Reviewed by Maciej.

        <rdar://problem/4308243> 8F36 Regression: crash in malloc_consolidate if you use a .PAC file

        The original fix missed the oversized cell case. Added a test for "currentThreadIsMainThread ||
        imp->m_destructorIsThreadSafe" where we collect oversized cells.

        We don't have a way to test PAC files yet, so there's no test attached.

        * kjs/collector.cpp:
        (KJS::Collector::collect): test the thread when we collect oversized cells

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@14141 268f45cc-cd09-0410-ab3c-d52691b4dbfc

diff --git a/JavaScriptCore/ChangeLog b/JavaScriptCore/ChangeLog
index b4fefc707b96b4327bfbcdd13a8f628ee2555c48..5cf16a801ed1a451aa538f28cf3e6766f42fe2eb 100644 (file)
--- a/JavaScriptCore/ChangeLog
+++ b/JavaScriptCore/ChangeLog
@@ -1,3 +1,17 @@
+2006-05-01  Timothy Hatcher  <timothy@apple.com>
+
+        Reviewed by Maciej.
+        
+        <rdar://problem/4308243> 8F36 Regression: crash in malloc_consolidate if you use a .PAC file
+
+        The original fix missed the oversized cell case. Added a test for "currentThreadIsMainThread || 
+        imp->m_destructorIsThreadSafe" where we collect oversized cells.
+
+        We don't have a way to test PAC files yet, so there's no test attached.
+
+        * kjs/collector.cpp:
+        (KJS::Collector::collect): test the thread when we collect oversized cells
+
 2006-05-01  Tim Omernick  <timo@apple.com>
 
         Reviewed by Adele.

diff --git a/JavaScriptCore/kjs/collector.cpp b/JavaScriptCore/kjs/collector.cpp
index 42d6f241c762a22df4d40dcd48070d14ce39cd62..1718f55bb2b2329d51a21ece5b92788588758640 100644 (file)
--- a/JavaScriptCore/kjs/collector.cpp
+++ b/JavaScriptCore/kjs/collector.cpp
@@ -544,7 +544,7 @@ bool Collector::collect()
   while (cell < heap.usedOversizeCells) {
     JSCell *imp = (JSCell *)heap.oversizeCells[cell];
     
-    if (!imp->m_marked) {
+    if (!imp->m_marked && (currentThreadIsMainThread || imp->m_destructorIsThreadSafe)) {
       imp->~JSCell();
 #if DEBUG_COLLECTOR
       heap.oversizeCells[cell]->u.freeCell.zeroIfFree = 0;