings/js/JSXMLHttpRequestCustom.cpp

    r86482 r86499  
    5757void JSXMLHttpRequest::visitChildren(SlotVisitor& visitor)
    5858{
     59    ASSERT_GC_OBJECT_INHERITS(this, &s_info);
     60    COMPILE_ASSERT(StructureFlags & OverridesVisitChildren, OverridesVisitChildrenWithoutSettingFlag);
     61    ASSERT(structure()->typeInfo().overridesVisitChildren());
    5962    Base::visitChildren(visitor);
    6063

  • trunk/Source/WebCore/bindings/js/JSXPathResultCustom.cpp

    r86482 r86499  
    3939void JSXPathResult::visitChildren(SlotVisitor& visitor)
    4040{
     41    ASSERT_GC_OBJECT_INHERITS(this, &s_info);
     42    COMPILE_ASSERT(StructureFlags & OverridesVisitChildren, OverridesVisitChildrenWithoutSettingFlag);
     43    ASSERT(structure()->typeInfo().overridesVisitChildren());
    4144    Base::visitChildren(visitor);
    4245

  • trunk/Source/WebCore/bindings/scripts/CodeGeneratorJS.pm

    r86482 r86499  
    908908        push(@headerContent, "ALWAYS_INLINE bool ${className}::getOwnPropertySlot(JSC::ExecState* exec, const JSC::Identifier& propertyName, JSC::PropertySlot& slot)\n");
    909909        push(@headerContent, "{\n");
     910        push(@headerContent, "    ASSERT_GC_OBJECT_INHERITS(this, &s_info);\n");
    910911        push(@headerContent, GenerateGetOwnPropertySlotBody($dataNode, $interfaceName, $className, $implClassName, $numAttributes > 0, 1));
    911912        push(@headerContent, "}\n\n");
    912913        push(@headerContent, "ALWAYS_INLINE bool ${className}::getOwnPropertyDescriptor(JSC::ExecState* exec, const JSC::Identifier& propertyName, JSC::PropertyDescriptor& descriptor)\n");
    913914        push(@headerContent, "{\n");
     915        push(@headerContent, "    ASSERT_GC_OBJECT_INHERITS(this, &s_info);\n");
    914916        push(@headerContent, GenerateGetOwnPropertyDescriptorBody($dataNode, $interfaceName, $className, $implClassName, $numAttributes > 0, 1));
    915917        push(@headerContent, "}\n\n");
    … …  
    14531455        push(@implContent, "void ${className}::visitChildren(SlotVisitor& visitor)\n");
    14541456        push(@implContent, "{\n");
     1457        push(@implContent, "    ASSERT_GC_OBJECT_INHERITS(this, &s_info);\n");
     1458        push(@implContent, "    COMPILE_ASSERT(StructureFlags & OverridesVisitChildren, OverridesVisitChildrenWithoutSettingFlag);\n");
     1459        push(@implContent, "    ASSERT(structure()->typeInfo().overridesVisitChildren());\n");
    14551460        push(@implContent, "    Base::visitChildren(visitor);\n");
    14561461        push(@implContent, "    impl()->visitJSEventListeners(visitor);\n");
    … …  
    14851490            push(@implContent, "bool ${className}::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)\n");
    14861491            push(@implContent, "{\n");
     1492            push(@implContent, "    ASSERT_GC_OBJECT_INHERITS(this, &s_info);\n");
    14871493            push(@implContent, GenerateGetOwnPropertySlotBody($dataNode, $interfaceName, $className, $implClassName, $numAttributes > 0, 0));
    14881494            push(@implContent, "}\n\n");
    14891495            push(@implContent, "bool ${className}::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)\n");
    14901496            push(@implContent, "{\n");
     1497            push(@implContent, "    ASSERT_GC_OBJECT_INHERITS(this, &s_info);\n");
    14911498            push(@implContent, GenerateGetOwnPropertyDescriptorBody($dataNode, $interfaceName, $className, $implClassName, $numAttributes > 0, 0));
    14921499            push(@implContent, "}\n\n");
    … …  
    14971504            push(@implContent, "bool ${className}::getOwnPropertySlot(ExecState* exec, unsigned propertyName, PropertySlot& slot)\n");
    14981505            push(@implContent, "{\n");
     1506            push(@implContent, "    ASSERT_GC_OBJECT_INHERITS(this, &s_info);\n");
    14991507            push(@implContent, "    if (propertyName < static_cast<$implClassName*>(impl())->length()) {\n");
    15001508            if ($dataNode->extendedAttributes->{"HasCustomIndexGetter"} || $dataNode->extendedAttributes->{"HasNumericIndexGetter"}) {
    … …  
    16481656                push(@implContent, "void ${className}::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)\n");
    16491657                push(@implContent, "{\n");
     1658                push(@implContent, "    ASSERT_GC_OBJECT_INHERITS(this, &s_info);\n");
    16501659                if ($dataNode->extendedAttributes->{"HasCustomIndexSetter"}) {
    16511660                    push(@implContent, "    bool ok;\n");
    … …  
    16721681                push(@implContent, "void ${className}::put(ExecState* exec, unsigned propertyName, JSValue value)\n");
    16731682                push(@implContent, "{\n");
     1683                push(@implContent, "    ASSERT_GC_OBJECT_INHERITS(this, &s_info);\n");
    16741684                push(@implContent, "    indexSetter(exec, propertyName, value);\n");
    16751685                push(@implContent, "    return;\n");
    … …  
    18261836        push(@implContent, "void ${className}::getOwnPropertyNames(ExecState* exec, PropertyNameArray& propertyNames, EnumerationMode mode)\n");
    18271837        push(@implContent, "{\n");
     1838        push(@implContent, "    ASSERT_GC_OBJECT_INHERITS(this, &s_info);\n");
    18281839        if ($dataNode->extendedAttributes->{"HasIndexGetter"} || $dataNode->extendedAttributes->{"HasCustomIndexGetter"} || $dataNode->extendedAttributes->{"HasNumericIndexGetter"}) {
    18291840            push(@implContent, "    for (unsigned i = 0; i < static_cast<${implClassName}*>(impl())->length(); ++i)\n");
    … …  
    18761887                push(@implContent, "    $className* castedThis = static_cast<$className*>(asObject(thisValue));\n");
    18771888            }
     1889            push(@implContent, "    ASSERT_GC_OBJECT_INHERITS(castedThis, &${className}::s_info);\n");
    18781890
    18791891            if ($dataNode->extendedAttributes->{"CheckDomainSecurity"} &&
    … …  
    21072119        push(@implContent, "{\n");
    21082120        push(@implContent, "    ${className}* thisObj = static_cast<$className*>(asObject(slotBase));\n");
     2121        push(@implContent, "    ASSERT_GC_OBJECT_INHERITS(thisObj, &s_info);\n");
    21092122        if (IndexGetterReturnsStrings($implClassName)) {
    21102123            $implIncludes{"KURL.h"} = 1;
    … …  
    21232136        push(@implContent, "\nJSValue ${className}::getByIndex(ExecState*, unsigned index)\n");
    21242137        push(@implContent, "{\n");
     2138        push(@implContent, "    ASSERT_GC_OBJECT_INHERITS(this, &s_info);\n");
    21252139        push(@implContent, "    return jsNumber(static_cast<$implClassName*>(impl())->item(index));\n");
    21262140        push(@implContent, "}\n\n");

