Title: [150050] trunk/Source/_javascript_Core
- Revision
- 150050
- Author
- [email protected]
- Date
- 2013-05-13 19:49:31 -0700 (Mon, 13 May 2013)
Log Message
Objective-C API: scanExternalObjectGraph should not create new JSVirtualMachine wrappers
https://bugs.webkit.org/show_bug.cgi?id=116074
If scanExternalObjectGraph creates a new JSVirtualMachine wrapper during collection, when the
scanExternalObjectGraph call finishes and the autorelease pool is drained we will dealloc the
JSVirtualMachine which will cause us to try to take the API lock for the corresponding VM.
If this happens on a GC thread other than the "main" thread, we will deadlock. The solution
is to just check the VM cache, and if there is no JSVirtualMachine wrapper, return early.
Reviewed by Darin Adler.
* API/JSVirtualMachine.mm:
(scanExternalObjectGraph):
Modified Paths
Diff
Modified: trunk/Source/_javascript_Core/API/JSVirtualMachine.mm (150049 => 150050)
--- trunk/Source/_javascript_Core/API/JSVirtualMachine.mm 2013-05-14 02:21:12 UTC (rev 150049)
+++ trunk/Source/_javascript_Core/API/JSVirtualMachine.mm 2013-05-14 02:49:31 UTC (rev 150050)
@@ -227,7 +227,9 @@
void scanExternalObjectGraph(JSC::VM& vm, JSC::SlotVisitor& visitor, void* root)
{
@autoreleasepool {
- JSVirtualMachine *virtualMachine = [JSVirtualMachine virtualMachineWithContextGroupRef:toRef(&vm)];
+ JSVirtualMachine *virtualMachine = [JSVMWrapperCache wrapperForJSContextGroupRef:toRef(&vm)];
+ if (!virtualMachine)
+ return;
NSMapTable *externalObjectGraph = [virtualMachine externalObjectGraph];
Vector<void*> stack;
stack.append(root);
Modified: trunk/Source/_javascript_Core/ChangeLog (150049 => 150050)
--- trunk/Source/_javascript_Core/ChangeLog 2013-05-14 02:21:12 UTC (rev 150049)
+++ trunk/Source/_javascript_Core/ChangeLog 2013-05-14 02:49:31 UTC (rev 150050)
@@ -1,3 +1,19 @@
+2013-05-13 Mark Hahnenberg <[email protected]>
+
+ Objective-C API: scanExternalObjectGraph should not create new JSVirtualMachine wrappers
+ https://bugs.webkit.org/show_bug.cgi?id=116074
+
+ If scanExternalObjectGraph creates a new JSVirtualMachine wrapper during collection, when the
+ scanExternalObjectGraph call finishes and the autorelease pool is drained we will dealloc the
+ JSVirtualMachine which will cause us to try to take the API lock for the corresponding VM.
+ If this happens on a GC thread other than the "main" thread, we will deadlock. The solution
+ is to just check the VM cache, and if there is no JSVirtualMachine wrapper, return early.
+
+ Reviewed by Darin Adler.
+
+ * API/JSVirtualMachine.mm:
+ (scanExternalObjectGraph):
+
2013-05-13 Benjamin Poulain <[email protected]>
Improve stringProtoFuncLastIndexOf for the prefix case
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes
