<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1//EN"
"http://www.w3.org/TR/xhtml11/DTD/xhtml11.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head><meta http-equiv="content-type" content="text/html; charset=utf-8" />
<title>[212646] branches/safari-603-branch/Source</title>
</head>
<body>
<style type="text/css"><!--
#msg dl.meta { border: 1px #006 solid; background: #369; padding: 6px; color: #fff; }
#msg dl.meta dt { float: left; width: 6em; font-weight: bold; }
#msg dt:after { content:':';}
#msg dl, #msg dt, #msg ul, #msg li, #header, #footer, #logmsg { font-family: verdana,arial,helvetica,sans-serif; font-size: 10pt; }
#msg dl a { font-weight: bold}
#msg dl a:link { color:#fc3; }
#msg dl a:active { color:#ff0; }
#msg dl a:visited { color:#cc6; }
h3 { font-family: verdana,arial,helvetica,sans-serif; font-size: 10pt; font-weight: bold; }
#msg pre { overflow: auto; background: #ffc; border: 1px #fa0 solid; padding: 6px; }
#logmsg { background: #ffc; border: 1px #fa0 solid; padding: 1em 1em 0 1em; }
#logmsg p, #logmsg pre, #logmsg blockquote { margin: 0 0 1em 0; }
#logmsg p, #logmsg li, #logmsg dt, #logmsg dd { line-height: 14pt; }
#logmsg h1, #logmsg h2, #logmsg h3, #logmsg h4, #logmsg h5, #logmsg h6 { margin: .5em 0; }
#logmsg h1:first-child, #logmsg h2:first-child, #logmsg h3:first-child, #logmsg h4:first-child, #logmsg h5:first-child, #logmsg h6:first-child { margin-top: 0; }
#logmsg ul, #logmsg ol { padding: 0; list-style-position: inside; margin: 0 0 0 1em; }
#logmsg ul { text-indent: -1em; padding-left: 1em; }#logmsg ol { text-indent: -1.5em; padding-left: 1.5em; }
#logmsg > ul, #logmsg > ol { margin: 0 0 1em 0; }
#logmsg pre { background: #eee; padding: 1em; }
#logmsg blockquote { border: 1px solid #fa0; border-left-width: 10px; padding: 1em 1em 0 1em; background: white;}
#logmsg dl { margin: 0; }
#logmsg dt { font-weight: bold; }
#logmsg dd { margin: 0; padding: 0 0 0.5em 0; }
#logmsg dd:before { content:'\00bb';}
#logmsg table { border-spacing: 0px; border-collapse: collapse; border-top: 4px solid #fa0; border-bottom: 1px solid #fa0; background: #fff; }
#logmsg table th { text-align: left; font-weight: normal; padding: 0.2em 0.5em; border-top: 1px dotted #fa0; }
#logmsg table td { text-align: right; border-top: 1px dotted #fa0; padding: 0.2em 0.5em; }
#logmsg table thead th { text-align: center; border-bottom: 1px solid #fa0; }
#logmsg table th.Corner { text-align: left; }
#logmsg hr { border: none 0; border-top: 2px dashed #fa0; height: 1px; }
#header, #footer { color: #fff; background: #636; border: 1px #300 solid; padding: 6px; }
#patch { width: 100%; }
#patch h4 {font-family: verdana,arial,helvetica,sans-serif;font-size:10pt;padding:8px;background:#369;color:#fff;margin:0;}
#patch .propset h4, #patch .binary h4 {margin:0;}
#patch pre {padding:0;line-height:1.2em;margin:0;}
#patch .diff {width:100%;background:#eee;padding: 0 0 10px 0;overflow:auto;}
#patch .propset .diff, #patch .binary .diff {padding:10px 0;}
#patch span {display:block;padding:0 10px;}
#patch .modfile, #patch .addfile, #patch .delfile, #patch .propset, #patch .binary, #patch .copfile {border:1px solid #ccc;margin:10px 0;}
#patch ins {background:#dfd;text-decoration:none;display:block;padding:0 10px;}
#patch del {background:#fdd;text-decoration:none;display:block;padding:0 10px;}
#patch .lines, .info {color:#888;background:#fff;}
--></style>
<div id="msg">
<dl class="meta">
<dt>Revision</dt> <dd><a href="http://trac.webkit.org/projects/webkit/changeset/212646">212646</a></dd>
<dt>Author</dt> <dd>matthew_hanson@apple.com</dd>
<dt>Date</dt> <dd>2017-02-20 09:29:15 -0800 (Mon, 20 Feb 2017)</dd>
</dl>
<h3>Log Message</h3>
<pre>Merge <a href="http://trac.webkit.org/projects/webkit/changeset/212618">r212618</a>. rdar://problem/30475767</pre>
<h3>Modified Paths</h3>
<ul>
<li><a href="#branchessafari603branchSourceJavaScriptCoreChangeLog">branches/safari-603-branch/Source/JavaScriptCore/ChangeLog</a></li>
<li><a href="#branchessafari603branchSourceJavaScriptCoreinterpreterCachedCallh">branches/safari-603-branch/Source/JavaScriptCore/interpreter/CachedCall.h</a></li>
<li><a href="#branchessafari603branchSourceJavaScriptCoreinterpreterCallFrameh">branches/safari-603-branch/Source/JavaScriptCore/interpreter/CallFrame.h</a></li>