  • trunk/Source/WebKit2/ChangeLog

    r86497 r86499  
     12011-05-13  Oliver Hunt  <oliver@apple.com>
     2
     3        Reviewed by Geoffrey Garen.
     4
     5        Make GC validation more aggressive
     6        https://bugs.webkit.org/show_bug.cgi?id=60802
     7
     8        Add GC_VALIDATION calls to all the JSNPObject methods.
     9
     10        * WebProcess/Plugins/Netscape/JSNPObject.cpp:
     11        (WebKit::JSNPObject::invalidate):
     12        (WebKit::JSNPObject::callMethod):
     13        (WebKit::JSNPObject::callObject):
     14        (WebKit::JSNPObject::callConstructor):
     15        (WebKit::JSNPObject::getCallData):
     16        (WebKit::JSNPObject::getConstructData):
     17        (WebKit::JSNPObject::getOwnPropertySlot):
     18        (WebKit::JSNPObject::getOwnPropertyDescriptor):
     19        (WebKit::JSNPObject::put):
     20        (WebKit::JSNPObject::getOwnPropertyNames):
     21        (WebKit::JSNPObject::propertyGetter):
     22        (WebKit::JSNPObject::methodGetter):
     23
     242011-05-13  Oliver Hunt  <oliver@apple.com>
     25
     26        Reviewed by Geoffrey Garen.
     27
     28        Make GC validation more aggressive
     29        https://bugs.webkit.org/show_bug.cgi?id=60802
     30
     31        Add GC_VALIDATION calls to all the JSNPObject methods.
     32
     33        * WebProcess/Plugins/Netscape/JSNPObject.cpp:
     34        (WebKit::JSNPObject::invalidate):
     35        (WebKit::JSNPObject::callMethod):
     36        (WebKit::JSNPObject::callObject):
     37        (WebKit::JSNPObject::callConstructor):
     38        (WebKit::JSNPObject::getCallData):
     39        (WebKit::JSNPObject::getConstructData):
     40        (WebKit::JSNPObject::getOwnPropertySlot):
     41        (WebKit::JSNPObject::getOwnPropertyDescriptor):
     42        (WebKit::JSNPObject::put):
     43        (WebKit::JSNPObject::getOwnPropertyNames):
     44        (WebKit::JSNPObject::propertyGetter):
     45        (WebKit::JSNPObject::methodGetter):
     46
    1472011-05-14  Alexey Proskuryakov  <ap@apple.com>
    248

