Title: [229747] branches/safari-605-branch/Source/_javascript_Core
- Revision
- 229747
- Author
- jmarc...@apple.com
- Date
- 2018-03-20 08:21:02 -0700 (Tue, 20 Mar 2018)
Log Message
Cherry-pick r229109. rdar://problem/38651610
Modified Paths
Diff
Modified: branches/safari-605-branch/Source/_javascript_Core/ChangeLog (229746 => 229747)
--- branches/safari-605-branch/Source/_javascript_Core/ChangeLog 2018-03-20 15:12:33 UTC (rev 229746)
+++ branches/safari-605-branch/Source/_javascript_Core/ChangeLog 2018-03-20 15:21:02 UTC (rev 229747)
@@ -1,3 +1,23 @@
+2018-03-20 Jason Marcell <jmarc...@apple.com>
+
+ Cherry-pick r229109. rdar://problem/38651610
+
+ 2018-02-28 JF Bastien <jfbast...@apple.com>
+
+ GC should sweep code block before deleting
+ https://bugs.webkit.org/show_bug.cgi?id=183229
+ <rdar://problem/32767615>
+
+ Reviewed by Saam Barati, Fil Pizlo.
+
+ Stub routines shouldn't get deleted before codeblocks have been
+ swept, otherwise there's a small race window where the codeblock
+ thinks it's still reachable.
+
+ * heap/Heap.cpp:
+ (JSC::Heap::deleteUnmarkedCompiledCode):
+ (JSC::Heap::sweepInFinalize):
+
2018-02-21 Jason Marcell <jmarc...@apple.com>
Cherry-pick r228860. rdar://problem/37751729
Modified: branches/safari-605-branch/Source/_javascript_Core/heap/Heap.cpp (229746 => 229747)
--- branches/safari-605-branch/Source/_javascript_Core/heap/Heap.cpp 2018-03-20 15:12:33 UTC (rev 229746)
+++ branches/safari-605-branch/Source/_javascript_Core/heap/Heap.cpp 2018-03-20 15:21:02 UTC (rev 229747)
@@ -936,6 +936,7 @@
void Heap::deleteUnmarkedCompiledCode()
{
clearUnmarkedExecutables();
+ vm()->forEachCodeBlockSpace([] (auto& space) { space.space.sweep(); }); // Sweeping must occur before deleting stubs, otherwise the stubs might still think they're alive as they get deleted.
m_jitStubRoutines->deleteUnmarkedJettisonedStubRoutines();
}
@@ -2084,7 +2085,6 @@
void Heap::sweepInFinalize()
{
m_objectSpace.sweepLargeAllocations();
- vm()->forEachCodeBlockSpace([] (auto& space) { space.space.sweep(); });
vm()->eagerlySweptDestructibleObjectSpace.sweep();
}
_______________________________________________
webkit-changes mailing list
webkit-changes@lists.webkit.org
https://lists.webkit.org/mailman/listinfo/webkit-changes
