Attachment 360696 Details for Bug 194082 – Patch

[patch] Patch

bug-194082-20190130233845.patch (text/plain), 1.68 KB, created by Yusuke Suzuki on 2019-01-30 23:38:45 PST

(hide)

Description:

Filename:

MIME Type:

Creator: Yusuke Suzuki

Created: 2019-01-30 23:38:45 PST

Size: 1.68 KB

patch

obsolete

>Subversion Revision: 240765
>diff --git a/Source/JavaScriptCore/ChangeLog b/Source/JavaScriptCore/ChangeLog
>index 32f536acb0d2390cf532d69ce4fd40680321d1ca..d8bc8dd3d97bfe280f440a371d00ce92c86e22ee 100644
>--- a/Source/JavaScriptCore/ChangeLog
>+++ b/Source/JavaScriptCore/ChangeLog
>@@ -1,3 +1,17 @@
>+2019-01-30  Yusuke Suzuki  <ysuzuki@apple.com>
>+
>+        [JSC] Symbol should be in destructibleCellSpace
>+        https://bugs.webkit.org/show_bug.cgi?id=194082
>+
>+        Reviewed by NOBODY (OOPS!).
>+
>+        Because Symbol's member was not poisoned, we changed the subspace for Symbol from destructibleCellSpace
>+        to cellJSValueOOBSpace. But the problem is cellJSValueOOBSpace is a space for cells which are not
>+        destructible. As a result, Symbol::destroy is never called, and SymbolImpl is leaked. This patch makes
>+        Symbol's space destructibleCellSpace to appropriately call the destructor.
>+
>+        * runtime/Symbol.h:
>+
> 2019-01-30  Michael Catanzaro  <mcatanzaro@igalia.com>
> 
>         Unreviewed, rolling out r240755.
>diff --git a/Source/JavaScriptCore/runtime/Symbol.h b/Source/JavaScriptCore/runtime/Symbol.h
>index 71023e61abf00d44edcc851ba92264369710ecc6..52c91621f5ba2dac6526d5a538639d4a26480d70 100644
>--- a/Source/JavaScriptCore/runtime/Symbol.h
>+++ b/Source/JavaScriptCore/runtime/Symbol.h
>@@ -36,12 +36,6 @@ class Symbol final : public JSCell {
>     typedef JSCell Base;
>     static const unsigned StructureFlags = Base::StructureFlags | StructureIsImmortal | OverridesToThis;
> 
>-    template<typename>
>-    static CompleteSubspace* subspaceFor(VM& vm)
>-    {
>-        return &vm.cellJSValueOOBSpace;
>-    }
>-
>     DECLARE_EXPORT_INFO;
> 
>     static const bool needsDestruction = true;

Actions: View | Formatted Diff | Diff

Attachments on bug 194082: 360694 | 360695 | 360696