haikuwebkit/LayoutTests/plugins/refcount-leaks.html

75 lines
1.9 KiB
HTML
Raw Permalink Normal View History

JSImmutableButterfly can't be allocated from a subspace with HeapCell::Kind::Auxiliary https://bugs.webkit.org/show_bug.cgi?id=186878 <rdar://problem/40568659> Reviewed by Filip Pizlo. Source/JavaScriptCore: This patch fixes a bug in our JSImmutableButterfly implementation uncovered by our stress GC bots. Before this patch, JSImmutableButterfly was allocated with HeapCell::Kind::Auxiliary. This is wrong. Things that are JSCells can't be allocated from HeapCell::Kind::Auxiliary. This patch adds a new HeapCell::Kind called JSCellWithInteriorPointers. It behaves like JSCell in all ways, except conservative scan knows to treat it like a butterfly in when we we may be pointing into the middle of it. The way we were crashing on the stress GC bots is that our conservative marking won't do cell visiting for things that are Auxiliary. This meant that if the stack were the only thing pointing to a JSImmutableButterfly when a GC took place, that JSImmutableButterfly would not be visited. This is now fixed. * bytecompiler/NodesCodegen.cpp: (JSC::ArrayNode::emitBytecode): * debugger/Debugger.cpp: * heap/ConservativeRoots.cpp: (JSC::ConservativeRoots::genericAddPointer): * heap/Heap.cpp: (JSC::GatherHeapSnapshotData::operator() const): (JSC::RemoveDeadHeapSnapshotNodes::operator() const): (JSC::Heap::globalObjectCount): (JSC::Heap::objectTypeCounts): (JSC::Heap::deleteAllCodeBlocks): * heap/HeapCell.cpp: (WTF::printInternal): * heap/HeapCell.h: (JSC::isJSCellKind): (JSC::hasInteriorPointers): * heap/HeapUtil.h: (JSC::HeapUtil::findGCObjectPointersForMarking): (JSC::HeapUtil::isPointerGCObjectJSCell): * heap/MarkedBlock.cpp: (JSC::MarkedBlock::Handle::didAddToDirectory): * heap/SlotVisitor.cpp: (JSC::SlotVisitor::appendJSCellOrAuxiliary): * runtime/JSGlobalObject.cpp: * runtime/JSImmutableButterfly.h: (JSC::JSImmutableButterfly::subspaceFor): * runtime/VM.cpp: (JSC::VM::VM): * runtime/VM.h: * tools/CellProfile.h: (JSC::CellProfile::CellProfile): (JSC::CellProfile::isJSCell const): * tools/HeapVerifier.cpp: (JSC::HeapVerifier::validateCell): LayoutTests: Make these test not susceptible to conservative scan leaks by ensuring at least one object gets collected when we allocate many of them. Before, these were just testing that a fixed number of objects were collected. * editing/selection/navigation-clears-editor-state-expected.txt: * editing/selection/navigation-clears-editor-state.html: * fast/dom/reference-cycle-leaks.html: * fast/misc/resources/test-observegc.js: * fast/misc/test-observegc-expected.txt: * platform/mac-wk2/plugins/refcount-leaks-expected.txt: * plugins/refcount-leaks-expected.txt: * plugins/refcount-leaks.html: Canonical link: https://commits.webkit.org/202325@main git-svn-id: https://svn.webkit.org/repository/webkit/trunk@233236 268f45cc-cd09-0410-ab3c-d52691b4dbfc
2018-06-27 01:08:25 +00:00
<head>
<script src="../resources/js-test-pre.js"></script>
</head>
<script>
JSImmutableButterfly can't be allocated from a subspace with HeapCell::Kind::Auxiliary https://bugs.webkit.org/show_bug.cgi?id=186878 <rdar://problem/40568659> Reviewed by Filip Pizlo. Source/JavaScriptCore: This patch fixes a bug in our JSImmutableButterfly implementation uncovered by our stress GC bots. Before this patch, JSImmutableButterfly was allocated with HeapCell::Kind::Auxiliary. This is wrong. Things that are JSCells can't be allocated from HeapCell::Kind::Auxiliary. This patch adds a new HeapCell::Kind called JSCellWithInteriorPointers. It behaves like JSCell in all ways, except conservative scan knows to treat it like a butterfly in when we we may be pointing into the middle of it. The way we were crashing on the stress GC bots is that our conservative marking won't do cell visiting for things that are Auxiliary. This meant that if the stack were the only thing pointing to a JSImmutableButterfly when a GC took place, that JSImmutableButterfly would not be visited. This is now fixed. * bytecompiler/NodesCodegen.cpp: (JSC::ArrayNode::emitBytecode): * debugger/Debugger.cpp: * heap/ConservativeRoots.cpp: (JSC::ConservativeRoots::genericAddPointer): * heap/Heap.cpp: (JSC::GatherHeapSnapshotData::operator() const): (JSC::RemoveDeadHeapSnapshotNodes::operator() const): (JSC::Heap::globalObjectCount): (JSC::Heap::objectTypeCounts): (JSC::Heap::deleteAllCodeBlocks): * heap/HeapCell.cpp: (WTF::printInternal): * heap/HeapCell.h: (JSC::isJSCellKind): (JSC::hasInteriorPointers): * heap/HeapUtil.h: (JSC::HeapUtil::findGCObjectPointersForMarking): (JSC::HeapUtil::isPointerGCObjectJSCell): * heap/MarkedBlock.cpp: (JSC::MarkedBlock::Handle::didAddToDirectory): * heap/SlotVisitor.cpp: (JSC::SlotVisitor::appendJSCellOrAuxiliary): * runtime/JSGlobalObject.cpp: * runtime/JSImmutableButterfly.h: (JSC::JSImmutableButterfly::subspaceFor): * runtime/VM.cpp: (JSC::VM::VM): * runtime/VM.h: * tools/CellProfile.h: (JSC::CellProfile::CellProfile): (JSC::CellProfile::isJSCell const): * tools/HeapVerifier.cpp: (JSC::HeapVerifier::validateCell): LayoutTests: Make these test not susceptible to conservative scan leaks by ensuring at least one object gets collected when we allocate many of them. Before, these were just testing that a fixed number of objects were collected. * editing/selection/navigation-clears-editor-state-expected.txt: * editing/selection/navigation-clears-editor-state.html: * fast/dom/reference-cycle-leaks.html: * fast/misc/resources/test-observegc.js: * fast/misc/test-observegc-expected.txt: * platform/mac-wk2/plugins/refcount-leaks-expected.txt: * plugins/refcount-leaks-expected.txt: * plugins/refcount-leaks.html: Canonical link: https://commits.webkit.org/202325@main git-svn-id: https://svn.webkit.org/repository/webkit/trunk@233236 268f45cc-cd09-0410-ab3c-d52691b4dbfc
2018-06-27 01:08:25 +00:00
function noop(x) {
}
JSImmutableButterfly can't be allocated from a subspace with HeapCell::Kind::Auxiliary https://bugs.webkit.org/show_bug.cgi?id=186878 <rdar://problem/40568659> Reviewed by Filip Pizlo. Source/JavaScriptCore: This patch fixes a bug in our JSImmutableButterfly implementation uncovered by our stress GC bots. Before this patch, JSImmutableButterfly was allocated with HeapCell::Kind::Auxiliary. This is wrong. Things that are JSCells can't be allocated from HeapCell::Kind::Auxiliary. This patch adds a new HeapCell::Kind called JSCellWithInteriorPointers. It behaves like JSCell in all ways, except conservative scan knows to treat it like a butterfly in when we we may be pointing into the middle of it. The way we were crashing on the stress GC bots is that our conservative marking won't do cell visiting for things that are Auxiliary. This meant that if the stack were the only thing pointing to a JSImmutableButterfly when a GC took place, that JSImmutableButterfly would not be visited. This is now fixed. * bytecompiler/NodesCodegen.cpp: (JSC::ArrayNode::emitBytecode): * debugger/Debugger.cpp: * heap/ConservativeRoots.cpp: (JSC::ConservativeRoots::genericAddPointer): * heap/Heap.cpp: (JSC::GatherHeapSnapshotData::operator() const): (JSC::RemoveDeadHeapSnapshotNodes::operator() const): (JSC::Heap::globalObjectCount): (JSC::Heap::objectTypeCounts): (JSC::Heap::deleteAllCodeBlocks): * heap/HeapCell.cpp: (WTF::printInternal): * heap/HeapCell.h: (JSC::isJSCellKind): (JSC::hasInteriorPointers): * heap/HeapUtil.h: (JSC::HeapUtil::findGCObjectPointersForMarking): (JSC::HeapUtil::isPointerGCObjectJSCell): * heap/MarkedBlock.cpp: (JSC::MarkedBlock::Handle::didAddToDirectory): * heap/SlotVisitor.cpp: (JSC::SlotVisitor::appendJSCellOrAuxiliary): * runtime/JSGlobalObject.cpp: * runtime/JSImmutableButterfly.h: (JSC::JSImmutableButterfly::subspaceFor): * runtime/VM.cpp: (JSC::VM::VM): * runtime/VM.h: * tools/CellProfile.h: (JSC::CellProfile::CellProfile): (JSC::CellProfile::isJSCell const): * tools/HeapVerifier.cpp: (JSC::HeapVerifier::validateCell): LayoutTests: Make these test not susceptible to conservative scan leaks by ensuring at least one object gets collected when we allocate many of them. Before, these were just testing that a fixed number of objects were collected. * editing/selection/navigation-clears-editor-state-expected.txt: * editing/selection/navigation-clears-editor-state.html: * fast/dom/reference-cycle-leaks.html: * fast/misc/resources/test-observegc.js: * fast/misc/test-observegc-expected.txt: * platform/mac-wk2/plugins/refcount-leaks-expected.txt: * plugins/refcount-leaks-expected.txt: * plugins/refcount-leaks.html: Canonical link: https://commits.webkit.org/202325@main git-svn-id: https://svn.webkit.org/repository/webkit/trunk@233236 268f45cc-cd09-0410-ab3c-d52691b4dbfc
2018-06-27 01:08:25 +00:00
function doGC() {
// GC twice to make sure everything is cleaned up.
for (var i = 0; i < 2; i++) {
gc();
}
JSImmutableButterfly can't be allocated from a subspace with HeapCell::Kind::Auxiliary https://bugs.webkit.org/show_bug.cgi?id=186878 <rdar://problem/40568659> Reviewed by Filip Pizlo. Source/JavaScriptCore: This patch fixes a bug in our JSImmutableButterfly implementation uncovered by our stress GC bots. Before this patch, JSImmutableButterfly was allocated with HeapCell::Kind::Auxiliary. This is wrong. Things that are JSCells can't be allocated from HeapCell::Kind::Auxiliary. This patch adds a new HeapCell::Kind called JSCellWithInteriorPointers. It behaves like JSCell in all ways, except conservative scan knows to treat it like a butterfly in when we we may be pointing into the middle of it. The way we were crashing on the stress GC bots is that our conservative marking won't do cell visiting for things that are Auxiliary. This meant that if the stack were the only thing pointing to a JSImmutableButterfly when a GC took place, that JSImmutableButterfly would not be visited. This is now fixed. * bytecompiler/NodesCodegen.cpp: (JSC::ArrayNode::emitBytecode): * debugger/Debugger.cpp: * heap/ConservativeRoots.cpp: (JSC::ConservativeRoots::genericAddPointer): * heap/Heap.cpp: (JSC::GatherHeapSnapshotData::operator() const): (JSC::RemoveDeadHeapSnapshotNodes::operator() const): (JSC::Heap::globalObjectCount): (JSC::Heap::objectTypeCounts): (JSC::Heap::deleteAllCodeBlocks): * heap/HeapCell.cpp: (WTF::printInternal): * heap/HeapCell.h: (JSC::isJSCellKind): (JSC::hasInteriorPointers): * heap/HeapUtil.h: (JSC::HeapUtil::findGCObjectPointersForMarking): (JSC::HeapUtil::isPointerGCObjectJSCell): * heap/MarkedBlock.cpp: (JSC::MarkedBlock::Handle::didAddToDirectory): * heap/SlotVisitor.cpp: (JSC::SlotVisitor::appendJSCellOrAuxiliary): * runtime/JSGlobalObject.cpp: * runtime/JSImmutableButterfly.h: (JSC::JSImmutableButterfly::subspaceFor): * runtime/VM.cpp: (JSC::VM::VM): * runtime/VM.h: * tools/CellProfile.h: (JSC::CellProfile::CellProfile): (JSC::CellProfile::isJSCell const): * tools/HeapVerifier.cpp: (JSC::HeapVerifier::validateCell): LayoutTests: Make these test not susceptible to conservative scan leaks by ensuring at least one object gets collected when we allocate many of them. Before, these were just testing that a fixed number of objects were collected. * editing/selection/navigation-clears-editor-state-expected.txt: * editing/selection/navigation-clears-editor-state.html: * fast/dom/reference-cycle-leaks.html: * fast/misc/resources/test-observegc.js: * fast/misc/test-observegc-expected.txt: * platform/mac-wk2/plugins/refcount-leaks-expected.txt: * plugins/refcount-leaks-expected.txt: * plugins/refcount-leaks.html: Canonical link: https://commits.webkit.org/202325@main git-svn-id: https://svn.webkit.org/repository/webkit/trunk@233236 268f45cc-cd09-0410-ab3c-d52691b4dbfc
