[Webkit-unassigned] [Bug 53716] JSC::Bindings m_rootObject->isValid() assert fails when running layout tests

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=53716


Michael Saboff <msaboff at apple.com> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
  Attachment #81683|                            |review?
               Flag|                            |




--- Comment #7 from Michael Saboff <msaboff at apple.com>  2011-02-08 13:35:00 PST ---
Created an attachment (id=81683)
 --> (https://bugs.webkit.org/attachment.cgi?id=81683&action=review)
Patch to change failing ASSERT to conditionally remove RuntimeObject

There is a race where a RuntimeObject has been marked for garbage collection but not reclaimed.  When RootObject::invalidate() is called for a RootObject containing a GC'ed RuntimeObject, the invalidate call for the RuntimeObject will not be called (due to the m_runtimeObject.isValid(it) check).  The m_runtimeObjects WeakGCMap will be cleared and the m_valid flag will be cleared.  Later, when the RuntimeObject's dtor is called, it will clean up the related Instance object which was leading to the ASSERTion failure.

The code has been changed to make the removal of the runtime object conditional on m_rootObject being valid.  If it isn't valid, the RuntimeObject has already been removed.

-- 
Configure bugmail: https://bugs.webkit.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.