Title: [229261] releases/WebKitGTK/webkit-2.20/Source/_javascript_Core
- Revision
- 229261
- Author
- [email protected]
- Date
- 2018-03-05 04:34:31 -0800 (Mon, 05 Mar 2018)
Log Message
Merge r229109 - GC should sweep code block before deleting
https://bugs.webkit.org/show_bug.cgi?id=183229
<rdar://problem/32767615>
Reviewed by Saam Barati, Fil Pizlo.
Stub routines shouldn't get deleted before codeblocks have been
swept, otherwise there's a small race window where the codeblock
thinks it's still reachable.
* heap/Heap.cpp:
(JSC::Heap::deleteUnmarkedCompiledCode):
(JSC::Heap::sweepInFinalize):
Modified Paths
Diff
Modified: releases/WebKitGTK/webkit-2.20/Source/_javascript_Core/ChangeLog (229260 => 229261)
--- releases/WebKitGTK/webkit-2.20/Source/_javascript_Core/ChangeLog 2018-03-05 12:34:23 UTC (rev 229260)
+++ releases/WebKitGTK/webkit-2.20/Source/_javascript_Core/ChangeLog 2018-03-05 12:34:31 UTC (rev 229261)
@@ -1,3 +1,19 @@
+2018-02-28 JF Bastien <[email protected]>
+
+ GC should sweep code block before deleting
+ https://bugs.webkit.org/show_bug.cgi?id=183229
+ <rdar://problem/32767615>
+
+ Reviewed by Saam Barati, Fil Pizlo.
+
+ Stub routines shouldn't get deleted before codeblocks have been
+ swept, otherwise there's a small race window where the codeblock
+ thinks it's still reachable.
+
+ * heap/Heap.cpp:
+ (JSC::Heap::deleteUnmarkedCompiledCode):
+ (JSC::Heap::sweepInFinalize):
+
2018-02-28 Yusuke Suzuki <[email protected]>
JSC crash with `import("")`
Modified: releases/WebKitGTK/webkit-2.20/Source/_javascript_Core/heap/Heap.cpp (229260 => 229261)
--- releases/WebKitGTK/webkit-2.20/Source/_javascript_Core/heap/Heap.cpp 2018-03-05 12:34:23 UTC (rev 229260)
+++ releases/WebKitGTK/webkit-2.20/Source/_javascript_Core/heap/Heap.cpp 2018-03-05 12:34:31 UTC (rev 229261)
@@ -944,6 +944,7 @@
void Heap::deleteUnmarkedCompiledCode()
{
clearUnmarkedExecutables();
+ vm()->forEachCodeBlockSpace([] (auto& space) { space.space.sweep(); }); // Sweeping must occur before deleting stubs, otherwise the stubs might still think they're alive as they get deleted.
m_jitStubRoutines->deleteUnmarkedJettisonedStubRoutines();
}
@@ -2081,7 +2082,6 @@
void Heap::sweepInFinalize()
{
m_objectSpace.sweepLargeAllocations();
- vm()->forEachCodeBlockSpace([] (auto& space) { space.space.sweep(); });
vm()->eagerlySweptDestructibleObjectSpace.sweep();
}
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes
