Title: [90282] trunk/Source/_javascript_Core
- Revision
- 90282
- Author
- [email protected]
- Date
- 2011-07-01 15:02:54 -0700 (Fri, 01 Jul 2011)
Log Message
2011-07-01 Oliver Hunt <[email protected]>
IE Web Workers demo crashes in JSC::SlotVisitor::visitChildren()
https://bugs.webkit.org/show_bug.cgi?id=63732
Reviewed by Gavin Barraclough.
Initialise the memory at the head of the new storage so that
GC is safe if triggered by reportExtraMemoryCost.
* runtime/JSArray.cpp:
(JSC::JSArray::increaseVectorPrefixLength):
Modified Paths
Diff
Modified: trunk/Source/_javascript_Core/ChangeLog (90281 => 90282)
--- trunk/Source/_javascript_Core/ChangeLog 2011-07-01 22:02:44 UTC (rev 90281)
+++ trunk/Source/_javascript_Core/ChangeLog 2011-07-01 22:02:54 UTC (rev 90282)
@@ -1,5 +1,18 @@
2011-07-01 Oliver Hunt <[email protected]>
+ IE Web Workers demo crashes in JSC::SlotVisitor::visitChildren()
+ https://bugs.webkit.org/show_bug.cgi?id=63732
+
+ Reviewed by Gavin Barraclough.
+
+ Initialise the memory at the head of the new storage so that
+ GC is safe if triggered by reportExtraMemoryCost.
+
+ * runtime/JSArray.cpp:
+ (JSC::JSArray::increaseVectorPrefixLength):
+
+2011-07-01 Oliver Hunt <[email protected]>
+
GC sweep can occur before an object is completely initialised
https://bugs.webkit.org/show_bug.cgi?id=63836
Modified: trunk/Source/_javascript_Core/runtime/JSArray.cpp (90281 => 90282)
--- trunk/Source/_javascript_Core/runtime/JSArray.cpp 2011-07-01 22:02:44 UTC (rev 90281)
+++ trunk/Source/_javascript_Core/runtime/JSArray.cpp 2011-07-01 22:02:54 UTC (rev 90282)
@@ -638,7 +638,10 @@
m_vectorLength = newLength;
fastFree(storage->m_allocBase);
-
+ ASSERT(newLength > vectorLength);
+ unsigned delta = newLength - vectorLength;
+ for (unsigned i = 0; i < delta; i++)
+ m_storage->m_vector[i].clear();
Heap::heap(this)->reportExtraMemoryCost(storageSize(newVectorLength) - storageSize(vectorLength));
return true;
_______________________________________________
webkit-changes mailing list
[email protected]
http://lists.webkit.org/mailman/listinfo.cgi/webkit-changes
