Title: [118810] trunk/Source/_javascript_Core
- Revision
- 118810
- Author
- [email protected]
- Date
- 2012-05-29 11:38:14 -0700 (Tue, 29 May 2012)
Log Message
CopiedSpace::doneCopying could start another collection
https://bugs.webkit.org/show_bug.cgi?id=86538
Reviewed by Geoffrey Garen.
It's possible that if we don't have anything at the head of to-space
after a collection and the BlockAllocator doesn't have any fresh blocks
to give us right now we could start another collection while still in
the middle of the first collection when we call CopiedSpace::addNewBlock().
One way to resolve this would be to have Heap::shouldCollect() check that
m_operationInProgress is NoOperation. This would prevent the path in
getFreshBlock() that starts the collection if we're already in the middle of one.
I could not come up with a test case to reproduce this crash on ToT.
* heap/Heap.h:
(JSC::Heap::shouldCollect): We shouldn't collect if we're already in the middle
of a collection, i.e. the current operation should be NoOperation.
Modified Paths
Diff
Modified: trunk/Source/_javascript_Core/ChangeLog (118809 => 118810)
--- trunk/Source/_javascript_Core/ChangeLog 2012-05-29 18:19:59 UTC (rev 118809)
+++ trunk/Source/_javascript_Core/ChangeLog 2012-05-29 18:38:14 UTC (rev 118810)
@@ -1,3 +1,25 @@
+2012-05-29 Mark Hahnenberg <[email protected]>
+
+ CopiedSpace::doneCopying could start another collection
+ https://bugs.webkit.org/show_bug.cgi?id=86538
+
+ Reviewed by Geoffrey Garen.
+
+ It's possible that if we don't have anything at the head of to-space
+ after a collection and the BlockAllocator doesn't have any fresh blocks
+ to give us right now we could start another collection while still in
+ the middle of the first collection when we call CopiedSpace::addNewBlock().
+
+ One way to resolve this would be to have Heap::shouldCollect() check that
+ m_operationInProgress is NoOperation. This would prevent the path in
+ getFreshBlock() that starts the collection if we're already in the middle of one.
+
+ I could not come up with a test case to reproduce this crash on ToT.
+
+ * heap/Heap.h:
+ (JSC::Heap::shouldCollect): We shouldn't collect if we're already in the middle
+ of a collection, i.e. the current operation should be NoOperation.
+
2012-05-29 David Barr <[email protected]>
Introduce ENABLE_CSS_IMAGE_RESOLUTION compile flag
Modified: trunk/Source/_javascript_Core/heap/Heap.h (118809 => 118810)
--- trunk/Source/_javascript_Core/heap/Heap.h 2012-05-29 18:19:59 UTC (rev 118809)
+++ trunk/Source/_javascript_Core/heap/Heap.h 2012-05-29 18:38:14 UTC (rev 118810)
@@ -240,9 +240,9 @@
inline bool Heap::shouldCollect()
{
#if ENABLE(GGC)
- return m_objectSpace.nurseryWaterMark() >= m_minBytesPerCycle && m_isSafeToCollect;
+ return m_objectSpace.nurseryWaterMark() >= m_minBytesPerCycle && m_isSafeToCollect && m_operationInProgress == NoOperation;
#else
- return m_bytesAllocated > m_bytesAllocatedLimit && m_isSafeToCollect;
+ return m_bytesAllocated > m_bytesAllocatedLimit && m_isSafeToCollect && m_operationInProgress == NoOperation;
#endif
}
_______________________________________________
webkit-changes mailing list
[email protected]
http://lists.webkit.org/mailman/listinfo.cgi/webkit-changes
