Title: [86913] branches/safari-534.36-branch/Source/_javascript_Core
Diff
Modified: branches/safari-534.36-branch/Source/_javascript_Core/ChangeLog (86912 => 86913)
--- branches/safari-534.36-branch/Source/_javascript_Core/ChangeLog 2011-05-20 01:04:09 UTC (rev 86912)
+++ branches/safari-534.36-branch/Source/_javascript_Core/ChangeLog 2011-05-20 01:11:08 UTC (rev 86913)
@@ -1,5 +1,22 @@
2011-05-19 Lucas Forschler <[email protected]
+ Merged r86809.
+
+ 2011-05-18 Oliver Hunt <[email protected]>
+
+ Reviewed by Gavin Barraclough.
+
+ Some tests crashing in JSC::MarkStack::validateValue beneath ScriptController::clearWindowShell on SnowLeopard Intel Release (WebKit2 Tests)
+ https://bugs.webkit.org/show_bug.cgi?id=61064
+
+ Switch NonFinalObject to using WriteBarrier<> rather than WriteBarrierBase<>
+ for its inline storage. This resolves the problem of GC occurring before
+ a subclass has initialised its anonymous storage.
+
+ * runtime/JSObject.h:
+
+2011-05-19 Lucas Forschler <[email protected]
+
Merged r86785.
2011-05-18 Oliver Hunt <[email protected]>
Modified: branches/safari-534.36-branch/Source/_javascript_Core/runtime/JSObject.h (86912 => 86913)
--- branches/safari-534.36-branch/Source/_javascript_Core/runtime/JSObject.h 2011-05-20 01:04:09 UTC (rev 86912)
+++ branches/safari-534.36-branch/Source/_javascript_Core/runtime/JSObject.h 2011-05-20 01:11:08 UTC (rev 86913)
@@ -343,7 +343,7 @@
}
private:
- WriteBarrierBase<Unknown> m_inlineStorage[JSNonFinalObject_inlineStorageCapacity];
+ WriteBarrier<Unknown> m_inlineStorage[JSNonFinalObject_inlineStorageCapacity];
};
// JSFinalObject is a type of JSObject that contains sufficent internal
_______________________________________________
webkit-changes mailing list
[email protected]
http://lists.webkit.org/mailman/listinfo.cgi/webkit-changes
