Title: [230486] trunk/Source/_javascript_Core
- Revision
- 230486
- Author
- fpi...@apple.com
- Date
- 2018-04-10 11:04:07 -0700 (Tue, 10 Apr 2018)
Log Message
ExecutableToCodeBlockEdge::visitChildren() should be cool with m_codeBlock being null since we clear it in finalizeUnconditionally()
https://bugs.webkit.org/show_bug.cgi?id=184460
<rdar://problem/37610966>
Reviewed by Mark Lam.
* bytecode/ExecutableToCodeBlockEdge.cpp:
(JSC::ExecutableToCodeBlockEdge::visitChildren):
Modified Paths
Diff
Modified: trunk/Source/_javascript_Core/ChangeLog (230485 => 230486)
--- trunk/Source/_javascript_Core/ChangeLog 2018-04-10 17:57:29 UTC (rev 230485)
+++ trunk/Source/_javascript_Core/ChangeLog 2018-04-10 18:04:07 UTC (rev 230486)
@@ -1,5 +1,16 @@
2018-04-10 Filip Pizlo <fpi...@apple.com>
+ ExecutableToCodeBlockEdge::visitChildren() should be cool with m_codeBlock being null since we clear it in finalizeUnconditionally()
+ https://bugs.webkit.org/show_bug.cgi?id=184460
+ <rdar://problem/37610966>
+
+ Reviewed by Mark Lam.
+
+ * bytecode/ExecutableToCodeBlockEdge.cpp:
+ (JSC::ExecutableToCodeBlockEdge::visitChildren):
+
+2018-04-10 Filip Pizlo <fpi...@apple.com>
+
REGRESSION(r227341 and r227742): AI and clobberize should be precise and consistent about the effectfulness of CompareEq
https://bugs.webkit.org/show_bug.cgi?id=184455
Modified: trunk/Source/_javascript_Core/bytecode/ExecutableToCodeBlockEdge.cpp (230485 => 230486)
--- trunk/Source/_javascript_Core/bytecode/ExecutableToCodeBlockEdge.cpp 2018-04-10 17:57:29 UTC (rev 230485)
+++ trunk/Source/_javascript_Core/bytecode/ExecutableToCodeBlockEdge.cpp 2018-04-10 18:04:07 UTC (rev 230486)
@@ -50,6 +50,13 @@
ExecutableToCodeBlockEdge* edge = jsCast<ExecutableToCodeBlockEdge*>(cell);
CodeBlock* codeBlock = edge->m_codeBlock.get();
+ // It's possible for someone to hold a pointer to the edge after the edge has cleared its weak
+ // reference to the codeBlock. In a conservative GC like ours, that could happen at random for
+ // no good reason and it's Totally OK (TM). See finalizeUnconditionally() for where we clear
+ // m_codeBlock.
+ if (!codeBlock)
+ return;
+
if (!edge->m_isActive) {
visitor.appendUnbarriered(codeBlock);
return;
_______________________________________________
webkit-changes mailing list
webkit-changes@lists.webkit.org
https://lists.webkit.org/mailman/listinfo/webkit-changes