<li><a href="#branchessafari603branchSourceJavaScriptCoreinterpreterInterpretercpp">branches/safari-603-branch/Source/JavaScriptCore/interpreter/Interpreter.cpp</a></li>
<li><a href="#branchessafari603branchSourceJavaScriptCoreinterpreterInterpreterh">branches/safari-603-branch/Source/JavaScriptCore/interpreter/Interpreter.h</a></li>
<li><a href="#branchessafari603branchSourceJavaScriptCoreinterpreterProtoCallFrameh">branches/safari-603-branch/Source/JavaScriptCore/interpreter/ProtoCallFrame.h</a></li>
<li><a href="#branchessafari603branchSourceJavaScriptCoreruntimeArgListcpp">branches/safari-603-branch/Source/JavaScriptCore/runtime/ArgList.cpp</a></li>
<li><a href="#branchessafari603branchSourceJavaScriptCoreruntimeArgListh">branches/safari-603-branch/Source/JavaScriptCore/runtime/ArgList.h</a></li>
<li><a href="#branchessafari603branchSourceJavaScriptCoreruntimeStringPrototypecpp">branches/safari-603-branch/Source/JavaScriptCore/runtime/StringPrototype.cpp</a></li>
<li><a href="#branchessafari603branchSourceJavaScriptCoreruntimeVMcpp">branches/safari-603-branch/Source/JavaScriptCore/runtime/VM.cpp</a></li>
<li><a href="#branchessafari603branchSourceJavaScriptCoreruntimeVMh">branches/safari-603-branch/Source/JavaScriptCore/runtime/VM.h</a></li>
<li><a href="#branchessafari603branchSourceWTFChangeLog">branches/safari-603-branch/Source/WTF/ChangeLog</a></li>
<li><a href="#branchessafari603branchSourceWTFWTFxcodeprojprojectpbxproj">branches/safari-603-branch/Source/WTF/WTF.xcodeproj/project.pbxproj</a></li>
</ul>
<h3>Added Paths</h3>
<ul>
<li><a href="#branchessafari603branchSourceWTFwtfForbidHeapAllocationh">branches/safari-603-branch/Source/WTF/wtf/ForbidHeapAllocation.h</a></li>
</ul>
</div>
<div id="patch">
<h3>Diff</h3>
<a id="branchessafari603branchSourceJavaScriptCoreChangeLog"></a>
<div class="modfile"><h4>Modified: branches/safari-603-branch/Source/JavaScriptCore/ChangeLog (212645 => 212646)</h4>
<pre class="diff"><span>
<span class="info">--- branches/safari-603-branch/Source/JavaScriptCore/ChangeLog 2017-02-20 17:29:08 UTC (rev 212645)
+++ branches/safari-603-branch/Source/JavaScriptCore/ChangeLog 2017-02-20 17:29:15 UTC (rev 212646)
</span><span class="lines">@@ -1,3 +1,44 @@
</span><ins>+2017-02-20 Matthew Hanson <matthew_hanson@apple.com>
+
+ Merge r212618. rdar://problem/30475767
+
+ 2017-02-19 Mark Lam <mark.lam@apple.com>
+
+ CachedCall should let GC know to keep its arguments alive.
+ https://bugs.webkit.org/show_bug.cgi?id=168567
+ <rdar://problem/30475767>
+
+ Reviewed by Saam Barati.
+
+ We fix this by having CachedCall use a MarkedArgumentBuffer to store its
+ arguments instead of a Vector.
+
+ Also declared CachedCall, MarkedArgumentBuffer, and ProtoCallFrame as
+ WTF_FORBID_HEAP_ALLOCATION because they rely on being stack allocated for
+ correctness.
+
+ * interpreter/CachedCall.h:
+ (JSC::CachedCall::CachedCall):
+ (JSC::CachedCall::call):
+ (JSC::CachedCall::clearArguments):
+ (JSC::CachedCall::appendArgument):
+ (JSC::CachedCall::setArgument): Deleted.
+ * interpreter/CallFrame.h:
+ (JSC::ExecState::emptyList):
+ * interpreter/Interpreter.cpp:
+ (JSC::Interpreter::prepareForRepeatCall):
+ * interpreter/Interpreter.h:
+ * interpreter/ProtoCallFrame.h:
+ * runtime/ArgList.cpp:
+ (JSC::MarkedArgumentBuffer::expandCapacity):
+ * runtime/ArgList.h:
+ (JSC::MarkedArgumentBuffer::ensureCapacity):
+ * runtime/StringPrototype.cpp:
+ (JSC::replaceUsingRegExpSearch):
+ * runtime/VM.cpp:
+ (JSC::VM::VM):
+ * runtime/VM.h:
+
</ins><span class="cx"> 2017-02-17 Matthew Hanson <matthew_hanson@apple.com>
</span><span class="cx">
</span><span class="cx"> Merge r212177. rdar://problem/30205880
</span></span></pre></div>
<a id="branchessafari603branchSourceJavaScriptCoreinterpreterCachedCallh"></a>
<div class="modfile"><h4>Modified: branches/safari-603-branch/Source/JavaScriptCore/interpreter/CachedCall.h (212645 => 212646)</h4>
<pre class="diff"><span>
<span class="info">--- branches/safari-603-branch/Source/JavaScriptCore/interpreter/CachedCall.h 2017-02-20 17:29:08 UTC (rev 212645)
+++ branches/safari-603-branch/Source/JavaScriptCore/interpreter/CachedCall.h 2017-02-20 17:29:15 UTC (rev 212646)
</span><span class="lines">@@ -1,5 +1,5 @@
</span><span class="cx"> /*
</span><del>- * Copyright (C) 2009, 2013, 2016 Apple Inc. All rights reserved.
