Title: [151974] branches/safari-537-branch/Source/_javascript_Core
- Revision
- 151974
- Author
- [email protected]
- Date
- 2013-06-25 17:58:54 -0700 (Tue, 25 Jun 2013)
Log Message
Merged r151786. <rdar://problem/14149317>
Modified Paths
Diff
Modified: branches/safari-537-branch/Source/_javascript_Core/API/JSManagedValue.mm (151973 => 151974)
--- branches/safari-537-branch/Source/_javascript_Core/API/JSManagedValue.mm 2013-06-26 00:36:13 UTC (rev 151973)
+++ branches/safari-537-branch/Source/_javascript_Core/API/JSManagedValue.mm 2013-06-26 00:58:54 UTC (rev 151974)
@@ -40,6 +40,7 @@
class JSManagedValueHandleOwner : public JSC::WeakHandleOwner {
public:
+ virtual void finalize(JSC::Handle<JSC::Unknown>, void* context);
virtual bool isReachableFromOpaqueRoots(JSC::Handle<JSC::Unknown>, void* context, JSC::SlotVisitor&);
};
@@ -90,12 +91,27 @@
return [JSValue valueWithJSValueRef:toRef(object) inContext:context];
}
+- (void)disconnectValue
+{
+ m_value.clear();
+}
+
@end
+@interface JSManagedValue (PrivateMethods)
+- (void)disconnectValue;
+@end
+
bool JSManagedValueHandleOwner::isReachableFromOpaqueRoots(JSC::Handle<JSC::Unknown>, void* context, JSC::SlotVisitor& visitor)
{
JSManagedValue *managedValue = static_cast<JSManagedValue *>(context);
return visitor.containsOpaqueRoot(managedValue);
}
+void JSManagedValueHandleOwner::finalize(JSC::Handle<JSC::Unknown>, void* context)
+{
+ JSManagedValue *managedValue = static_cast<JSManagedValue *>(context);
+ [managedValue disconnectValue];
+}
+
#endif // JSC_OBJC_API_ENABLED
Modified: branches/safari-537-branch/Source/_javascript_Core/API/tests/testapi.mm (151973 => 151974)
--- branches/safari-537-branch/Source/_javascript_Core/API/tests/testapi.mm 2013-06-26 00:36:13 UTC (rev 151973)
+++ branches/safari-537-branch/Source/_javascript_Core/API/tests/testapi.mm 2013-06-26 00:58:54 UTC (rev 151974)
@@ -814,11 +814,22 @@
@autoreleasepool {
JSContext *context = [[JSContext alloc] init];
- TestObject *testObject = TestObject.testObject;
+ TestObject *testObject = [TestObject testObject];
context[@"testObject"] = testObject;
[context evaluateScript:@"testObject.__lookupGetter__('variable').call({})"];
checkResult(@"Make sure we throw an exception when calling getter on incorrect |this|", context.exception);
}
+
+ @autoreleasepool {
+ TestObject *testObject = [TestObject testObject];
+ JSManagedValue *managedTestObject;
+ @autoreleasepool {
+ JSContext *context = [[JSContext alloc] init];
+ context[@"testObject"] = testObject;
+ managedTestObject = [JSManagedValue managedValueWithValue:context[@"testObject"]];
+ [context.virtualMachine addManagedReference:managedTestObject withOwner:testObject];
+ }
+ }
}
#else
Modified: branches/safari-537-branch/Source/_javascript_Core/ChangeLog (151973 => 151974)
--- branches/safari-537-branch/Source/_javascript_Core/ChangeLog 2013-06-26 00:36:13 UTC (rev 151973)
+++ branches/safari-537-branch/Source/_javascript_Core/ChangeLog 2013-06-26 00:58:54 UTC (rev 151974)
@@ -1,5 +1,29 @@
2013-06-25 Lucas Forschler <[email protected]>
+ Merge r151786
+
+ 2013-06-20 Mark Hahnenberg <[email protected]>
+
+ Improper deallocation of JSManagedValue causes crashes during autorelease pool draining
+ https://bugs.webkit.org/show_bug.cgi?id=117840
+
+ Reviewed by Geoffrey Garen.
+
+ Improperly managing a JSManagedValue can cause a crash when the JSC::Weak inside the
+ JSManagedValue is destroyed upon deallocation. We would rather have improperly maintained
+ JSManagedValues cause memory leaks than take down the whole app.
+
+ The fix is to use the callback to the JSC::Weak on the destruction of the VM so that we
+ can safely null it out. This will prevent ~Weak from crashing.
+
+ * API/JSManagedValue.mm:
+ (-[JSManagedValue JSC::JSC::]):
+ (JSManagedValueHandleOwner::finalize):
+ * API/tests/testapi.mm: Added a test that crashed prior to this fix due to a leaked
+ managed reference. Also fixed a small style nit I noticed in another test.
+
+2013-06-25 Lucas Forschler <[email protected]>
+
Merge r151923
2013-06-24 Roger Fong <[email protected]>
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes
