Bug 114318 – Add liveness tests to JSC API entry points

• Component: New Bugs
• Status: RESOLVED FIXED

[Oliver Hunt]

Add liveness tests to JSC API entry points

[Oliver Hunt]

Created attachment 197185 [details]
Patch

[Oliver Hunt]

Committed r148062: <http://trac.webkit.org/changeset/148062>

[Oliver Hunt]

Reopening to attach new patch.

[Oliver Hunt]

Created attachment 197191 [details]
Patch

[Geoffrey Garen]

Comment on attachment 197191 [details]
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=197191&action=review

> Source/JavaScriptCore/API/JSObjectRef.cpp:343
>  void* JSObjectGetPrivate(JSObjectRef object)
>  {
> -    JSObject* jsObject = toJS(object);
> +    JSObject* jsObject = unsafeToJS(object);

Why does GetPrivate need to use the unsafe function?

[Oliver Hunt]

(In reply to comment #5)
> (From update of attachment 197191 [details])
> View in context: https://bugs.webkit.org/attachment.cgi?id=197191&action=review
> 
> > Source/JavaScriptCore/API/JSObjectRef.cpp:343
> >  void* JSObjectGetPrivate(JSObjectRef object)
> >  {
> > -    JSObject* jsObject = toJS(object);
> > +    JSObject* jsObject = unsafeToJS(object);
> 
> Why does GetPrivate need to use the unsafe function?

It's called by finalizers when (by definition) the structure chain for an object may no longer be perfect :-/

Somewhat annoying, but this still covers the majority of cases.

[Geoffrey Garen]

> > Why does GetPrivate need to use the unsafe function?
> 
> It's called by finalizers when (by definition) the structure chain for an object may no longer be perfect :-/

OK. You should add a comment that explains that detail.

Also, let's rename the function to "uncheckedToJS". It's always safe to call the function, it just does less checking.

[Geoffrey Garen]

Comment on attachment 197191 [details]
Patch

r=me with those changes

[Oliver Hunt]

Committed r148073: <http://trac.webkit.org/changeset/148073>

[Alexey Proskuryakov]

This has caused (or maybe uncovered) bug 114341.