wuggy/Dactyloidae
wuggy/Dactyloidae
1
0
Fork 0
mirror of https://repo.dactyloidae.xyz/Dactyloidae/UXP.git synced 2026-09-05 15:28:39 +09:00
Code Issues Projects Releases Packages Wiki Activity

revert last rev (7faa37b7) and revert rev b7e45308 and 9824659d instead.

Browse source 
because crash still happens. crash log:

RegExpShared::finalize(FreeOp* fop)
{
    for (auto& comp : compilationArray)
        js_free(comp.byteCode);
    for (size_t i = 0; i < tables.length(); i++)
        js_free(tables[i]);
    tables.~JitCodeTables(); // <----
}

Stack trace:
 	mozglue.dll!arena_dalloc(void * ptr, unsigned int offset) Line 4209	C
 	mozglue.dll!je_free(void * ptr) Line 6099	C
>	xul.dll!js::RegExpShared::finalize(js::FreeOp * fop) Line 982	C++
 	xul.dll!js::gc::Arena::finalize<js::RegExpShared>(js::FreeOp * fop, js::gc::AllocKind thingKind, unsigned int thingSize) Line 460	C++
 	xul.dll!FinalizeTypedArenas<js::RegExpShared>(js::FreeOp * fop, js::gc::Arena * * src, js::gc::SortedArenaList & dest, js::gc::AllocKind thingKind, js::SliceBudget & budget, js::gc::ArenaLists::KeepArenasEnum keepArenas) Line 521	C++
 	xul.dll!js::gc::ArenaLists::backgroundFinalize(js::FreeOp * fop, js::gc::Arena * listHead, js::gc::Arena * * empty) Line 2597	C++
 	xul.dll!js::gc::GCRuntime::sweepBackgroundThings(js::gc::ZoneList & zones, js::LifoAlloc & freeBlocks) Line 2982	C++
 	xul.dll!js::GCHelperState::doSweep(js::AutoLockGC & lock) Line 3183	C++
 	xul.dll!js::GCHelperState::work() Line 3103	C++
 	xul.dll!js::HelperThread::handleGCHelperWorkload(js::AutoLockHelperThreadState & locked) Line 1823	C++
 	xul.dll!js::HelperThread::threadLoop() Line 1888	C++
 	xul.dll!js::detail::ThreadTrampoline<void (__cdecl&)(void *),js::HelperThread *>::Start(void * aPack) Line 227	C++
 	[External Code]
 	[Frames below may be incorrect and/or missing, no symbols loaded for ucrtbase.dll]
This commit is contained in:
roytam1 2023-02-01 21:43:16 +08:00
commit 4475b2d9f7
3 changed files with 15 additions and 17 deletions
Download patch file Download diff file Expand all files Collapse all files

3
js/src/gc/Heap.h
View file

@ -340,6 +340,9 @@ class TenuredCell : public Cell
static MOZ_ALWAYS_INLINE void writeBarrierPost(void* cellp, TenuredCell* prior,
TenuredCell* next);
// Default implementation for kinds that don't require finalization.
void finalize(FreeOp* fop) {}
// Default implementation for kinds that don't require fixup.
void fixupAfterMovingGC() {}

16
js/src/vm/RegExpObject.cpp
View file

@ -952,6 +952,12 @@ RegExpShared::RegExpShared(JSAtom* source, RegExpFlag flags)
numNamedCaptures_(0), groupsTemplate_(nullptr)
{}
RegExpShared::~RegExpShared()
{
for (size_t i = 0; i < tables.length(); i++)
js_delete(tables[i]);
}
void
RegExpShared::traceChildren(JSTracer* trc)
{
@ -972,16 +978,6 @@ RegExpShared::discardJitCode()
comp.jitCode = nullptr;
}
void
RegExpShared::finalize(FreeOp* fop)
{
for (auto& comp : compilationArray)
js_free(comp.byteCode);
for (size_t i = 0; i < tables.length(); i++)
js_free(tables[i]);
tables.~JitCodeTables();
}
/* static */ bool
RegExpShared::compile(JSContext* cx, MutableHandleRegExpShared re, HandleLinearString input,
CompilationMode mode, ForceByteCodeEnum force)

13
js/src/vm/RegExpObject.h
View file

@ -121,6 +121,7 @@ class RegExpShared : public gc::TenuredCell
uint8_t* byteCode;
RegExpCompilation() : byteCode(nullptr) {}
~RegExpCompilation() { js_free(byteCode); }
bool compiled(ForceByteCodeEnum force = DontForceByteCode) const {
return byteCode || (force == DontForceByteCode && jitCode);
@ -128,14 +129,14 @@ class RegExpShared : public gc::TenuredCell
};
/* Source to the RegExp, for lazy compilation. */
HeapPtr<JSAtom*> source;
GCPtr<JSAtom*> source;
RegExpFlag flags;
bool canStringMatch;
size_t parenCount;
uint32_t numNamedCaptures_;
HeapPtr<PlainObject*> groupsTemplate_;
uint32_t numNamedCaptures_;
GCPtr<PlainObject*> groupsTemplate_;
RegExpCompilation compilationArray[4];
@ -148,8 +149,7 @@ class RegExpShared : public gc::TenuredCell
}
// Tables referenced by JIT code.
using JitCodeTables = Vector<uint8_t*, 0, SystemAllocPolicy>;
JitCodeTables tables;
Vector<uint8_t*, 0, SystemAllocPolicy> tables;
/* Internal functions. */
RegExpShared(JSAtom* source, RegExpFlag flags);
@ -172,7 +172,7 @@ class RegExpShared : public gc::TenuredCell
}
public:
~RegExpShared() = delete;
~RegExpShared();
// Execute this RegExp on input starting from searchIndex, filling in
// matches if specified and otherwise only determining if there is a match.
@ -222,7 +222,6 @@ class RegExpShared : public gc::TenuredCell
void traceChildren(JSTracer* trc);
void discardJitCode();
void finalize(FreeOp* fop);
static size_t offsetOfSource() {
return offsetof(RegExpShared, source);