Changeset 95308 in webkit

Timestamp:

Sep 16, 2011 11:43:25 AM (13 years ago)

Author:

fpizlo@apple.com

Message:

REGRESSION: Reproducible crash below SlotVisitor::harvestWeakReferences
using Domino's online ordering
​https://bugs.webkit.org/show_bug.cgi?id=68220

Reviewed by Oliver Hunt.

Weak handle processing can result in new objects being marked, which
results in new WeakReferencesHarvesters being added. But weak
reference harvesters are only processed before weak handle processing,
so there's the risk that a weak reference harvester will persist
until the next collection, by which time it may have been deleted.

• heap/Heap.cpp:

(JSC::Heap::markRoots):

Location:

trunk/Source/JavaScriptCore

Files:

• ChangeLog (modified) (1 diff)
• heap/Heap.cpp (modified) (2 diffs)

trunk/Source/JavaScriptCore/ChangeLog

@@ +1 @@
+2011-09-16  Filip Pizlo  <fpizlo@apple.com>
+
+        REGRESSION: Reproducible crash below SlotVisitor::harvestWeakReferences
+        using Domino's online ordering
+        https://bugs.webkit.org/show_bug.cgi?id=68220
+
+        Reviewed by Oliver Hunt.
+        
+        Weak handle processing can result in new objects being marked, which
+        results in new WeakReferencesHarvesters being added. But weak
+        reference harvesters are only processed before weak handle processing,
+        so there's the risk that a weak reference harvester will persist
+        until the next collection, by which time it may have been deleted.
+
+        * heap/Heap.cpp:
+        (JSC::Heap::markRoots):
+
 2011-09-16  Csaba Osztrogonác  <ossy@webkit.org>
 

trunk/Source/JavaScriptCore/heap/Heap.cpp

@@ -587 +587 @@
     visitor.drain();
 
-    harvestWeakReferences();
-
     // Weak handles must be marked last, because their owners use the set of
     // opaque roots to determine reachability.
@@ -598 +596 @@
     // If the set of opaque roots has grown, more weak handles may have become reachable.
     } while (lastOpaqueRootCount != visitor.opaqueRootCount());
+
+    // Need to call this here because weak handle processing could add weak
+    // reference harvesters.
+    harvestWeakReferences();
 
     visitor.reset();