Changeset 86974 in webkit

Timestamp:

May 20, 2011 12:06:29 PM (13 years ago)

Author:

commit-queue@webkit.org

Message:

2011-05-20 Zoltan Herczeg <​zherczeg@inf.u-szeged.hu>

Reviewed by Oliver Hunt.

Zombies should "live" forever
​https://bugs.webkit.org/show_bug.cgi?id=61170

Reusing zombie cells could still hide garbage
collected cell related bugs.

• JavaScriptCore.pro:
• heap/MarkedBlock.cpp: (JSC::MarkedBlock::clearMarks):
• heap/MarkedBlock.h:
• heap/MarkedSpace.cpp: (JSC::MarkedSpace::destroy):
• runtime/JSCell.h: (JSC::JSCell::JSValue::isZombie):
• runtime/JSZombie.h: (JSC::JSZombie::~JSZombie):
• runtime/WriteBarrier.h: (JSC::WriteBarrierBase::setWithoutWriteBarrier):

Location:

trunk/Source/JavaScriptCore

Files:

• ChangeLog (modified) (1 diff)
• JavaScriptCore.pro (modified) (2 diffs)
• heap/MarkedBlock.cpp (modified) (1 diff)
• heap/MarkedBlock.h (modified) (1 diff)
• heap/MarkedSpace.cpp (modified) (1 diff)
• runtime/JSCell.h (modified) (1 diff)
• runtime/JSZombie.h (modified) (1 diff)
• runtime/WriteBarrier.h (modified) (1 diff)

trunk/Source/JavaScriptCore/ChangeLog

@@ +1 @@
+2011-05-20  Zoltan Herczeg  <zherczeg@inf.u-szeged.hu>
+
+        Reviewed by Oliver Hunt.
+
+        Zombies should "live" forever
+        https://bugs.webkit.org/show_bug.cgi?id=61170
+
+        Reusing zombie cells could still hide garbage
+        collected cell related bugs.
+
+        * JavaScriptCore.pro:
+        * heap/MarkedBlock.cpp:
+        (JSC::MarkedBlock::clearMarks):
+        * heap/MarkedBlock.h:
+        * heap/MarkedSpace.cpp:
+        (JSC::MarkedSpace::destroy):
+        * runtime/JSCell.h:
+        (JSC::JSCell::JSValue::isZombie):
+        * runtime/JSZombie.h:
+        (JSC::JSZombie::~JSZombie):
+        * runtime/WriteBarrier.h:
+        (JSC::WriteBarrierBase::setWithoutWriteBarrier):
+
 2011-05-20  Brady Eidson  <beidson@apple.com>
 

trunk/Source/JavaScriptCore/JavaScriptCore.pro

@@ -63 +63 @@
     assembler/ARMv7Assembler.cpp \
     assembler/MacroAssemblerARM.cpp \
-    assembler/MacroAssemblerSH4.h \
     assembler/MacroAssemblerSH4.cpp \
-    assembler/SH4Assembler.h \
     bytecode/CodeBlock.cpp \
     bytecode/JumpTable.cpp \
@@ -168 +166 @@
     runtime/JSVariableObject.cpp \
     runtime/JSWrapperObject.cpp \
+    runtime/JSZombie.cpp \
     runtime/LiteralParser.cpp \
     runtime/Lookup.cpp \

trunk/Source/JavaScriptCore/heap/MarkedBlock.cpp

@@ -87 +87 @@
 }
 
+#if ENABLE(JSC_ZOMBIES)
+void MarkedBlock::clearMarks()
+{
+    /* Keep our precious zombies! */
+    for (size_t i = firstAtom(); i < m_endAtom; i += m_atomsPerCell) {
+        if (m_marks.get(i))
+            continue;
+
+        JSCell* cell = reinterpret_cast<JSCell*>(&atoms()[i]);
+        if (!cell->isZombie())
+            m_marks.clear(i);
+    }
+}
+#endif
+
 } // namespace JSC

trunk/Source/JavaScriptCore/heap/MarkedBlock.h

@@ -155 +155 @@
     }
 
+#if !ENABLE(JSC_ZOMBIES)
     inline void MarkedBlock::clearMarks()
     {
         m_marks.clearAll();
     }
+#endif
     
     inline size_t MarkedBlock::markCount()

trunk/Source/JavaScriptCore/heap/MarkedSpace.cpp

@@ -47 +47 @@
 void MarkedSpace::destroy()
 {
+    /* Keep our precious zombies! */
+#if !ENABLE(JSC_ZOMBIES)
     clearMarks();
     shrink();
     ASSERT(!size());
+#endif
 }
 

trunk/Source/JavaScriptCore/runtime/JSCell.h

@@ -356 +356 @@
         return MarkedSpace::heap(c);
     }
-    
+
 #if ENABLE(JSC_ZOMBIES)
     inline bool JSValue::isZombie() const
     {
-        return isCell() && asCell() > (JSCell*)0x1ffffffffL && asCell()->isZombie();
+        return isCell() && asCell()->isZombie();
     }
 #endif

trunk/Source/JavaScriptCore/runtime/JSZombie.h

@@ -42 +42 @@
     }
 
+    ~JSZombie()
+    {
+        /* Zombie cells should never been reused. */
+        ASSERT_NOT_REACHED();
+    }
+
     virtual bool isZombie() const { return true; }
 

trunk/Source/JavaScriptCore/runtime/WriteBarrier.h

@@ -130 +130 @@
         this->m_cell = reinterpret_cast<JSCell*>(value);
 #if ENABLE(JSC_ZOMBIES)
-        ASSERT(!m_cell || !isZombie(m_cell));
+        ASSERT(!m_cell || value == reinterpret_cast<T*>(1) || !isZombie(m_cell));
 #endif
     }