Title: [99927] trunk/Source/_javascript_Core
- Revision
- 99927
- Author
- [email protected]
- Date
- 2011-11-10 22:39:54 -0800 (Thu, 10 Nov 2011)
Log Message
JSString forgets to clear m_fibers when resolving ropes
https://bugs.webkit.org/show_bug.cgi?id=72089
Reviewed by Geoff Garen.
* runtime/JSString.cpp:
(JSC::JSString::resolveRopeSlowCase):
Modified Paths
Diff
Modified: trunk/Source/_javascript_Core/ChangeLog (99926 => 99927)
--- trunk/Source/_javascript_Core/ChangeLog 2011-11-11 06:28:49 UTC (rev 99926)
+++ trunk/Source/_javascript_Core/ChangeLog 2011-11-11 06:39:54 UTC (rev 99927)
@@ -1,3 +1,13 @@
+2011-11-10 Filip Pizlo <[email protected]>
+
+ JSString forgets to clear m_fibers when resolving ropes
+ https://bugs.webkit.org/show_bug.cgi?id=72089
+
+ Reviewed by Geoff Garen.
+
+ * runtime/JSString.cpp:
+ (JSC::JSString::resolveRopeSlowCase):
+
2011-11-09 Filip Pizlo <[email protected]>
DFG byte array support sometimes clamps values incorrectly
Modified: trunk/Source/_javascript_Core/runtime/JSString.cpp (99926 => 99927)
--- trunk/Source/_javascript_Core/runtime/JSString.cpp 2011-11-11 06:28:49 UTC (rev 99926)
+++ trunk/Source/_javascript_Core/runtime/JSString.cpp 2011-11-11 06:39:54 UTC (rev 99927)
@@ -102,10 +102,13 @@
UNUSED_PARAM(exec);
UChar* position = buffer + m_length; // We will be working backwards over the rope.
- Vector<JSString*, 32> workQueue; // These strings are kept alive by the parent rope, so using a Vector is OK.
+ Vector<JSString*, 32> workQueue; // Putting strings into a Vector is only OK because there are no GC points in this method.
- for (size_t i = 0; i < s_maxInternalRopeLength && m_fibers[i]; ++i)
+ for (size_t i = 0; i < s_maxInternalRopeLength && m_fibers[i]; ++i) {
workQueue.append(m_fibers[i].get());
+ // Clearing here works only because there are no GC points in this method.
+ m_fibers[i].clear();
+ }
while (!workQueue.isEmpty()) {
JSString* currentFiber = workQueue.last();
_______________________________________________
webkit-changes mailing list
[email protected]
http://lists.webkit.org/mailman/listinfo.cgi/webkit-changes
