|Summary:||GC in the middle of JSObject::allocatePropertyStorage can cause badness|
|Product:||WebKit||Reporter:||Mark Hahnenberg <firstname.lastname@example.org>|
|Severity:||Normal||CC:||email@example.com, firstname.lastname@example.org, email@example.com, firstname.lastname@example.org|
|Version:||528+ (Nightly build)|
Currently, when we're in the middle of JSObject::allocatePropertyStorage, our Structure has inconsistent information. The Structure has just had a property added to it and it thinks it is bigger in both size and capacity, but our actual property backing store is still the same size as before. This can lead the garbage collector to do bad things based on this inaccurate information. We should instead check to see if we need to allocate more space first and do so if necessary, and then add the new property to our structure.
(From update of attachment 137007 [details]) Attachment 137007 [details] did not pass win-ews (win): Output: http://queues.webkit.org/results/12391710
(From update of attachment 137104 [details]) Attachment 137104 [details] did not pass win-ews (win): Output: http://queues.webkit.org/results/12400123
(From update of attachment 137112 [details]) Attachment 137112 [details] did not pass win-ews (win): Output: http://queues.webkit.org/results/12403044
(From update of attachment 137121 [details]) r=me Did the test cases I mentioned pan out?
(From update of attachment 137121 [details]) Clearing flags on attachment: 137121 Committed r114255: <http://trac.webkit.org/changeset/114255>
All reviewed patches have been landed. Closing bug.
Reverted in r116494, this causes many failures if COLLECT_ON_EVERY_ALLOCATION is enabled.
Rolling this change back in since the underlying bug that it revealed should have been fixed in http://trac.webkit.org/changeset/116565.
Resubmitting patch to make sure everything still builds.