Do not use weak handles for ArrayBuffers.

src/heap.cc

 // Copyright 2012 the V8 project authors. All rights reserved.
 // Redistribution and use in source and binary forms, with or without
 // modification, are permitted provided that the following conditions are
 // met:
 //
 //     * Redistributions of source code must retain the above copyright
 //       notice, this list of conditions and the following disclaimer.
 //     * Redistributions in binary form must reproduce the above
 //       copyright notice, this list of conditions and the following
 //       disclaimer in the documentation and/or other materials provided
@@ skipping 1551 matching lines @@
       }
       // Retained object is new tail.
       ASSERT(!retained->IsUndefined());
       candidate = reinterpret_cast<T*>(retained);
       tail = candidate;
 
 
       // tail is a live object, visit it.
       WeakListVisitor<T>::VisitLiveObject(
           heap, tail, retainer, record_slots);
+    } else {
+      WeakListVisitor<T>::VisitPhantomObject(heap, candidate);
     }
 
     // Move to next element in the list.
     list = WeakListVisitor<T>::WeakNext(candidate);
   }
 
   // Terminate the list if there is one or more elements.
   if (tail != NULL) {
     WeakListVisitor<T>::SetWeakNext(tail, undefined);
   }
@@ skipping 11 matching lines @@
     return function->next_function_link();
   }
 
   static int WeakNextOffset() {
     return JSFunction::kNextFunctionLinkOffset;
   }
 
   static void VisitLiveObject(Heap*, JSFunction*,
                               WeakObjectRetainer*, bool) {
   }
+
+  static void VisitPhantomObject(Heap*, JSFunction*) {
+  }
 };
 
 
 template<>
 struct WeakListVisitor<Context> {
   static void SetWeakNext(Context* context, Object* next) {
     context->set(Context::NEXT_CONTEXT_LINK,
                  next,
                  UPDATE_WRITE_BARRIER);
   }
@@ skipping 18 matching lines @@
                  UPDATE_WRITE_BARRIER);
     if (record_slots) {
       Object** optimized_functions =
           HeapObject::RawField(
               context, FixedArray::SizeFor(Context::OPTIMIZED_FUNCTIONS_LIST));
       heap->mark_compact_collector()->RecordSlot(
           optimized_functions, optimized_functions, function_list_head);
     }
   }
 
+  static void VisitPhantomObject(Heap*, Context*) {
+  }
+
   static int WeakNextOffset() {
     return FixedArray::SizeFor(Context::NEXT_CONTEXT_LINK);
   }
 };
 
 
 void Heap::ProcessWeakReferences(WeakObjectRetainer* retainer) {
   // We don't record weak slots during marking or scavenges.
   // Instead we do it once when we complete mark-compact cycle.
   // Note that write barrier has no effect if we are already in the middle of
@@ skipping 23 matching lines @@
 
   static Object* WeakNext(JSTypedArray* obj) {
     return obj->weak_next();
   }
 
   static void VisitLiveObject(Heap*,
                               JSTypedArray* obj,
                               WeakObjectRetainer* retainer,
                               bool record_slots) {}
 
+  static void VisitPhantomObject(Heap*, JSTypedArray*) {}
+
   static int WeakNextOffset() {
     return JSTypedArray::kWeakNextOffset;
   }
 };
 
 
 template<>
 struct WeakListVisitor<JSArrayBuffer> {
   static void SetWeakNext(JSArrayBuffer* obj, Object* next) {
     obj->set_weak_next(next);
@@ skipping 13 matching lines @@
             array_buffer->weak_first_array(),
             retainer, record_slots);
     array_buffer->set_weak_first_array(typed_array_obj);
     if (typed_array_obj != heap->undefined_value() && record_slots) {
       Object** slot = HeapObject::RawField(
           array_buffer, JSArrayBuffer::kWeakFirstArrayOffset);
       heap->mark_compact_collector()->RecordSlot(slot, slot, typed_array_obj);
     }
   }
 
+  static void VisitPhantomObject(Heap* heap, JSArrayBuffer* phantom) {
+    Runtime::FreeArrayBuffer(heap->isolate(), phantom);
+  }
+
   static int WeakNextOffset() {
     return JSArrayBuffer::kWeakNextOffset;
   }
 };
 
 
 void Heap::ProcessArrayBuffers(WeakObjectRetainer* retainer,
                                bool record_slots) {
   Object* array_buffer_obj =
       VisitWeakList<JSArrayBuffer>(this,
                                    array_buffers_list(),
                                    retainer, record_slots);
   set_array_buffers_list(array_buffer_obj);
 }
 

[Michael Starzinger, 2013/06/19 11:35:09]

nit: Add a second empty newline.

[Dmitry Lomov (no reviews), 2013/06/19 11:51:25]

Done.

+void Heap::TearDownArrayBuffers() {
+  Object* undefined = undefined_value();
+  for (Object* o = array_buffers_list();

[Michael Starzinger, 2013/06/19 11:35:09]

nit: Should fit into one line.

[Dmitry Lomov (no reviews), 2013/06/19 11:51:25]

Done.

+       o != undefined;) {
+    JSArrayBuffer* buffer = JSArrayBuffer::cast(o);
+    Runtime::FreeArrayBuffer(isolate(), buffer);
+    o = buffer->weak_next();
+  }

[Michael Starzinger, 2013/06/19 11:35:09]

Let's play it safe and reset array_buffers_list to undefined here.

[Dmitry Lomov (no reviews), 2013/06/19 11:51:25]

Done.

+}
+
 
 void Heap::VisitExternalResources(v8::ExternalResourceVisitor* visitor) {
   DisallowHeapAllocation no_allocation;
 
   // Both the external string table and the string table may contain
   // external strings, but neither lists them exhaustively, nor is the
   // intersection set empty.  Therefore we iterate over the external string
   // table first, ignoring internalized strings, and then over the
   // internalized string table.
 
@@ skipping 5120 matching lines @@
     PrintF("max_gc_pause=%.1f ", get_max_gc_pause());
     PrintF("total_gc_time=%.1f ", total_gc_time_ms_);
     PrintF("min_in_mutator=%.1f ", get_min_in_mutator());
     PrintF("max_alive_after_gc=%" V8_PTR_PREFIX "d ",
            get_max_alive_after_gc());
     PrintF("total_marking_time=%.1f ", marking_time());
     PrintF("total_sweeping_time=%.1f ", sweeping_time());
     PrintF("\n\n");
   }
 
+  TearDownArrayBuffers();
+
   isolate_->global_handles()->TearDown();
 
   external_string_table_.TearDown();
 
   error_object_list_.TearDown();
 
   new_space_.TearDown();
 
   if (old_pointer_space_ != NULL) {
     old_pointer_space_->TearDown();
@@ skipping 1188 matching lines @@
   if (FLAG_parallel_recompilation) {
     heap_->relocation_mutex_->Lock();
 #ifdef DEBUG
     heap_->relocation_mutex_locked_by_optimizer_thread_ =
         heap_->isolate()->optimizing_compiler_thread()->IsOptimizerThread();
 #endif  // DEBUG
   }
 }
 
 } }  // namespace v8::internal