  • trunk/Source/WebKit2/WebProcess/Plugins/Netscape/JSNPObject.cpp

    r86482 r86499  
    7373{
    7474    ASSERT(m_npObject);
     75    ASSERT_GC_OBJECT_INHERITS(this, &s_info);
    7576
    7677    releaseNPObject(m_npObject);
    … …  
    8081JSValue JSNPObject::callMethod(ExecState* exec, NPIdentifier methodName)
    8182{
     83    ASSERT_GC_OBJECT_INHERITS(this, &s_info);
    8284    if (!m_npObject)
    8385        return throwInvalidAccessError(exec);
    … …  
    119121JSC::JSValue JSNPObject::callObject(JSC::ExecState* exec)
    120122{
     123    ASSERT_GC_OBJECT_INHERITS(this, &s_info);
    121124    if (!m_npObject)
    122125        return throwInvalidAccessError(exec);
    … …  
    158161JSValue JSNPObject::callConstructor(ExecState* exec)
    159162{
     163    ASSERT_GC_OBJECT_INHERITS(this, &s_info);
    160164    if (!m_npObject)
    161165        return throwInvalidAccessError(exec);
    … …  
    201205JSC::CallType JSNPObject::getCallData(JSC::CallData& callData)
    202206{
     207    ASSERT_GC_OBJECT_INHERITS(this, &s_info);
    203208    if (!m_npObject || !m_npObject->_class->invokeDefault)
    204209        return CallTypeNone;
    … …  
    218223ConstructType JSNPObject::getConstructData(ConstructData& constructData)
    219224{
     225    ASSERT_GC_OBJECT_INHERITS(this, &s_info);
    220226    if (!m_npObject || !m_npObject->_class->construct)
    221227        return ConstructTypeNone;
    … …  
    227233bool JSNPObject::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
    228234{
     235    ASSERT_GC_OBJECT_INHERITS(this, &s_info);
    229236    if (!m_npObject) {
    230237        throwInvalidAccessError(exec);
    … …  
    251258bool JSNPObject::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
    252259{
     260    ASSERT_GC_OBJECT_INHERITS(this, &s_info);
    253261    if (!m_npObject) {
    254262        throwInvalidAccessError(exec);
    … …  
    279287void JSNPObject::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot&)
    280288{
     289    ASSERT_GC_OBJECT_INHERITS(this, &s_info);
    281290    if (!m_npObject) {
    282291        throwInvalidAccessError(exec);
    … …  
    316325void JSNPObject::getOwnPropertyNames(ExecState* exec, PropertyNameArray& propertyNameArray, EnumerationMode mode)
    317326{
     327    ASSERT_GC_OBJECT_INHERITS(this, &s_info);
    318328    if (!m_npObject) {
    319329        throwInvalidAccessError(exec);
    … …  
    363373{
    364374    JSNPObject* thisObj = static_cast<JSNPObject*>(asObject(slotBase));
    365 
     375    ASSERT_GC_OBJECT_INHERITS(thisObj, &s_info);
     376   
    366377    if (!thisObj->m_npObject)
    367378        return throwInvalidAccessError(exec);
    … …  
    398409{
    399410    JSNPObject* thisObj = static_cast<JSNPObject*>(asObject(slotBase));
     411    ASSERT_GC_OBJECT_INHERITS(thisObj, &s_info);
    400412   
    401413    if (!thisObj->m_npObject)
Note: See TracChangeset for help on using the changeset viewer.