Bug 200111
| Summary: | [JSC] Investigate CodeBlock liveness | ||
|---|---|---|---|
| Product: | WebKit | Reporter: | Yusuke Suzuki <ysuzuki> |
| Component: | JavaScriptCore | Assignee: | Yusuke Suzuki <ysuzuki> |
| Status: | NEW | ||
| Severity: | Normal | ||
| Priority: | P2 | ||
| Version: | WebKit Nightly Build | ||
| Hardware: | Unspecified | ||
| OS: | Unspecified | ||
Yusuke Suzuki
My guess is that CodeBlock has some problem.
| Attachments | ||
|---|---|---|
| Add attachment proposed patch, testcase, etc. |
Yusuke Suzuki
CodeBlockSet contains CodeBlocks, but it is removed when the destructor is called.
Is this correct mechanism? I’m thinking that it is wrong with incremental sweeping and conservative scan.
Yusuke Suzuki
I think conservative-scan & CodeBlockSet combination is OK, but still I think CodeBlockSet is potentially dangerous.
CodeBlock is registered to that set when it is created, and it is removed when CodeBlock::~CodeBlock destructor is called. This means that CodeBlock is included when CodeBlock is already dead but its destructor is not called (not swept yet).
If the client of CodeBlockSet does not account the possibility that touching CodeBlock is now dead, having a bad time.
The safer way is removing dead CodeBlocks when GC finalizing happens.