Revision: 5738
Author: [email protected]
Date: Fri Oct 29 01:13:19 2010
Log: Clear JS function result caches in all global contexts.
Original patch by Mark Lam <[email protected]> from Hewlett-Packard
Development Company, LP. (http://codereview.chromium.org/4187007)
Fix memory corruption in JSFunctionResultCache::Clear caused by out of
bounds writes which was revealed by the patch.
Review URL: http://codereview.chromium.org/4200009
http://code.google.com/p/v8/source/detail?r=5738
Modified:
/branches/bleeding_edge/src/heap.cc
/branches/bleeding_edge/src/objects-inl.h
=======================================
--- /branches/bleeding_edge/src/heap.cc Mon Oct 25 08:22:03 2010
+++ /branches/bleeding_edge/src/heap.cc Fri Oct 29 01:13:19 2010
@@ -581,25 +581,22 @@
}
-class ClearThreadJSFunctionResultCachesVisitor: public ThreadVisitor {
- virtual void VisitThread(ThreadLocalTop* top) {
- Context* context = top->context_;
- if (context == NULL) return;
-
+void Heap::ClearJSFunctionResultCaches() {
+ if (Bootstrapper::IsActive()) return;
+
+ Object* context = global_contexts_list_;
+ while (!context->IsUndefined()) {
+ // Get the caches for this context:
FixedArray* caches =
- context->global()->global_context()->jsfunction_result_caches();
+ Context::cast(context)->jsfunction_result_caches();
+ // Clear the caches:
int length = caches->length();
for (int i = 0; i < length; i++) {
JSFunctionResultCache::cast(caches->get(i))->Clear();
}
- }
-};
-
-
-void Heap::ClearJSFunctionResultCaches() {
- if (Bootstrapper::IsActive()) return;
- ClearThreadJSFunctionResultCachesVisitor visitor;
- ThreadManager::IterateArchivedThreads(&visitor);
+ // Get the next context:
+ context = Context::cast(context)->get(Context::NEXT_CONTEXT_LINK);
+ }
}
=======================================
--- /branches/bleeding_edge/src/objects-inl.h Mon Oct 25 08:22:03 2010
+++ /branches/bleeding_edge/src/objects-inl.h Fri Oct 29 01:13:19 2010
@@ -1952,7 +1952,9 @@
void JSFunctionResultCache::Clear() {
int cache_size = Smi::cast(get(kCacheSizeIndex))->value();
Object** entries_start = RawField(this,
OffsetOfElementAt(kEntriesIndex));
- MemsetPointer(entries_start, Heap::the_hole_value(), cache_size);
+ MemsetPointer(entries_start,
+ Heap::the_hole_value(),
+ cache_size - kEntriesIndex);
MakeZeroSize();
}
--
v8-dev mailing list
[email protected]
http://groups.google.com/group/v8-dev
