[SCM] WebKit Debian packaging branch, webkit-1.2, updated. upstream/1.1.90-6072-g9a69373
dimich at chromium.org
dimich at chromium.org
Thu Apr 8 02:12:01 UTC 2010
The following commit has been merged in the webkit-1.2 branch:
commit 2a751d7ac3d2b2699f0c165d3ce813ba26d7e1c1
Author: dimich at chromium.org <dimich at chromium.org@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Date: Sat Mar 6 03:04:31 2010 +0000
[v8] Remove wrong assert in GC callback.
https://bugs.webkit.org/show_bug.cgi?id=35757
Reviewed by David Levin.
WebCore:
Test: fast/workers/wrapper-map-gc.html
* bindings/v8/DOMData.h:
(WebCore::DOMData::handleWeakObject): remove ASSERT(isMainThread()), move another assert up to verify we are on the right thread.
LayoutTests:
* fast/workers/resources/wrapper-map-gc.js: Added.
* fast/workers/wrapper-map-gc.html: Added.
* fast/workers/wrapper-map-gc-expected.txt: Added.
git-svn-id: http://svn.webkit.org/repository/webkit/trunk@55608 268f45cc-cd09-0410-ab3c-d52691b4dbfc
diff --git a/LayoutTests/ChangeLog b/LayoutTests/ChangeLog
index a9cf3cc..e9ff37b 100644
--- a/LayoutTests/ChangeLog
+++ b/LayoutTests/ChangeLog
@@ -1,3 +1,14 @@
+2010-03-05 Dmitry Titov <dimich at chromium.org>
+
+ Reviewed by David Levin.
+
+ [v8] Remove wrong assert in GC callback
+ https://bugs.webkit.org/show_bug.cgi?id=35757
+
+ * fast/workers/resources/wrapper-map-gc.js: Added.
+ * fast/workers/wrapper-map-gc.html: Added.
+ * fast/workers/wrapper-map-gc-expected.txt: Added.
+
2010-03-05 Alex Milowski <alex at milowski.com>
Reviewed by Kenneth Rohde Christiansen.
diff --git a/LayoutTests/fast/workers/resources/wrapper-map-gc.js b/LayoutTests/fast/workers/resources/wrapper-map-gc.js
new file mode 100644
index 0000000..c10701d
--- /dev/null
+++ b/LayoutTests/fast/workers/resources/wrapper-map-gc.js
@@ -0,0 +1,7 @@
+onmessage = function(event) {
+ // This quickly creates a need for GC.
+ postMessage(event.data + event.data);
+}
+
+// Trigger the ping-pong.
+postMessage("kaboom?");
diff --git a/LayoutTests/fast/workers/wrapper-map-gc-expected.txt b/LayoutTests/fast/workers/wrapper-map-gc-expected.txt
new file mode 100644
index 0000000..bf4b238
--- /dev/null
+++ b/LayoutTests/fast/workers/wrapper-map-gc-expected.txt
@@ -0,0 +1,3 @@
+This test tries to cause GC in Worker context. It also fires events in the Worker, which allocates JS DOM Wrappers for Event object. As a result of GC, the maps that map wrappers to DOM Objects will be cleaned up. Test succeeds if it does not crash and prints 'PASS' at the end.
+
+PASS
diff --git a/LayoutTests/fast/workers/wrapper-map-gc.html b/LayoutTests/fast/workers/wrapper-map-gc.html
new file mode 100644
index 0000000..8032277
--- /dev/null
+++ b/LayoutTests/fast/workers/wrapper-map-gc.html
@@ -0,0 +1,32 @@
+<script>
+function test()
+{
+ if (window.layoutTestController) {
+ layoutTestController.dumpAsText();
+ layoutTestController.waitUntilDone();
+ }
+
+ var counter = 0;
+ var worker = new Worker("resources/wrapper-map-gc.js");
+
+ // Post the message from worker back to the worker.
+ // This will fire another onmessage event in the Worker and allocate more data.
+ worker.onmessage = function(evt)
+ {
+ worker.postMessage(evt.data);
+ // This appears to be enough to reliably trigger GC in a Worker (about 20Mb strings allocated).
+ if (++counter > 20) {
+ document.getElementById("result").innerText = "PASS";
+ worker.terminate();
+ if (window.layoutTestController) {
+ layoutTestController.notifyDone();
+ }
+ }
+ }
+}
+</script>
+<body onload=test()>
+<p>This test tries to cause GC in Worker context. It also fires events in the Worker, which allocates JS DOM Wrappers for Event object. As a result of GC, the maps that map wrappers to DOM Objects will be cleaned up. Test succeeds if it does not crash and prints 'PASS' at the end.</p>
+<pre id="result"></pre>
+</body>
+</html>
diff --git a/WebCore/ChangeLog b/WebCore/ChangeLog
index 222fec4..45e1151 100644
--- a/WebCore/ChangeLog
+++ b/WebCore/ChangeLog
@@ -1,3 +1,15 @@
+2010-03-05 Dmitry Titov <dimich at chromium.org>
+
+ Reviewed by David Levin.
+
+ [v8] Remove wrong assert in GC callback
+ https://bugs.webkit.org/show_bug.cgi?id=35757
+
+ Test: fast/workers/wrapper-map-gc.html
+
+ * bindings/v8/DOMData.h:
+ (WebCore::DOMData::handleWeakObject): remove ASSERT(isMainThread()), move another assert up to verify we are on the right thread.
+
2010-03-05 Alex Milowski <alex at milowski.com>
Reviewed by Kenneth Rohde Christiansen.
diff --git a/WebCore/bindings/v8/DOMData.h b/WebCore/bindings/v8/DOMData.h
index 7fa9e7d..3ca29bf 100644
--- a/WebCore/bindings/v8/DOMData.h
+++ b/WebCore/bindings/v8/DOMData.h
@@ -98,17 +98,14 @@ namespace WebCore {
template<typename T>
void DOMData::handleWeakObject(DOMDataStore::DOMWrapperMapType mapType, v8::Persistent<v8::Object> v8Object, T* domObject)
{
- ASSERT(WTF::isMainThread());
DOMDataList& list = DOMDataStore::allStores();
for (size_t i = 0; i < list.size(); ++i) {
DOMDataStore* store = list[i];
+ ASSERT(store->domData()->owningThread() == WTF::currentThread());
DOMDataStore::InternalDOMWrapperMap<T>* domMap = static_cast<DOMDataStore::InternalDOMWrapperMap<T>*>(store->getDOMWrapperMap(mapType));
-
- if (domMap->removeIfPresent(domObject, v8Object)) {
- ASSERT(store->domData()->owningThread() == WTF::currentThread());
+ if (domMap->removeIfPresent(domObject, v8Object))
store->domData()->derefObject(V8DOMWrapper::domWrapperType(v8Object), domObject);
- }
}
}
--
WebKit Debian packaging
More information about the Pkg-webkit-commits
mailing list