</del><ins>+ * Copyright (C) 2009-2017 Apple Inc. All rights reserved.
</ins><span class="cx"> *
</span><span class="cx"> * Redistribution and use in source and binary forms, with or without
</span><span class="cx"> * modification, are permitted provided that the following conditions
</span><span class="lines">@@ -33,10 +33,12 @@
</span><span class="cx"> #include "ProtoCallFrame.h"
</span><span class="cx"> #include "VMEntryScope.h"
</span><span class="cx"> #include "VMInlines.h"
</span><ins>+#include <wtf/ForbidHeapAllocation.h>
</ins><span class="cx">
</span><span class="cx"> namespace JSC {
</span><span class="cx"> class CachedCall {
</span><del>- WTF_MAKE_NONCOPYABLE(CachedCall); WTF_MAKE_FAST_ALLOCATED;
</del><ins>+ WTF_MAKE_NONCOPYABLE(CachedCall);
+ WTF_FORBID_HEAP_ALLOCATION;
</ins><span class="cx"> public:
</span><span class="cx"> CachedCall(CallFrame* callFrame, JSFunction* function, int argumentCount)
</span><span class="cx"> : m_valid(false)
</span><span class="lines">@@ -49,8 +51,8 @@
</span><span class="cx">
</span><span class="cx"> ASSERT(!function->isHostFunctionNonInline());
</span><span class="cx"> if (UNLIKELY(vm.isSafeToRecurseSoft())) {
</span><del>- m_arguments.resize(argumentCount);
- m_closure = m_interpreter->prepareForRepeatCall(function->jsExecutable(), callFrame, &m_protoCallFrame, function, argumentCount + 1, function->scope(), m_arguments.data());
</del><ins>+ m_arguments.ensureCapacity(argumentCount);
+ m_closure = m_interpreter->prepareForRepeatCall(function->jsExecutable(), callFrame, &m_protoCallFrame, function, argumentCount + 1, function->scope(), m_arguments);
</ins><span class="cx"> } else
</span><span class="cx"> throwStackOverflowError(callFrame, scope);
</span><span class="cx"> m_valid = !scope.exception();
</span><span class="lines">@@ -59,11 +61,14 @@
</span><span class="cx"> JSValue call()
</span><span class="cx"> {
</span><span class="cx"> ASSERT(m_valid);
</span><ins>+ ASSERT(m_arguments.size() == static_cast<size_t>(m_protoCallFrame.argumentCount()));
</ins><span class="cx"> return m_interpreter->execute(m_closure);
</span><span class="cx"> }
</span><span class="cx"> void setThis(JSValue v) { m_protoCallFrame.setThisValue(v); }
</span><del>- void setArgument(int n, JSValue v) { m_protoCallFrame.setArgument(n, v); }
</del><span class="cx">
</span><ins>+ void clearArguments() { m_arguments.clear(); }
+ void appendArgument(JSValue v) { m_arguments.append(v); }
+
</ins><span class="cx"> private:
</span><span class="cx"> bool m_valid;
</span><span class="cx"> Interpreter* m_interpreter;
</span><span class="lines">@@ -70,7 +75,7 @@
</span><span class="cx"> VM& m_vm;
</span><span class="cx"> VMEntryScope m_entryScope;
</span><span class="cx"> ProtoCallFrame m_protoCallFrame;
</span><del>- Vector<JSValue> m_arguments;
</del><ins>+ MarkedArgumentBuffer m_arguments;
</ins><span class="cx"> CallFrameClosure m_closure;
</span><span class="cx"> };
</span><span class="cx"> }
</span></span></pre></div>
<a id="branchessafari603branchSourceJavaScriptCoreinterpreterCallFrameh"></a>
<div class="modfile"><h4>Modified: branches/safari-603-branch/Source/JavaScriptCore/interpreter/CallFrame.h (212645 => 212646)</h4>
<pre class="diff"><span>
<span class="info">--- branches/safari-603-branch/Source/JavaScriptCore/interpreter/CallFrame.h 2017-02-20 17:29:08 UTC (rev 212645)
+++ branches/safari-603-branch/Source/JavaScriptCore/interpreter/CallFrame.h 2017-02-20 17:29:15 UTC (rev 212646)
</span><span class="lines">@@ -1,7 +1,7 @@
</span><span class="cx"> /*
</span><span class="cx"> * Copyright (C) 1999-2001 Harri Porten (porten@kde.org)
</span><span class="cx"> * Copyright (C) 2001 Peter Kelly (pmk@post.com)
</span><del>- * Copyright (C) 2003, 2007-2008, 2011, 2013-2016 Apple Inc. All rights reserved.
</del><ins>+ * Copyright (C) 2003-2017 Apple Inc. All rights reserved.
</ins><span class="cx"> *
</span><span class="cx"> * This library is free software; you can redistribute it and/or
</span><span class="cx"> * modify it under the terms of the GNU Library General Public
</span><span class="lines">@@ -119,7 +119,7 @@
</span><span class="cx">
</span><span class="cx"> AtomicStringTable* atomicStringTable() const { return vm().atomicStringTable(); }
</span><span class="cx"> const CommonIdentifiers& propertyNames() const { return *vm().propertyNames; }
</span><del>- const MarkedArgumentBuffer& emptyList() const { return *vm().emptyList; }
</del><ins>+ const ArgList& emptyList() const { return *vm().emptyList; }
</ins><span class="cx"> Interpreter* interpreter() { return vm().interpreter; }
</span><span class="cx"> Heap* heap() { return &vm().heap; }
</span><span class="cx">
</span></span></pre></div>
<a id="branchessafari603branchSourceJavaScriptCoreinterpreterInterpretercpp"></a>
<div class="modfile"><h4>Modified: branches/safari-603-branch/Source/JavaScriptCore/interpreter/Interpreter.cpp (212645 => 212646)</h4>
<pre class="diff"><span>
<span class="info">--- branches/safari-603-branch/Source/JavaScriptCore/interpreter/Interpreter.cpp 2017-02-20 17:29:08 UTC (rev 212645)
+++ branches/safari-603-branch/Source/JavaScriptCore/interpreter/Interpreter.cpp 2017-02-20 17:29:15 UTC (rev 212646)
</span><span class="lines">@@ -1,5 +1,5 @@
</span><span class="cx"> /*
</span><del>- * Copyright (C) 2008-2010, 2012-2016 Apple Inc. All rights reserved.
</del><ins>+ * Copyright (C) 2008-2017 Apple Inc. All rights reserved.
</ins><span class="cx"> * Copyright (C) 2008 Cameron Zwarich <cwzwarich@uwaterloo.ca>
</span><span class="cx"> *
</span><span class="cx"> * Redistribution and use in source and binary forms, with or without
</span><span class="lines">@@ -1005,7 +1005,7 @@
</span><span class="cx"> return checkedReturn(asObject(result));
</span><span class="cx"> }
</span><span class="cx">
</span><del>-CallFrameClosure Interpreter::prepareForRepeatCall(FunctionExecutable* functionExecutable, CallFrame* callFrame, ProtoCallFrame* protoCallFrame, JSFunction* function, int argumentCountIncludingThis, JSScope* scope, JSValue* args)
</del><ins>+CallFrameClosure Interpreter::prepareForRepeatCall(FunctionExecutable* functionExecutable, CallFrame* callFrame, ProtoCallFrame* protoCallFrame, JSFunction* function, int argumentCountIncludingThis, JSScope* scope, const ArgList& args)
</ins><span class="cx"> {
</span><span class="cx"> VM& vm = *scope->vm();
</span><span class="cx"> auto throwScope = DECLARE_THROW_SCOPE(vm);
</span><span class="lines">@@ -1025,7 +1025,7 @@
</span><span class="cx">
</span><span class="cx"> size_t argsCount = argumentCountIncludingThis;
</span><span class="cx">
</span><del>- protoCallFrame->init(newCodeBlock, function, jsUndefined(), argsCount, args);
</del><ins>+ protoCallFrame->init(newCodeBlock, function, jsUndefined(), argsCount, args.data());
</ins><span class="cx"> // Return the successful closure:
</span><span class="cx"> CallFrameClosure result = { callFrame, protoCallFrame, function, functionExecutable, &vm, scope, newCodeBlock->numParameters(), argumentCountIncludingThis };
</span><span class="cx"> return result;
</span></span></pre></div>
<a id="branchessafari603branchSourceJavaScriptCoreinterpreterInterpreterh"></a>
<div class="modfile"><h4>Modified: branches/safari-603-branch/Source/JavaScriptCore/interpreter/Interpreter.h (212645 => 212646)</h4>
<pre class="diff"><span>
<span class="info">--- branches/safari-603-branch/Source/JavaScriptCore/interpreter/Interpreter.h 2017-02-20 17:29:08 UTC (rev 212645)
+++ branches/safari-603-branch/Source/JavaScriptCore/interpreter/Interpreter.h 2017-02-20 17:29:15 UTC (rev 212646)
</span><span class="lines">@@ -1,5 +1,5 @@
</span><span class="cx"> /*
</span><del>- * Copyright (C) 2008, 2013, 2015-2016 Apple Inc. All rights reserved.
</del><ins>+ * Copyright (C) 2008-2017 Apple Inc. All rights reserved.
</ins><span class="cx"> * Copyright (C) 2012 Research In Motion Limited. All rights reserved.
</span><span class="cx"> *
</span><span class="cx"> * Redistribution and use in source and binary forms, with or without
</span><span class="lines">@@ -154,7 +154,7 @@
</span><span class="cx"> private:
</span><span class="cx"> enum ExecutionFlag { Normal, InitializeAndReturn };
</span><span class="cx">
</span><del>- CallFrameClosure prepareForRepeatCall(FunctionExecutable*, CallFrame*, ProtoCallFrame*, JSFunction*, int argumentCountIncludingThis, JSScope*, JSValue*);
</del><ins>+ CallFrameClosure prepareForRepeatCall(FunctionExecutable*, CallFrame*, ProtoCallFrame*, JSFunction*, int argumentCountIncludingThis, JSScope*, const ArgList&);
</ins><span class="cx">
</span><span class="cx"> JSValue execute(CallFrameClosure&);
</span><span class="cx">
</span></span></pre></div>
<a id="branchessafari603branchSourceJavaScriptCoreinterpreterProtoCallFrameh"></a>
<div class="modfile"><h4>Modified: branches/safari-603-branch/Source/JavaScriptCore/interpreter/ProtoCallFrame.h (212645 => 212646)</h4>
<pre class="diff"><span>
<span class="info">--- branches/safari-603-branch/Source/JavaScriptCore/interpreter/ProtoCallFrame.h 2017-02-20 17:29:08 UTC (rev 212645)
+++ branches/safari-603-branch/Source/JavaScriptCore/interpreter/ProtoCallFrame.h 2017-02-20 17:29:15 UTC (rev 212646)
</span><span class="lines">@@ -1,5 +1,5 @@
</span><span class="cx"> /*
</span><del>- * Copyright (C) 2013 Apple Inc. All Rights Reserved.
