Title: [110134] trunk/Source/_javascript_Core
- Revision
- 110134
- Author
- [email protected]
- Date
- 2012-03-07 19:15:00 -0800 (Wed, 07 Mar 2012)
Log Message
The end atom of the marked block considered to filter invalid cells
https://bugs.webkit.org/show_bug.cgi?id=79191
Patch by Hojong Han <[email protected]> on 2012-03-07
Reviewed by Geoffrey Garen.
Register file could have stale pointers beyond the end atom of marked block.
Those pointers can weasel out of filtering in-middle-of-cell pointer.
* heap/MarkedBlock.h:
(JSC::MarkedBlock::isLiveCell):
Modified Paths
Diff
Modified: trunk/Source/_javascript_Core/ChangeLog (110133 => 110134)
--- trunk/Source/_javascript_Core/ChangeLog 2012-03-08 03:10:08 UTC (rev 110133)
+++ trunk/Source/_javascript_Core/ChangeLog 2012-03-08 03:15:00 UTC (rev 110134)
@@ -1,3 +1,16 @@
+2012-03-07 Hojong Han <[email protected]>
+
+ The end atom of the marked block considered to filter invalid cells
+ https://bugs.webkit.org/show_bug.cgi?id=79191
+
+ Reviewed by Geoffrey Garen.
+
+ Register file could have stale pointers beyond the end atom of marked block.
+ Those pointers can weasel out of filtering in-middle-of-cell pointer.
+
+ * heap/MarkedBlock.h:
+ (JSC::MarkedBlock::isLiveCell):
+
2012-03-07 Jessie Berlin <[email protected]>
Clean Windows build fails after r110033
Modified: trunk/Source/_javascript_Core/heap/MarkedBlock.h (110133 => 110134)
--- trunk/Source/_javascript_Core/heap/MarkedBlock.h 2012-03-08 03:10:08 UTC (rev 110133)
+++ trunk/Source/_javascript_Core/heap/MarkedBlock.h 2012-03-08 03:15:00 UTC (rev 110134)
@@ -321,6 +321,8 @@
return false;
if ((atomNumber - firstAtom) % m_atomsPerCell) // Filters pointers into cell middles.
return false;
+ if (atomNumber >= m_endAtom) // Filters pointers into invalid cells out of the range.
+ return false;
return isLive(static_cast<const JSCell*>(p));
}
_______________________________________________
webkit-changes mailing list
[email protected]
http://lists.webkit.org/mailman/listinfo.cgi/webkit-changes
