Revision: 5530
Author: [email protected]
Date: Mon Sep 27 03:29:25 2010
Log: Fix more GC unsafe places
Review URL: http://codereview.chromium.org/3499001
http://code.google.com/p/v8/source/detail?r=5530
Modified:
/branches/bleeding_edge/src/api.cc
/branches/bleeding_edge/src/bootstrapper.cc
/branches/bleeding_edge/src/debug.cc
/branches/bleeding_edge/src/runtime.cc
=======================================
--- /branches/bleeding_edge/src/api.cc Thu Sep 23 01:27:51 2010
+++ /branches/bleeding_edge/src/api.cc Mon Sep 27 03:29:25 2010
@@ -2658,8 +2658,9 @@
return;
}
i::Handle<i::PixelArray> pixels = i::Factory::NewPixelArray(length,
data);
- self->set_map(
- *i::Factory::GetSlowElementsMap(i::Handle<i::Map>(self->map())));
+ i::Handle<i::Map> slow_map =
+ i::Factory::GetSlowElementsMap(i::Handle<i::Map>(self->map()));
+ self->set_map(*slow_map);
self->set_elements(*pixels);
}
@@ -2713,8 +2714,9 @@
}
i::Handle<i::ExternalArray> array =
i::Factory::NewExternalArray(length, array_type, data);
- self->set_map(
- *i::Factory::GetSlowElementsMap(i::Handle<i::Map>(self->map())));
+ i::Handle<i::Map> slow_map =
+ i::Factory::GetSlowElementsMap(i::Handle<i::Map>(self->map()));
+ self->set_map(*slow_map);
self->set_elements(*array);
}
=======================================
--- /branches/bleeding_edge/src/bootstrapper.cc Thu Sep 23 01:27:51 2010
+++ /branches/bleeding_edge/src/bootstrapper.cc Mon Sep 27 03:29:25 2010
@@ -1064,8 +1064,11 @@
// global object.
static const PropertyAttributes attributes =
static_cast<PropertyAttributes>(READ_ONLY | DONT_DELETE);
- SetProperty(builtins, Factory::LookupAsciiSymbol("global"),
- Handle<Object>(global_context()->global()), attributes);
+ Handle<String> global_symbol = Factory::LookupAsciiSymbol("global");
+ SetProperty(builtins,
+ global_symbol,
+ Handle<Object>(global_context()->global()),
+ attributes);
// Setup the reference from the global object to the builtins object.
JSGlobalObject::cast(global_context()->global())->set_builtins(*builtins);
=======================================
--- /branches/bleeding_edge/src/debug.cc Thu Sep 16 14:40:42 2010
+++ /branches/bleeding_edge/src/debug.cc Mon Sep 27 03:29:25 2010
@@ -1034,10 +1034,12 @@
if (!break_point_object->IsJSObject()) return true;
// Get the function CheckBreakPoint (defined in debug.js).
+ Handle<String> is_break_point_triggered_symbol =
+ Factory::LookupAsciiSymbol("IsBreakPointTriggered");
Handle<JSFunction> check_break_point =
Handle<JSFunction>(JSFunction::cast(
- debug_context()->global()->GetProperty(
- *Factory::LookupAsciiSymbol("IsBreakPointTriggered"))));
+ debug_context()->global()->GetProperty(
+ *is_break_point_triggered_symbol)));
// Get the break id as an object.
Handle<Object> break_id = Factory::NewNumberFromInt(Debug::break_id());
@@ -2176,9 +2178,11 @@
// script. Make sure that these break points are set.
// Get the function UpdateScriptBreakPoints (defined in
debug-debugger.js).
+ Handle<String> update_script_break_points_symbol =
+ Factory::LookupAsciiSymbol("UpdateScriptBreakPoints");
Handle<Object> update_script_break_points =
Handle<Object>(Debug::debug_context()->global()->GetProperty(
- *Factory::LookupAsciiSymbol("UpdateScriptBreakPoints")));
+ *update_script_break_points_symbol));
if (!update_script_break_points->IsJSFunction()) {
return;
}
=======================================
--- /branches/bleeding_edge/src/runtime.cc Thu Sep 23 04:25:01 2010
+++ /branches/bleeding_edge/src/runtime.cc Mon Sep 27 03:29:25 2010
@@ -638,8 +638,8 @@
Handle<FixedArray> elms = Factory::NewFixedArray(DESCRIPTOR_SIZE);
Handle<JSArray> desc = Factory::NewJSArrayWithElements(elms);
LookupResult result;
- CONVERT_CHECKED(JSObject, obj, args[0]);
- CONVERT_CHECKED(String, name, args[1]);
+ CONVERT_ARG_CHECKED(JSObject, obj, 0);
+ CONVERT_ARG_CHECKED(String, name, 1);
// This could be an element.
uint32_t index;
@@ -653,10 +653,12 @@
// 15.5.5.2. Note that this might be a string object with elements
// other than the actual string value. This is covered by the
// subsequent cases.