</del><ins>+ * Copyright (C) 2013-2017 Apple Inc. All Rights Reserved.
</ins><span class="cx"> *
</span><span class="cx"> * Redistribution and use in source and binary forms, with or without
</span><span class="cx"> * modification, are permitted provided that the following conditions
</span><span class="lines">@@ -26,10 +26,13 @@
</span><span class="cx"> #pragma once
</span><span class="cx">
</span><span class="cx"> #include "Register.h"
</span><ins>+#include <wtf/ForbidHeapAllocation.h>
</ins><span class="cx">
</span><span class="cx"> namespace JSC {
</span><span class="cx">
</span><span class="cx"> struct JS_EXPORT_PRIVATE ProtoCallFrame {
</span><ins>+ WTF_FORBID_HEAP_ALLOCATION;
+public:
</ins><span class="cx"> Register codeBlockValue;
</span><span class="cx"> Register calleeValue;
</span><span class="cx"> Register argCountAndCodeOriginValue;
</span></span></pre></div>
<a id="branchessafari603branchSourceJavaScriptCoreruntimeArgListcpp"></a>
<div class="modfile"><h4>Modified: branches/safari-603-branch/Source/JavaScriptCore/runtime/ArgList.cpp (212645 => 212646)</h4>
<pre class="diff"><span>
<span class="info">--- branches/safari-603-branch/Source/JavaScriptCore/runtime/ArgList.cpp 2017-02-20 17:29:08 UTC (rev 212645)
+++ branches/safari-603-branch/Source/JavaScriptCore/runtime/ArgList.cpp 2017-02-20 17:29:15 UTC (rev 212646)
</span><span class="lines">@@ -1,5 +1,5 @@
</span><span class="cx"> /*
</span><del>- * Copyright (C) 2003, 2004, 2005, 2006, 2007, 2009, 2016 Apple Inc. All rights reserved.
</del><ins>+ * Copyright (C) 2003-2017 Apple Inc. All rights reserved.
</ins><span class="cx"> *
</span><span class="cx"> * This library is free software; you can redistribute it and/or
</span><span class="cx"> * modify it under the terms of the GNU Library General Public
</span><span class="lines">@@ -63,9 +63,21 @@
</span><span class="cx"> }
</span><span class="cx"> }
</span><span class="cx">
</span><ins>+void MarkedArgumentBuffer::slowEnsureCapacity(size_t requestedCapacity)
+{
+ int newCapacity = Checked<int>(requestedCapacity).unsafeGet();
+ expandCapacity(newCapacity);
+}
+
</ins><span class="cx"> void MarkedArgumentBuffer::expandCapacity()
</span><span class="cx"> {
</span><span class="cx"> int newCapacity = (Checked<int>(m_capacity) * 2).unsafeGet();
</span><ins>+ expandCapacity(newCapacity);
+}
+
+void MarkedArgumentBuffer::expandCapacity(int newCapacity)
+{
+ ASSERT(m_capacity < newCapacity);
</ins><span class="cx"> size_t size = (Checked<size_t>(newCapacity) * sizeof(EncodedJSValue)).unsafeGet();
</span><span class="cx"> EncodedJSValue* newBuffer = static_cast<EncodedJSValue*>(fastMalloc(size));
</span><span class="cx"> for (int i = 0; i < m_capacity; ++i) {
</span></span></pre></div>
<a id="branchessafari603branchSourceJavaScriptCoreruntimeArgListh"></a>
<div class="modfile"><h4>Modified: branches/safari-603-branch/Source/JavaScriptCore/runtime/ArgList.h (212645 => 212646)</h4>
<pre class="diff"><span>
<span class="info">--- branches/safari-603-branch/Source/JavaScriptCore/runtime/ArgList.h 2017-02-20 17:29:08 UTC (rev 212645)
+++ branches/safari-603-branch/Source/JavaScriptCore/runtime/ArgList.h 2017-02-20 17:29:15 UTC (rev 212646)
</span><span class="lines">@@ -1,6 +1,6 @@
</span><span class="cx"> /*
</span><span class="cx"> * Copyright (C) 1999-2001 Harri Porten (porten@kde.org)
</span><del>- * Copyright (C) 2003, 2007, 2008, 2009, 2016 Apple Inc. All rights reserved.
</del><ins>+ * Copyright (C) 2003-2017 Apple Inc. All rights reserved.
