[SCM] WebKit Debian packaging branch, debian/experimental, updated. upstream/1.3.3-10851-g50815da

[oliver at apple.com]

The following commit has been merged in the debian/experimental branch:
commit 47c7d8679ab4f82ce140089be2a23f08edea2df8
Author: oliver at apple.com <oliver at apple.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Date:   Sat Dec 4 02:05:56 2010 +0000

    2010-12-03  Oliver Hunt  <oliver at apple.com>
    
            Reviewed by Geoff Garen.
    
            Incorrect logic for returning memory at the end of linking.
            Reviewed by Geoff Garen.
    
            At the end of linking we return any space at the end of the
            allocated executable region that was saved due to branch
            compaction.  This is currently by done by subtracting the
            different from the m_freePtr in the allocation pool.  This
            can be incorrect if your allocation was made from a new
            page that was not selected for subsequent allocations.
    
            This patch corrects this behaviour by verifying that the
            memory being returned actually comes from the current
            allocation pool.
    
            * assembler/LinkBuffer.h:
            (JSC::LinkBuffer::linkCode):
            * jit/ExecutableAllocator.h:
            (JSC::ExecutablePool::tryShrink):
    
    git-svn-id: http://svn.webkit.org/repository/webkit/trunk@73321 268f45cc-cd09-0410-ab3c-d52691b4dbfc

diff --git a/JavaScriptCore/ChangeLog b/JavaScriptCore/ChangeLog
index 9b804bd..e314643 100644
--- a/JavaScriptCore/ChangeLog
+++ b/JavaScriptCore/ChangeLog
@@ -1,3 +1,26 @@
+2010-12-03  Oliver Hunt  <oliver at apple.com>
+
+        Reviewed by Geoff Garen.
+
+        Incorrect logic for returning memory at the end of linking.
+        Reviewed by Geoff Garen.
+
+        At the end of linking we return any space at the end of the
+        allocated executable region that was saved due to branch
+        compaction.  This is currently by done by subtracting the
+        different from the m_freePtr in the allocation pool.  This
+        can be incorrect if your allocation was made from a new
+        page that was not selected for subsequent allocations.
+
+        This patch corrects this behaviour by verifying that the
+        memory being returned actually comes from the current
+        allocation pool.
+
+        * assembler/LinkBuffer.h:
+        (JSC::LinkBuffer::linkCode):
+        * jit/ExecutableAllocator.h:
+        (JSC::ExecutablePool::tryShrink):
+
 2010-12-03  Michael Saboff  <msaboff at apple.com>
 
         Reviewed by Gavin Barraclough
diff --git a/JavaScriptCore/assembler/LinkBuffer.h b/JavaScriptCore/assembler/LinkBuffer.h
index e1dca0b..e38b9d4 100644
--- a/JavaScriptCore/assembler/LinkBuffer.h
+++ b/JavaScriptCore/assembler/LinkBuffer.h
@@ -265,7 +265,7 @@ private:
 
         jumpsToLink.clear();
         m_size = writePtr + m_assembler->size() - readPtr;
-        m_executablePool->returnLastBytes(initialSize - m_size);
+        m_executablePool->tryShrink(m_code, initialSize, m_size);
 
 #if DUMP_LINK_STATISTICS
         dumpLinkStatistics(m_code, initialSize, m_size);
diff --git a/JavaScriptCore/jit/ExecutableAllocator.h b/JavaScriptCore/jit/ExecutableAllocator.h
index f362605..be20c73 100644
--- a/JavaScriptCore/jit/ExecutableAllocator.h
+++ b/JavaScriptCore/jit/ExecutableAllocator.h
@@ -137,9 +137,11 @@ public:
         return poolAllocate(n);
     }
     
-    void returnLastBytes(size_t count)
+    void tryShrink(void* allocation, size_t oldSize, size_t newSize)
     {
-        m_freePtr -= count;
+        if (static_cast<char*>(allocation) + oldSize != m_freePtr)
+            return;
+        m_freePtr = static_cast<char*>(allocation) + roundUpAllocationSize(newSize, sizeof(void*));
     }
 
     ~ExecutablePool()

-- 
WebKit Debian packaging