Changeset 90282 in webkit

Timestamp:

Jul 1, 2011 3:02:54 PM (13 years ago)

Author:

oliver@apple.com

Message:

2011-07-01 Oliver Hunt <​oliver@apple.com>

IE Web Workers demo crashes in JSC::SlotVisitor::visitChildren()
​https://bugs.webkit.org/show_bug.cgi?id=63732

Reviewed by Gavin Barraclough.

Initialise the memory at the head of the new storage so that
GC is safe if triggered by reportExtraMemoryCost.

• runtime/JSArray.cpp: (JSC::JSArray::increaseVectorPrefixLength):

Location:

trunk/Source/JavaScriptCore

Files:

• ChangeLog (modified) (1 diff)
• runtime/JSArray.cpp (modified) (1 diff)

trunk/Source/JavaScriptCore/ChangeLog

@@ +1 @@
+2011-07-01  Oliver Hunt  <oliver@apple.com>
+
+        IE Web Workers demo crashes in JSC::SlotVisitor::visitChildren()
+        https://bugs.webkit.org/show_bug.cgi?id=63732
+
+        Reviewed by Gavin Barraclough.
+
+        Initialise the memory at the head of the new storage so that
+        GC is safe if triggered by reportExtraMemoryCost.
+
+        * runtime/JSArray.cpp:
+        (JSC::JSArray::increaseVectorPrefixLength):
+
 2011-07-01  Oliver Hunt  <oliver@apple.com>
 

trunk/Source/JavaScriptCore/runtime/JSArray.cpp

@@ -639 +639 @@
     
     fastFree(storage->m_allocBase);
-
+    ASSERT(newLength > vectorLength);
+    unsigned delta = newLength - vectorLength;
+    for (unsigned i = 0; i < delta; i++)
+        m_storage->m_vector[i].clear();
     Heap::heap(this)->reportExtraMemoryCost(storageSize(newVectorLength) - storageSize(vectorLength));