</ins><span class="cx"> *
</span><span class="cx"> * This library is free software; you can redistribute it and/or
</span><span class="cx"> * modify it under the terms of the GNU Library General Public
</span><span class="lines">@@ -22,6 +22,7 @@
</span><span class="cx"> #pragma once
</span><span class="cx">
</span><span class="cx"> #include "CallFrame.h"
</span><ins>+#include <wtf/ForbidHeapAllocation.h>
</ins><span class="cx"> #include <wtf/HashSet.h>
</span><span class="cx">
</span><span class="cx"> namespace JSC {
</span><span class="lines">@@ -28,6 +29,7 @@
</span><span class="cx">
</span><span class="cx"> class MarkedArgumentBuffer {
</span><span class="cx"> WTF_MAKE_NONCOPYABLE(MarkedArgumentBuffer);
</span><ins>+ WTF_FORBID_HEAP_ALLOCATION;
</ins><span class="cx"> friend class VM;
</span><span class="cx"> friend class ArgList;
</span><span class="cx">
</span><span class="lines">@@ -94,8 +96,16 @@
</span><span class="cx">
</span><span class="cx"> static void markLists(SlotVisitor&, ListSet&);
</span><span class="cx">
</span><ins>+ void ensureCapacity(size_t requestedCapacity)
+ {
+ if (requestedCapacity > static_cast<size_t>(m_capacity))
+ slowEnsureCapacity(requestedCapacity);
+ }
+
</ins><span class="cx"> private:
</span><span class="cx"> void expandCapacity();
</span><ins>+ void expandCapacity(int newCapacity);
+ void slowEnsureCapacity(size_t requestedCapacity);
</ins><span class="cx">
</span><span class="cx"> void addMarkSet(JSValue);
</span><span class="cx">
</span></span></pre></div>
<a id="branchessafari603branchSourceJavaScriptCoreruntimeStringPrototypecpp"></a>
<div class="modfile"><h4>Modified: branches/safari-603-branch/Source/JavaScriptCore/runtime/StringPrototype.cpp (212645 => 212646)</h4>
<pre class="diff"><span>
<span class="info">--- branches/safari-603-branch/Source/JavaScriptCore/runtime/StringPrototype.cpp 2017-02-20 17:29:08 UTC (rev 212645)
+++ branches/safari-603-branch/Source/JavaScriptCore/runtime/StringPrototype.cpp 2017-02-20 17:29:15 UTC (rev 212646)
</span><span class="lines">@@ -1,6 +1,6 @@
</span><span class="cx"> /*
</span><span class="cx"> * Copyright (C) 1999-2001 Harri Porten (porten@kde.org)
</span><del>- * Copyright (C) 2004-2008, 2013, 2016 Apple Inc. All rights reserved.
</del><ins>+ * Copyright (C) 2004-2017 Apple Inc. All rights reserved.
</ins><span class="cx"> * Copyright (C) 2009 Torch Mobile, Inc.
</span><span class="cx"> * Copyright (C) 2015 Jordan Harband (ljharb@gmail.com)
</span><span class="cx"> *
</span><span class="lines">@@ -539,18 +539,19 @@
</span><span class="cx"> OUT_OF_MEMORY(exec, scope);
</span><span class="cx">
</span><span class="cx"> unsigned i = 0;
</span><ins>+ cachedCall.clearArguments();
</ins><span class="cx"> for (; i < regExp->numSubpatterns() + 1; ++i) {
</span><span class="cx"> int matchStart = ovector[i * 2];
</span><span class="cx"> int matchLen = ovector[i * 2 + 1] - matchStart;
</span><span class="cx">
</span><span class="cx"> if (matchStart < 0)
</span><del>- cachedCall.setArgument(i, jsUndefined());
</del><ins>+ cachedCall.appendArgument(jsUndefined());
</ins><span class="cx"> else
</span><del>- cachedCall.setArgument(i, jsSubstring(&vm, source, matchStart, matchLen));
</del><ins>+ cachedCall.appendArgument(jsSubstring(&vm, source, matchStart, matchLen));
</ins><span class="cx"> }
</span><span class="cx">
</span><del>- cachedCall.setArgument(i++, jsNumber(result.start));
- cachedCall.setArgument(i++, string);
</del><ins>+ cachedCall.appendArgument(jsNumber(result.start));
+ cachedCall.appendArgument(string);
</ins><span class="cx">
</span><span class="cx"> cachedCall.setThis(jsUndefined());
</span><span class="cx"> JSValue jsResult = cachedCall.call();
</span><span class="lines">@@ -578,18 +579,19 @@
</span><span class="cx"> OUT_OF_MEMORY(exec, scope);
</span><span class="cx">
</span><span class="cx"> unsigned i = 0;
</span><ins>+ cachedCall.clearArguments();
</ins><span class="cx"> for (; i < regExp->numSubpatterns() + 1; ++i) {
</span><span class="cx"> int matchStart = ovector[i * 2];
</span><span class="cx"> int matchLen = ovector[i * 2 + 1] - matchStart;
</span><span class="cx">
