Title: [229122] tags/Safari-605.1.32.0.1/Source/_javascript_Core
- Revision
- 229122
- Author
- jmarc...@apple.com
- Date
- 2018-02-28 19:51:15 -0800 (Wed, 28 Feb 2018)
Log Message
Cherry-pick r229109. rdar://problem/38005929
Modified Paths
Diff
Modified: tags/Safari-605.1.32.0.1/Source/_javascript_Core/ChangeLog (229121 => 229122)
--- tags/Safari-605.1.32.0.1/Source/_javascript_Core/ChangeLog 2018-03-01 03:49:43 UTC (rev 229121)
+++ tags/Safari-605.1.32.0.1/Source/_javascript_Core/ChangeLog 2018-03-01 03:51:15 UTC (rev 229122)
@@ -1,3 +1,23 @@
+2018-02-28 Jason Marcell <jmarc...@apple.com>
+
+ Cherry-pick r229109. rdar://problem/38005929
+
+ 2018-02-28 JF Bastien <jfbast...@apple.com>
+
+ GC should sweep code block before deleting
+ https://bugs.webkit.org/show_bug.cgi?id=183229
+ <rdar://problem/32767615>
+
+ Reviewed by Saam Barati, Fil Pizlo.
+
+ Stub routines shouldn't get deleted before codeblocks have been
+ swept, otherwise there's a small race window where the codeblock
+ thinks it's still reachable.
+
+ * heap/Heap.cpp:
+ (JSC::Heap::deleteUnmarkedCompiledCode):
+ (JSC::Heap::sweepInFinalize):
+
2018-02-21 Jason Marcell <jmarc...@apple.com>
Cherry-pick r228860. rdar://problem/37751729
Modified: tags/Safari-605.1.32.0.1/Source/_javascript_Core/heap/Heap.cpp (229121 => 229122)
--- tags/Safari-605.1.32.0.1/Source/_javascript_Core/heap/Heap.cpp 2018-03-01 03:49:43 UTC (rev 229121)
+++ tags/Safari-605.1.32.0.1/Source/_javascript_Core/heap/Heap.cpp 2018-03-01 03:51:15 UTC (rev 229122)
@@ -936,6 +936,7 @@
void Heap::deleteUnmarkedCompiledCode()
{
clearUnmarkedExecutables();
+ vm()->forEachCodeBlockSpace([] (auto& space) { space.space.sweep(); }); // Sweeping must occur before deleting stubs, otherwise the stubs might still think they're alive as they get deleted.
m_jitStubRoutines->deleteUnmarkedJettisonedStubRoutines();
}
@@ -2084,7 +2085,6 @@
void Heap::sweepInFinalize()
{
m_objectSpace.sweepLargeAllocations();
- vm()->forEachCodeBlockSpace([] (auto& space) { space.space.sweep(); });
vm()->eagerlySweptDestructibleObjectSpace.sweep();
}
_______________________________________________
webkit-changes mailing list
webkit-changes@lists.webkit.org
https://lists.webkit.org/mailman/listinfo/webkit-changes
