Title: [113112] trunk/Source/_javascript_Core
- Revision
- 113112
- Author
- [email protected]
- Date
- 2012-04-03 17:29:52 -0700 (Tue, 03 Apr 2012)
Log Message
Linux crashes during boot
https://bugs.webkit.org/show_bug.cgi?id=83096
Reviewed by Filip Pizlo.
The bug here is that we add empty JSValues to the sparse map, and then set them
- but a GC may occur before doing so (due to a call to reportExtraMemory cost).
We may want to consider making it safe to mark empty JSValues, but the simple &
contained fix to this specific bug is to just initialize these values to
something other than JSValue().
* runtime/JSArray.cpp:
(JSC::SparseArrayValueMap::add):
- Initialize sparse map entries.
Modified Paths
Diff
Modified: trunk/Source/_javascript_Core/ChangeLog (113111 => 113112)
--- trunk/Source/_javascript_Core/ChangeLog 2012-04-04 00:28:24 UTC (rev 113111)
+++ trunk/Source/_javascript_Core/ChangeLog 2012-04-04 00:29:52 UTC (rev 113112)
@@ -1,3 +1,20 @@
+2012-04-03 Gavin Barraclough <[email protected]>
+
+ Linux crashes during boot
+ https://bugs.webkit.org/show_bug.cgi?id=83096
+
+ Reviewed by Filip Pizlo.
+
+ The bug here is that we add empty JSValues to the sparse map, and then set them
+ - but a GC may occur before doing so (due to a call to reportExtraMemory cost).
+ We may want to consider making it safe to mark empty JSValues, but the simple &
+ contained fix to this specific bug is to just initialize these values to
+ something other than JSValue().
+
+ * runtime/JSArray.cpp:
+ (JSC::SparseArrayValueMap::add):
+ - Initialize sparse map entries.
+
2012-04-02 Oliver Hunt <[email protected]>
Incorrect liveness information when inlining
Modified: trunk/Source/_javascript_Core/runtime/JSArray.cpp (113111 => 113112)
--- trunk/Source/_javascript_Core/runtime/JSArray.cpp 2012-04-04 00:28:24 UTC (rev 113111)
+++ trunk/Source/_javascript_Core/runtime/JSArray.cpp 2012-04-04 00:29:52 UTC (rev 113112)
@@ -198,6 +198,8 @@
inline SparseArrayValueMap::AddResult SparseArrayValueMap::add(JSArray* array, unsigned i)
{
SparseArrayEntry entry;
+ entry.setWithoutWriteBarrier(jsUndefined());
+
AddResult result = m_map.add(i, entry);
size_t capacity = m_map.capacity();
if (capacity != m_reportedCapacity) {
_______________________________________________
webkit-changes mailing list
[email protected]
http://lists.webkit.org/mailman/listinfo.cgi/webkit-changes