</span><span class="cx"> if (matchStart < 0)
</span><del>- cachedCall.setArgument(i, jsUndefined());
</del><ins>+ cachedCall.appendArgument(jsUndefined());
</ins><span class="cx"> else
</span><del>- cachedCall.setArgument(i, jsSubstring(&vm, source, matchStart, matchLen));
</del><ins>+ cachedCall.appendArgument(jsSubstring(&vm, source, matchStart, matchLen));
</ins><span class="cx"> }
</span><span class="cx">
</span><del>- cachedCall.setArgument(i++, jsNumber(result.start));
- cachedCall.setArgument(i++, string);
</del><ins>+ cachedCall.appendArgument(jsNumber(result.start));
+ cachedCall.appendArgument(string);
</ins><span class="cx">
</span><span class="cx"> cachedCall.setThis(jsUndefined());
</span><span class="cx"> JSValue jsResult = cachedCall.call();
</span></span></pre></div>
<a id="branchessafari603branchSourceJavaScriptCoreruntimeVMcpp"></a>
<div class="modfile"><h4>Modified: branches/safari-603-branch/Source/JavaScriptCore/runtime/VM.cpp (212645 => 212646)</h4>
<pre class="diff"><span>
<span class="info">--- branches/safari-603-branch/Source/JavaScriptCore/runtime/VM.cpp 2017-02-20 17:29:08 UTC (rev 212645)
+++ branches/safari-603-branch/Source/JavaScriptCore/runtime/VM.cpp 2017-02-20 17:29:15 UTC (rev 212646)
</span><span class="lines">@@ -177,7 +177,7 @@
</span><span class="cx"> , topJSWebAssemblyInstance(nullptr)
</span><span class="cx"> , m_atomicStringTable(vmType == Default ? wtfThreadData().atomicStringTable() : new AtomicStringTable)
</span><span class="cx"> , propertyNames(nullptr)
</span><del>- , emptyList(new MarkedArgumentBuffer)
</del><ins>+ , emptyList(new ArgList)
</ins><span class="cx"> , machineCodeBytesPerBytecodeWordForBaselineJIT(std::make_unique<SimpleStats>())
</span><span class="cx"> , customGetterSetterFunctionMap(*this)
</span><span class="cx"> , stringCache(*this)
</span></span></pre></div>
<a id="branchessafari603branchSourceJavaScriptCoreruntimeVMh"></a>
<div class="modfile"><h4>Modified: branches/safari-603-branch/Source/JavaScriptCore/runtime/VM.h (212645 => 212646)</h4>
<pre class="diff"><span>
<span class="info">--- branches/safari-603-branch/Source/JavaScriptCore/runtime/VM.h 2017-02-20 17:29:08 UTC (rev 212645)
+++ branches/safari-603-branch/Source/JavaScriptCore/runtime/VM.h 2017-02-20 17:29:15 UTC (rev 212646)
</span><span class="lines">@@ -373,7 +373,7 @@
</span><span class="cx"> WTF::SymbolRegistry m_symbolRegistry;
</span><span class="cx"> TemplateRegistryKeyTable m_templateRegistryKeytable;
</span><span class="cx"> CommonIdentifiers* propertyNames;
</span><del>- const MarkedArgumentBuffer* emptyList; // Lists are supposed to be allocated on the stack to have their elements properly marked, which is not the case here - but this list has nothing to mark.
</del><ins>+ const ArgList* emptyList;
</ins><span class="cx"> SmallStrings smallStrings;
</span><span class="cx"> NumericStrings numericStrings;
</span><span class="cx"> DateInstanceCache dateInstanceCache;
</span></span></pre></div>
<a id="branchessafari603branchSourceWTFChangeLog"></a>
<div class="modfile"><h4>Modified: branches/safari-603-branch/Source/WTF/ChangeLog (212645 => 212646)</h4>
<pre class="diff"><span>
<span class="info">--- branches/safari-603-branch/Source/WTF/ChangeLog 2017-02-20 17:29:08 UTC (rev 212645)
+++ branches/safari-603-branch/Source/WTF/ChangeLog 2017-02-20 17:29:15 UTC (rev 212646)
</span><span class="lines">@@ -1,3 +1,26 @@
</span><ins>+2017-02-20 Matthew Hanson <matthew_hanson@apple.com>
+
+ Merge r212618. rdar://problem/30475767
+
+ 2017-02-19 Mark Lam <mark.lam@apple.com>
+
+ CachedCall should let GC know to keep its arguments alive.
+ https://bugs.webkit.org/show_bug.cgi?id=168567
+ <rdar://problem/30475767>
+
+ Reviewed by Saam Barati.
+
+ Added a WTF_FORBID_HEAP_ALLOCATION that will cause a compilation failure if
+ a class declared with it is malloced.
+
+ While this doesn't prevent that class declared WTF_FORBID_HEAP_ALLOCATION from
+ being embedded in another class that is heap allocated, it does at minimum
+ document the intent and gives the users of this class a chance to do the
+ right thing.
+
+ * WTF.xcodeproj/project.pbxproj:
+ * wtf/ForbidHeapAllocation.h: Added.
