Bug 28909 – DateInstance object collected on ARM JIT (JSValue: WTF_USE_JSVALUE32)

• Component: JavaScriptCore
• Status: RESOLVED FIXED

[Zoltan Herczeg]

Small example:

var startTime = new Date
print(startTime)

// Mess up the gc'ed area
gc()
for (var i = 0; i < 100; ++i)
   new Number(0.2)

print(startTime)

Output:
Wed Sep 02 2009 11:43:57 GMT+0200 (CEST)
Thu Jan 01 1970 01:00:00 GMT+0100 (CET)

Known things so far:
JSWrapperObject::markChildren is not called for DateInstance objects

This method is usually called from:

JSArray.h:189
    currentCell->markChildren(*this);

However, in case of DateInstance, the followin line is called
JSArray.h:185
    static_cast<JSObject*>(currentCell)->markChildrenDirect(*this);
which means (currentCell->structure()->typeInfo().hasDefaultMark()) is true

Any idea? I feel hasDefaultMark() should not be true

[Darin Adler]

You're right about hasDefaultMark being the problem. I have a patch that fixes this and also ensures we catch such problems in debug builds.

[Darin Adler]

Created attachment 38930 [details]
patch

Passes all the regression tests. I will do the performance testing as well before landing.

[Geoffrey Garen]

Comment on attachment 38930 [details]
patch

r=me

[Darin Adler]

Comment on attachment 38930 [details]
patch

I haven't landed this patch yet because it causes a performance regression. But I'll be looking into that when I have time and I should be able to address it soon.

[Zoltan Herczeg]

Thanks for the update Darin. I am thinking now to try out the patch before landing (perhaps on Monday) to confirm it really works on ARM.

[Darin Adler]

Landed enough of this to fix the bug, but not the entire patch yet.

http://trac.webkit.org/changeset/48067