Inherits runtime directory's classes from FastAllocBase (bug #20422), which has been instantiated by 'new': class IdentifierTable -> instantiated in runtime/Identifier.cpp: line 70 stuct RegExpObjectData -> runtime/RegExpObject.cpp: line 62 class HashEntry -> runtime/Lookup.h: line 47 struct DateInstance::Cache -> runtime/DateInstance.cpp: line 33 class UString -> runtime/UString.cpp: line 212 struct RegExpConstructorPrivate -> runtime/RegExpConstructor.cpp: line 108 class ScopeChain -> untime/JSFunction.h: line 109
Created attachment 31916 [details] proposed patch
Created attachment 31917 [details] updated proposed patch
Comment on attachment 31917 [details] updated proposed patch Looks fine. I still think we could just land these all as one big patch.
Committing to http://svn.webkit.org/repository/webkit/trunk ... M JavaScriptCore/ChangeLog M JavaScriptCore/runtime/DateInstance.cpp M JavaScriptCore/runtime/Identifier.cpp M JavaScriptCore/runtime/Lookup.h M JavaScriptCore/runtime/RegExpConstructor.cpp M JavaScriptCore/runtime/RegExpObject.h M JavaScriptCore/runtime/ScopeChain.h M JavaScriptCore/runtime/UString.h Committed r45259 http://trac.webkit.org/changeset/45259
Rolling out http://trac.webkit.org/changeset/45259. Caused: http://build.webkit.org/builders/Leopard%20Intel%20Debug%20%28Tests%29/builds/2322 http://build.webkit.org/results/Leopard%20Intel%20Debug%20(Tests)/r45259%20(2322)/results.html plugins/undefined-property-crash.html ASSERTION FAILED: s <= HeapConstants<heapType>::cellSize (/Volumes/Big/WebKit-BuildSlave/leopard-intel-debug-tests/build/JavaScriptCore/runtime/Collector.cpp:278 void* JSC::Heap::heapAllocate(size_t) [with JSC::HeapType heapType = PrimaryHeap])
Comment on attachment 31917 [details] updated proposed patch Caused crash on the bots.
Committing to http://svn.webkit.org/repository/webkit/trunk ... M JavaScriptCore/ChangeLog M JavaScriptCore/runtime/DateInstance.cpp M JavaScriptCore/runtime/Identifier.cpp M JavaScriptCore/runtime/Lookup.h M JavaScriptCore/runtime/RegExpConstructor.cpp M JavaScriptCore/runtime/RegExpObject.h M JavaScriptCore/runtime/ScopeChain.h M JavaScriptCore/runtime/UString.h Committed r45269 http://trac.webkit.org/changeset/45269
I need to add a --no-close option to my landing script.
Created attachment 33606 [details] updated proposed patch I need to send one patch for one class, so we will see which causes the assertion.
I'm concerned, because this seems to indicate that adding FastAllocBase as a base class is making some objects bigger!
I think I made a mistake in the r-d patch and inherit a class which has been instantiated by JS's GC also and that caused the problem.
I've checked the problem: I've inherited DateInstance::Cache form FastAllocBase but DataInstance is a JSObject so this caused the problem. DataInstance::Cache doesn't need to be inherited.
Comment on attachment 33606 [details] updated proposed patch Assuming everything still builds. Does this need to be public FastAllocBase?
Comment on attachment 33606 [details] updated proposed patch Clearing review flag on attachment: 33606 Committing to http://svn.webkit.org/repository/webkit/trunk ... M JavaScriptCore/ChangeLog M JavaScriptCore/runtime/RegExpObject.h Committed r46907 M JavaScriptCore/runtime/RegExpObject.h M JavaScriptCore/ChangeLog r46907 = 44404206ca651e03bd169e7e01bca730b59bcd41 (trunk) No changes between current HEAD and refs/remotes/trunk Resetting to the latest refs/remotes/trunk http://trac.webkit.org/changeset/46907
All reviewed patches have been landed. Closing bug.