+
</ins><span class="cx"> 2017-02-17 Matthew Hanson <matthew_hanson@apple.com>
</span><span class="cx">
</span><span class="cx"> Merge r212265. rdar://problem/30231732
</span></span></pre></div>
<a id="branchessafari603branchSourceWTFWTFxcodeprojprojectpbxproj"></a>
<div class="modfile"><h4>Modified: branches/safari-603-branch/Source/WTF/WTF.xcodeproj/project.pbxproj (212645 => 212646)</h4>
<pre class="diff"><span>
<span class="info">--- branches/safari-603-branch/Source/WTF/WTF.xcodeproj/project.pbxproj 2017-02-20 17:29:08 UTC (rev 212645)
+++ branches/safari-603-branch/Source/WTF/WTF.xcodeproj/project.pbxproj 2017-02-20 17:29:15 UTC (rev 212646)
</span><span class="lines">@@ -360,6 +360,7 @@
</span><span class="cx"> E4A0AD3D1A96253C00536DF6 /* WorkQueueCocoa.cpp in Sources */ = {isa = PBXBuildFile; fileRef = E4A0AD3C1A96253C00536DF6 /* WorkQueueCocoa.cpp */; };
</span><span class="cx"> EB95E1F0161A72410089A2F5 /* ByteOrder.h in Headers */ = {isa = PBXBuildFile; fileRef = EB95E1EF161A72410089A2F5 /* ByteOrder.h */; };
</span><span class="cx"> FE8225311B2A1E5B00BA68FD /* NakedPtr.h in Headers */ = {isa = PBXBuildFile; fileRef = FE8225301B2A1E5B00BA68FD /* NakedPtr.h */; };
</span><ins>+ FE86A8751E59440200111BBF /* ForbidHeapAllocation.h in Headers */ = {isa = PBXBuildFile; fileRef = FE86A8741E59440200111BBF /* ForbidHeapAllocation.h */; };
</ins><span class="cx"> FE8925B01D00DAEC0046907E /* Indenter.h in Headers */ = {isa = PBXBuildFile; fileRef = FE8925AF1D00DAEC0046907E /* Indenter.h */; };
</span><span class="cx"> FEDACD3D1630F83F00C69634 /* StackStats.cpp in Sources */ = {isa = PBXBuildFile; fileRef = FEDACD3B1630F83F00C69634 /* StackStats.cpp */; };
</span><span class="cx"> FEDACD3E1630F83F00C69634 /* StackStats.h in Headers */ = {isa = PBXBuildFile; fileRef = FEDACD3C1630F83F00C69634 /* StackStats.h */; };
</span><span class="lines">@@ -735,6 +736,7 @@
</span><span class="cx"> EB95E1EF161A72410089A2F5 /* ByteOrder.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ByteOrder.h; sourceTree = "<group>"; };
</span><span class="cx"> F72BBDB107FA424886178B9E /* SymbolImpl.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = SymbolImpl.cpp; sourceTree = "<group>"; };
</span><span class="cx"> FE8225301B2A1E5B00BA68FD /* NakedPtr.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = NakedPtr.h; sourceTree = "<group>"; };
</span><ins>+ FE86A8741E59440200111BBF /* ForbidHeapAllocation.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ForbidHeapAllocation.h; sourceTree = "<group>"; };
</ins><span class="cx"> FE8925AF1D00DAEC0046907E /* Indenter.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = Indenter.h; sourceTree = "<group>"; };
</span><span class="cx"> FEDACD3B1630F83F00C69634 /* StackStats.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = StackStats.cpp; sourceTree = "<group>"; };
</span><span class="cx"> FEDACD3C1630F83F00C69634 /* StackStats.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = StackStats.h; sourceTree = "<group>"; };
</span><span class="lines">@@ -945,6 +947,7 @@
</span><span class="cx"> 0F9D335B165DBA73005AD387 /* FilePrintStream.cpp */,
</span><span class="cx"> 0F9D335C165DBA73005AD387 /* FilePrintStream.h */,
</span><span class="cx"> 0F2B66A517B6B4F700A7AE3F /* FlipBytes.h */,
</span><ins>+ FE86A8741E59440200111BBF /* ForbidHeapAllocation.h */,
</ins><span class="cx"> A8A472A6151A825A004123FF /* Forward.h */,
</span><span class="cx"> 83F2BADE1CF9524E003E99C3 /* Function.h */,
</span><span class="cx"> 1A1D8B9D1731879800141DA4 /* FunctionDispatcher.cpp */,
</span><span class="lines">@@ -1383,6 +1386,7 @@
</span><span class="cx"> 83F2BADF1CF9524E003E99C3 /* Function.h in Headers */,
</span><span class="cx"> 1A1D8B9C173186CE00141DA4 /* FunctionDispatcher.h in Headers */,
</span><span class="cx"> A8A473CA151A825B004123FF /* GetPtr.h in Headers */,
</span><ins>+ FE86A8751E59440200111BBF /* ForbidHeapAllocation.h in Headers */,
</ins><span class="cx"> 0FEC84AF1BD825310080FF74 /* GraphNodeWorklist.h in Headers */,
</span><span class="cx"> 2C05385415BC819000F21B96 /* GregorianDateTime.h in Headers */,
</span><span class="cx"> A8A473D3151A825B004123FF /* HashCountedSet.h in Headers */,
</span></span></pre></div>
<a id="branchessafari603branchSourceWTFwtfForbidHeapAllocationh"></a>
<div class="addfile"><h4>Added: branches/safari-603-branch/Source/WTF/wtf/ForbidHeapAllocation.h (0 => 212646)</h4>
<pre class="diff"><span>
<span class="info">--- branches/safari-603-branch/Source/WTF/wtf/ForbidHeapAllocation.h (rev 0)
+++ branches/safari-603-branch/Source/WTF/wtf/ForbidHeapAllocation.h 2017-02-20 17:29:15 UTC (rev 212646)
</span><span class="lines">@@ -0,0 +1,37 @@
</span><ins>+/*
+ * Copyright (C) 2017 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ * notice, this list of conditions and the following disclaimer in the
+ * documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#pragma once
+
+#define WTF_FORBID_HEAP_ALLOCATION \
+private: \
+ void* operator new(size_t, void*) = delete; \
+ void* operator new[](size_t, void*) = delete; \
+ void* operator new(size_t) = delete; \
+ void operator delete(void*) = delete; \
+ void* operator new[](size_t size) = delete; \
+ void operator delete[](void*) = delete; \
+ void* operator new(size_t, NotNullTag, void* location) = delete; \
+ typedef int __thisIsHereToForceASemicolonAfterThisForbidHeapAllocationMacro
</ins></span></pre>
</div>
</div>
</body>
</html>