- JSValue* js_value = JSValue::cast(obj);
- String* str = String::cast(js_value->value());
+ Handle<JSValue> js_value = Handle<JSValue>::cast(obj);
+ Handle<String> str(String::cast(js_value->value()));
+ Handle<String> substr = SubString(str, index, index+1,
NOT_TENURED);
+
elms->set(IS_ACCESSOR_INDEX, Heap::false_value());
- elms->set(VALUE_INDEX, str->SubString(index, index+1));
+ elms->set(VALUE_INDEX, *substr);
elms->set(WRITABLE_INDEX, Heap::false_value());
elms->set(ENUMERABLE_INDEX, Heap::false_value());
elms->set(CONFIGURABLE_INDEX, Heap::false_value());
@@ -664,13 +666,15 @@
}
case JSObject::INTERCEPTED_ELEMENT:
- case JSObject::FAST_ELEMENT:
+ case JSObject::FAST_ELEMENT: {
elms->set(IS_ACCESSOR_INDEX, Heap::false_value());
- elms->set(VALUE_INDEX, obj->GetElement(index));
+ Handle<Object> element = GetElement(Handle<Object>(obj), index);
+ elms->set(VALUE_INDEX, *element);
elms->set(WRITABLE_INDEX, Heap::true_value());
elms->set(ENUMERABLE_INDEX, Heap::true_value());
elms->set(CONFIGURABLE_INDEX, Heap::true_value());
return *desc;
+ }
case JSObject::DICTIONARY_ELEMENT: {
NumberDictionary* dictionary = obj->element_dictionary();
@@ -705,7 +709,7 @@
}
// Use recursive implementation to also traverse hidden prototypes
- GetOwnPropertyImplementation(obj, name, &result);
+ GetOwnPropertyImplementation(*obj, *name, &result);
if (!result.IsProperty()) {
return Heap::undefined_value();
@@ -716,7 +720,8 @@
// Property that is internally implemented as a callback or
// an API defined callback.
Object* value = obj->GetPropertyWithCallback(
- obj, structure, name, result.holder());
+ *obj, structure, *name, result.holder());
+ if (value->IsFailure()) return value;
elms->set(IS_ACCESSOR_INDEX, Heap::false_value());
elms->set(VALUE_INDEX, value);
elms->set(WRITABLE_INDEX, Heap::ToBoolean(!result.IsReadOnly()));
@@ -7537,14 +7542,18 @@
// The backing storage array must have non-existing elements to
// preserve holes across concat operations.
storage = Factory::NewFixedArrayWithHoles(result_length);
-
result->set_map(*Factory::GetFastElementsMap(Handle<Map>(result->map())));
+ Handle<Map> fast_map =
+ Factory::GetFastElementsMap(Handle<Map>(result->map()));
+ result->set_map(*fast_map);
} else {
// TODO(126): move 25% pre-allocation logic into Dictionary::Allocate
uint32_t at_least_space_for = estimate_nof_elements +
(estimate_nof_elements >> 2);
storage = Handle<FixedArray>::cast(
Factory::NewNumberDictionary(at_least_space_for));
-
result->set_map(*Factory::GetSlowElementsMap(Handle<Map>(result->map())));
+ Handle<Map> slow_map =
+ Factory::GetSlowElementsMap(Handle<Map>(result->map()));
+ result->set_map(*slow_map);
}
Handle<Object> len =
Factory::NewNumber(static_cast<double>(result_length));
@@ -9079,10 +9088,10 @@
// Recursively copy the with contexts.
Handle<Context> previous(context_chain->previous());
Handle<JSObject> extension(JSObject::cast(context_chain->extension()));
- return Factory::NewWithContext(
- CopyWithContextChain(function_context, previous),
- extension,
- context_chain->IsCatchContext());
+ Handle<Context> context = CopyWithContextChain(function_context,
previous);
+ return Factory::NewWithContext(context,
+ extension,
+ context_chain->IsCatchContext());
}
--
v8-dev mailing list
[email protected]
http://groups.google.com/group/v8-dev
