Attachment 370818 Details for Bug 198319 – Patch

[patch] Patch

bug-198319-20190528180531.patch (text/plain), 1.46 KB, created by Sihui Liu on 2019-05-28 18:05:31 PDT

(hide)

Description:

Filename:

MIME Type:

Creator: Sihui Liu

Created: 2019-05-28 18:05:31 PDT

Size: 1.46 KB

patch

obsolete

>Subversion Revision: 245824
>diff --git a/Source/WebCore/ChangeLog b/Source/WebCore/ChangeLog
>index c2f7c68faf89b0be4685e318a682727afd6ad6dd..755214dc8309b4f91dec82cc8ae4956742598235 100644
>--- a/Source/WebCore/ChangeLog
>+++ b/Source/WebCore/ChangeLog
>@@ -1,3 +1,13 @@
>+2019-05-28  Sihui Liu  <sihui_liu@apple.com>
>+
>+        Add write barrier to JSValueInWrappedObject for garbage collection
>+        https://bugs.webkit.org/show_bug.cgi?id=198319
>+
>+        Reviewed by NOBODY (OOPS!).
>+
>+        * bindings/js/JSValueInWrappedObject.h:
>+        (WebCore::cachedPropertyValue):
>+
> 2019-05-28  Brent Fulgham  <bfulgham@apple.com>
> 
>         Protect frames during style and layout changes
>diff --git a/Source/WebCore/bindings/js/JSValueInWrappedObject.h b/Source/WebCore/bindings/js/JSValueInWrappedObject.h
>index 9f5dda27e26669b267fd2465d875c5aa84c5693b..43b5d0220cd291d9a6563c4da580f4a33d851e4a 100644
>--- a/Source/WebCore/bindings/js/JSValueInWrappedObject.h
>+++ b/Source/WebCore/bindings/js/JSValueInWrappedObject.h
>@@ -118,7 +118,9 @@ inline JSC::JSValue cachedPropertyValue(JSC::ExecState& state, const JSDOMObject
> {
>     if (cachedValue && isWorldCompatible(state, cachedValue))
>         return cachedValue;
>-    cachedValue = cloneAcrossWorlds(state, owner, function());
>+    auto value = function();
>+    cachedValue = cloneAcrossWorlds(state, owner, value);
>+    state.vm().heap.writeBarrier(&owner, value);
>     ASSERT(isWorldCompatible(state, cachedValue));
>     return cachedValue;
> }

Actions: View | Formatted Diff | Diff

Attachments on bug 198319: 370818 | 424042