Do not allow GlobalHandles::Create to reuse destoryed nodes (ones from free l...

src/global-handles.cc

 // Copyright 2009 the V8 project authors. All rights reserved.
 // Redistribution and use in source and binary forms, with or without
 // modification, are permitted provided that the following conditions are
 // met:
 //
 //     * Redistributions of source code must retain the above copyright
 //       notice, this list of conditions and the following disclaimer.
 //     * Redistributions in binary form must reproduce the above
 //       copyright notice, this list of conditions and the following
 //       disclaimer in the documentation and/or other materials provided
@@ skipping 138 matching lines @@
     LOG(HandleEvent("GlobalHandle::Processing", handle().location()));
     void* par = parameter();
     state_ = NEAR_DEATH;
     set_parameter(NULL);
     // The callback function is resolved as late as possible to preserve old
     // behavior.
     WeakReferenceCallback func = callback();
     if (func != NULL) {
       v8::Persistent<v8::Object> object = ToApi<v8::Object>(handle());
       {
+        // Forbid reuse of destroyed nodes as they might be already deallocated.
+        // It's fine though to reuse nodes that were destroyed in weak callback
+        // as those cannot be deallocated until we are back from the callback.
+        set_first_free(NULL);

[Mads Ager (chromium), 2009/08/19 17:32:07]

Doesn't this leak the nodes on the free list?  Shouldn't you traverse the free
list and free the nodes before you set first free to NULL?

[antonm, 2009/08/19 17:39:32]

I don't think so.  To the best of my knowledge we don't use first_free_ pointer
while cleaning up the list---destroyed nodes are spotted while traversing the
whole list (fyi, I've experimented w/ other approaches, but they buy us nothing
for DOM performance).  Does that sound reasonable?

And just an observation: DESTROYED nodes could 'leak' both before and with my
patch if you destroy node already traversed, but they should be cleaned up on
next path.

         // Leaving V8.
         VMState state(EXTERNAL);
         func(object, par);
       }
     }
   }
 
   // Place the handle address first to avoid offset computation.
   Object* object_;  // Storage for object pointer.
 
@@ skipping 206 matching lines @@
 void GlobalHandles::RemoveObjectGroups() {
   List<ObjectGroup*>* object_groups = ObjectGroups();
   for (int i = 0; i< object_groups->length(); i++) {
     delete object_groups->at(i);
   }
   object_groups->Clear();
 }
 
 
 } }  // namespace v8::internal