Small example: var startTime = new Date print(startTime) // Mess up the gc'ed area gc() for (var i = 0; i < 100; ++i) new Number(0.2) print(startTime) Output: Wed Sep 02 2009 11:43:57 GMT+0200 (CEST) Thu Jan 01 1970 01:00:00 GMT+0100 (CET) Known things so far: JSWrapperObject::markChildren is not called for DateInstance objects This method is usually called from: JSArray.h:189 currentCell->markChildren(*this); However, in case of DateInstance, the followin line is called JSArray.h:185 static_cast<JSObject*>(currentCell)->markChildrenDirect(*this); which means (currentCell->structure()->typeInfo().hasDefaultMark()) is true Any idea? I feel hasDefaultMark() should not be true
You're right about hasDefaultMark being the problem. I have a patch that fixes this and also ensures we catch such problems in debug builds.
Created attachment 38930 [details] patch Passes all the regression tests. I will do the performance testing as well before landing.
Comment on attachment 38930 [details] patch r=me
Comment on attachment 38930 [details] patch I haven't landed this patch yet because it causes a performance regression. But I'll be looking into that when I have time and I should be able to address it soon.
Thanks for the update Darin. I am thinking now to try out the patch before landing (perhaps on Monday) to confirm it really works on ARM.
Landed enough of this to fix the bug, but not the entire patch yet. http://trac.webkit.org/changeset/48067