Title: [229109] trunk/Source/_javascript_Core
- Revision
- 229109
- Author
- jfbast...@apple.com
- Date
- 2018-02-28 16:00:07 -0800 (Wed, 28 Feb 2018)
Log Message
GC should sweep code block before deleting
https://bugs.webkit.org/show_bug.cgi?id=183229
<rdar://problem/32767615>
Reviewed by Saam Barati, Fil Pizlo.
Stub routines shouldn't get deleted before codeblocks have been
swept, otherwise there's a small race window where the codeblock
thinks it's still reachable.
* heap/Heap.cpp:
(JSC::Heap::deleteUnmarkedCompiledCode):
(JSC::Heap::sweepInFinalize):
Modified Paths
Diff
Modified: trunk/Source/_javascript_Core/ChangeLog (229108 => 229109)
--- trunk/Source/_javascript_Core/ChangeLog 2018-02-28 23:58:22 UTC (rev 229108)
+++ trunk/Source/_javascript_Core/ChangeLog 2018-03-01 00:00:07 UTC (rev 229109)
@@ -1,3 +1,19 @@
+2018-02-28 JF Bastien <jfbast...@apple.com>
+
+ GC should sweep code block before deleting
+ https://bugs.webkit.org/show_bug.cgi?id=183229
+ <rdar://problem/32767615>
+
+ Reviewed by Saam Barati, Fil Pizlo.
+
+ Stub routines shouldn't get deleted before codeblocks have been
+ swept, otherwise there's a small race window where the codeblock
+ thinks it's still reachable.
+
+ * heap/Heap.cpp:
+ (JSC::Heap::deleteUnmarkedCompiledCode):
+ (JSC::Heap::sweepInFinalize):
+
2018-02-28 Yusuke Suzuki <utatane....@gmail.com>
JSC crash with `import("")`
Modified: trunk/Source/_javascript_Core/heap/Heap.cpp (229108 => 229109)
--- trunk/Source/_javascript_Core/heap/Heap.cpp 2018-02-28 23:58:22 UTC (rev 229108)
+++ trunk/Source/_javascript_Core/heap/Heap.cpp 2018-03-01 00:00:07 UTC (rev 229109)
@@ -944,6 +944,7 @@
void Heap::deleteUnmarkedCompiledCode()
{
clearUnmarkedExecutables();
+ vm()->forEachCodeBlockSpace([] (auto& space) { space.space.sweep(); }); // Sweeping must occur before deleting stubs, otherwise the stubs might still think they're alive as they get deleted.
m_jitStubRoutines->deleteUnmarkedJettisonedStubRoutines();
}
@@ -2081,7 +2082,6 @@
void Heap::sweepInFinalize()
{
m_objectSpace.sweepLargeAllocations();
- vm()->forEachCodeBlockSpace([] (auto& space) { space.space.sweep(); });
vm()->eagerlySweptDestructibleObjectSpace.sweep();
}
_______________________________________________
webkit-changes mailing list
webkit-changes@lists.webkit.org
https://lists.webkit.org/mailman/listinfo/webkit-changes
