GC should sweep code block before deleting
authorjfbastien@apple.com <jfbastien@apple.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Thu, 1 Mar 2018 00:00:07 +0000 (00:00 +0000)
committerjfbastien@apple.com <jfbastien@apple.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Thu, 1 Mar 2018 00:00:07 +0000 (00:00 +0000)
https://bugs.webkit.org/show_bug.cgi?id=183229
<rdar://problem/32767615>

Reviewed by Saam Barati, Fil Pizlo.

Stub routines shouldn't get deleted before codeblocks have been
swept, otherwise there's a small race window where the codeblock
thinks it's still reachable.

* heap/Heap.cpp:
(JSC::Heap::deleteUnmarkedCompiledCode):
(JSC::Heap::sweepInFinalize):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@229109 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Source/JavaScriptCore/ChangeLog
Source/JavaScriptCore/heap/Heap.cpp

index 45de6bd..a071180 100644 (file)
@@ -1,3 +1,19 @@
+2018-02-28  JF Bastien  <jfbastien@apple.com>
+
+        GC should sweep code block before deleting
+        https://bugs.webkit.org/show_bug.cgi?id=183229
+        <rdar://problem/32767615>
+
+        Reviewed by Saam Barati, Fil Pizlo.
+
+        Stub routines shouldn't get deleted before codeblocks have been
+        swept, otherwise there's a small race window where the codeblock
+        thinks it's still reachable.
+
+        * heap/Heap.cpp:
+        (JSC::Heap::deleteUnmarkedCompiledCode):
+        (JSC::Heap::sweepInFinalize):
+
 2018-02-28  Yusuke Suzuki  <utatane.tea@gmail.com>
 
         JSC crash with `import("")`
index 3408ec1..17e37ae 100644 (file)
@@ -944,6 +944,7 @@ void Heap::clearUnmarkedExecutables()
 void Heap::deleteUnmarkedCompiledCode()
 {
     clearUnmarkedExecutables();
+    vm()->forEachCodeBlockSpace([] (auto& space) { space.space.sweep(); }); // Sweeping must occur before deleting stubs, otherwise the stubs might still think they're alive as they get deleted.
     m_jitStubRoutines->deleteUnmarkedJettisonedStubRoutines();
 }
 
@@ -2081,7 +2082,6 @@ void Heap::waitForCollection(Ticket ticket)
 void Heap::sweepInFinalize()
 {
     m_objectSpace.sweepLargeAllocations();
-    vm()->forEachCodeBlockSpace([] (auto& space) { space.space.sweep(); });
     vm()->eagerlySweptDestructibleObjectSpace.sweep();
 }