2018-06-27 01:08:25 +00:00
}
var countOrig;
var countAfterCreate;
var countAfterGC;
var testObj;
var refOrig;
var refAfterGet;
var refAfterGetGC;
var refBeforePass;
var refAfterPass;
var refAfterPassAndGC;
function runtest() {
Use testRunner instead of layoutTestController in networkinformation, perf, plugins, pointer-lock, printing, scrollbars, and security tests https://bugs.webkit.org/show_bug.cgi?id=89181 Reviewed by Kent Tamura. * perf/clone-with-focus.html: * perf/nested-combined-selectors.html: * perf/table-rows-length-caching.html: * platform/chromium/plugins/call-as-function.html: * platform/chromium/plugins/get-url-with-blank-target2.html: * platform/chromium/plugins/get-url-with-iframe-target-no-crash.html: * platform/chromium/printing/custom-page-size-style-expected.txt: * platform/chromium/printing/custom-page-size-style.html: * platform/gtk/plugins/invalidate-rect-with-null-npp-argument.html: * platform/gtk/scrollbars/overflow-scrollbar-horizontal-wheel-scroll.html: * platform/mac-wk2/plugins/contents-scale-factor.html: * platform/mac-wk2/plugins/mouse-events-scaled.html: * platform/mac/plugins/bindings-array-apply-crash.html: * platform/mac/plugins/bindings-objc-long-method-name.html: * platform/mac/plugins/bindings-objc-method-name-conversion.html: * platform/mac/plugins/bindings-test-objc.html: * platform/mac/plugins/call-as-function-test.html: * platform/mac/plugins/convert-point.html: * platform/mac/plugins/disable-plugins.html: * platform/mac/plugins/jsobjc-dom-wrappers.html: * platform/mac/plugins/jsobjc-simple.html: * platform/mac/plugins/pluginDocumentView-deallocated-dataSource.html-disabled: * platform/mac/plugins/root-object-premature-delete-crash.html: * platform/mac/plugins/supports-carbon-event-model.html: * platform/mac/plugins/testplugin-onnew-onpaint.html: * platform/mac/plugins/throw-on-dealloc.html: * platform/mac/plugins/undefined-property-crash.html: * platform/mac/plugins/update-widget-from-style-recalc.html: * platform/mac/plugins/webScriptObject-exception-deadlock.html: * platform/mac/scrollbars/key-window-not-first-responder.html: * platform/qt/plugins/application-plugin-plugins-disabled.html: * platform/win/plugins/call-javascript-that-destroys-plugin.html: * platform/win/plugins/get-value-netscape-window.html: * platform/win/plugins/iframe-inside-overflow.html: * platform/win/plugins/npn-invalidate-rect-invalidates-window.html: * platform/win/plugins/visibility-hidden.html: * platform/win/plugins/window-geometry-initialized-before-set-window.html: * platform/win/plugins/window-region-is-set-to-clip-rect.html: * platform/win/plugins/windowless-paint-rect-coordinates.html: * plugins/: * pointer-lock/lock-fail-responses-expected.txt: * pointer-lock/lock-fail-responses.html: * pointer-lock/pointer-lock-api.html: * pointer-lock/pointerlockchange-pointerlockerror-events-expected.txt: * pointer-lock/pointerlockchange-pointerlockerror-events.html: * pointer-lock/pointerlocklost-event-expected.txt: * pointer-lock/pointerlocklost-event.html: * printing/compositing-layer-printing.html: * printing/css2.1/README.txt: * printing/css2.1/page-break-after-000.html: * printing/css2.1/page-break-after-001.html: * printing/css2.1/page-break-after-002.html: * printing/css2.1/page-break-after-003.html: * printing/css2.1/page-break-after-004.html: * printing/css2.1/page-break-before-000.html: * printing/css2.1/page-break-before-001.html: * printing/css2.1/page-break-before-002.html: * printing/css2.1/page-break-inside-000.html: * printing/iframe-print.html: * printing/media-queries-print.html: * printing/numberOfPages-expected.txt: * printing/page-count-layout-overflow.html: * printing/page-count-relayout-shrink.html: * printing/page-count-with-one-word.html: * printing/page-format-data-display-none.html: * printing/page-format-data-expected.txt: * printing/page-format-data.html: * printing/page-rule-css-text.html: * printing/page-rule-in-media-query.html: * printing/page-rule-selection-expected.txt: * printing/page-rule-selection.html: * printing/pageNumerForElementById-expected.txt: * printing/print-close-crash.html: * printing/pseudo-class-outside-page.html: * printing/resources/paged-media-test-utils.js: (pageNumberForElementShouldBe): (numberOfPagesShouldBe): (runPrintingTest): * printing/return-from-printing-mode.html: * printing/script-tests/numberOfPages.js: * printing/script-tests/pageNumerForElementById.js: * printing/setPrinting.html: * printing/simultaneous-position-float-change.html: * printing/single-line-must-not-be-split-into-two-pages.html: * printing/width-overflow.html: * printing/zoomed-document.html: * scrollbars/hidden-iframe-scrollbar-crash.html: * scrollbars/hidden-iframe-scrollbar-crash2.html: * scrollbars/hidden-scrollbar-prevents-layout.html: * scrollbars/overflow-custom-scrollbar-crash.html: * scrollbars/resources/hidden-iframe-scrollbar-crash2.html: * scrollbars/scroll-rtl-or-bt-layer.html: * scrollbars/scrollable-iframe-remove-crash.html: * scrollbars/scrollbar-click-does-not-blur-content.html: * scrollbars/scrollbar-crash-on-refresh.html: * scrollbars/scrollbar-drag-thumb-with-large-content.html: * scrollbars/scrollbar-gradient-crash.html: * scrollbars/scrollbar-iframe-click-does-not-blur-content.html: * scrollbars/scrollbar-initial-position.html: * scrollbars/scrollbar-middleclick-nopaste.html: * scrollbars/scrollbar-miss-mousemove-disabled.html: * scrollbars/scrollbar-miss-mousemove.html: * scrollbars/scrollbar-owning-renderer-crash.html: * scrollbars/scrollbar-part-created-with-no-parent-crash.html: * scrollbars/scrollbar-percent-padding-crash.html: * scrollbars/scrollbar-scrollbarparts-repaint-crash.html: * scrollbars/scrollevent-iframe-no-scrolling-wheel.html: * scrollbars/scrollevent-iframe-no-scrolling.html: * security/autocomplete-cleared-on-back.html: * security/block-test-no-port.html: * security/block-test.html: * security/set-form-autocomplete-attribute.html: Canonical link: https://commits.webkit.org/107031@main git-svn-id: https://svn.webkit.org/repository/webkit/trunk@120417 268f45cc-cd09-0410-ab3c-d52691b4dbfc
2012-06-15 07:38:37 +00:00
if (window.testRunner)
JSImmutableButterfly can't be allocated from a subspace with HeapCell::Kind::Auxiliary https://bugs.webkit.org/show_bug.cgi?id=186878 <rdar://problem/40568659> Reviewed by Filip Pizlo. Source/JavaScriptCore: This patch fixes a bug in our JSImmutableButterfly implementation uncovered by our stress GC bots. Before this patch, JSImmutableButterfly was allocated with HeapCell::Kind::Auxiliary. This is wrong. Things that are JSCells can't be allocated from HeapCell::Kind::Auxiliary. This patch adds a new HeapCell::Kind called JSCellWithInteriorPointers. It behaves like JSCell in all ways, except conservative scan knows to treat it like a butterfly in when we we may be pointing into the middle of it. The way we were crashing on the stress GC bots is that our conservative marking won't do cell visiting for things that are Auxiliary. This meant that if the stack were the only thing pointing to a JSImmutableButterfly when a GC took place, that JSImmutableButterfly would not be visited. This is now fixed. * bytecompiler/NodesCodegen.cpp: (JSC::ArrayNode::emitBytecode): * debugger/Debugger.cpp: * heap/ConservativeRoots.cpp: (JSC::ConservativeRoots::genericAddPointer): * heap/Heap.cpp: (JSC::GatherHeapSnapshotData::operator() const): (JSC::RemoveDeadHeapSnapshotNodes::operator() const): (JSC::Heap::globalObjectCount): (JSC::Heap::objectTypeCounts): (JSC::Heap::deleteAllCodeBlocks): * heap/HeapCell.cpp: (WTF::printInternal): * heap/HeapCell.h: (JSC::isJSCellKind): (JSC::hasInteriorPointers): * heap/HeapUtil.h: (JSC::HeapUtil::findGCObjectPointersForMarking): (JSC::HeapUtil::isPointerGCObjectJSCell): * heap/MarkedBlock.cpp: (JSC::MarkedBlock::Handle::didAddToDirectory): * heap/SlotVisitor.cpp: (JSC::SlotVisitor::appendJSCellOrAuxiliary): * runtime/JSGlobalObject.cpp: * runtime/JSImmutableButterfly.h: (JSC::JSImmutableButterfly::subspaceFor): * runtime/VM.cpp: (JSC::VM::VM): * runtime/VM.h: * tools/CellProfile.h: (JSC::CellProfile::CellProfile): (JSC::CellProfile::isJSCell const): * tools/HeapVerifier.cpp: (JSC::HeapVerifier::validateCell): LayoutTests: Make these test not susceptible to conservative scan leaks by ensuring at least one object gets collected when we allocate many of them. Before, these were just testing that a fixed number of objects were collected. * editing/selection/navigation-clears-editor-state-expected.txt: * editing/selection/navigation-clears-editor-state.html: * fast/dom/reference-cycle-leaks.html: * fast/misc/resources/test-observegc.js: * fast/misc/test-observegc-expected.txt: * platform/mac-wk2/plugins/refcount-leaks-expected.txt: * plugins/refcount-leaks-expected.txt: * plugins/refcount-leaks.html: Canonical link: https://commits.webkit.org/202325@main git-svn-id: https://svn.webkit.org/repository/webkit/trunk@233236 268f45cc-cd09-0410-ab3c-d52691b4dbfc
2018-06-27 01:08:25 +00:00
testRunner.dumpAsText();
// Test that objects are deleted after their JS references are released.
JSImmutableButterfly can't be allocated from a subspace with HeapCell::Kind::Auxiliary https://bugs.webkit.org/show_bug.cgi?id=186878 <rdar://problem/40568659> Reviewed by Filip Pizlo. Source/JavaScriptCore: This patch fixes a bug in our JSImmutableButterfly implementation uncovered by our stress GC bots. Before this patch, JSImmutableButterfly was allocated with HeapCell::Kind::Auxiliary. This is wrong. Things that are JSCells can't be allocated from HeapCell::Kind::Auxiliary. This patch adds a new HeapCell::Kind called JSCellWithInteriorPointers. It behaves like JSCell in all ways, except conservative scan knows to treat it like a butterfly in when we we may be pointing into the middle of it. The way we were crashing on the stress GC bots is that our conservative marking won't do cell visiting for things that are Auxiliary. This meant that if the stack were the only thing pointing to a JSImmutableButterfly when a GC took place, that JSImmutableButterfly would not be visited. This is now fixed. * bytecompiler/NodesCodegen.cpp: (JSC::ArrayNode::emitBytecode): * debugger/Debugger.cpp: * heap/ConservativeRoots.cpp: (JSC::ConservativeRoots::genericAddPointer): * heap/Heap.cpp: (JSC::GatherHeapSnapshotData::operator() const): (JSC::RemoveDeadHeapSnapshotNodes::operator() const): (JSC::Heap::globalObjectCount): (JSC::Heap::objectTypeCounts): (JSC::Heap::deleteAllCodeBlocks): * heap/HeapCell.cpp: (WTF::printInternal): * heap/HeapCell.h: (JSC::isJSCellKind): (JSC::hasInteriorPointers): * heap/HeapUtil.h: (JSC::HeapUtil::findGCObjectPointersForMarking): (JSC::HeapUtil::isPointerGCObjectJSCell): * heap/MarkedBlock.cpp: (JSC::MarkedBlock::Handle::didAddToDirectory): * heap/SlotVisitor.cpp: (JSC::SlotVisitor::appendJSCellOrAuxiliary): * runtime/JSGlobalObject.cpp: * runtime/JSImmutableButterfly.h: (JSC::JSImmutableButterfly::subspaceFor): * runtime/VM.cpp: (JSC::VM::VM): * runtime/VM.h: * tools/CellProfile.h: (JSC::CellProfile::CellProfile): (JSC::CellProfile::isJSCell const): * tools/HeapVerifier.cpp: (JSC::HeapVerifier::validateCell): LayoutTests: Make these test not susceptible to conservative scan leaks by ensuring at least one object gets collected when we allocate many of them. Before, these were just testing that a fixed number of objects were collected. * editing/selection/navigation-clears-editor-state-expected.txt: * editing/selection/navigation-clears-editor-state.html: * fast/dom/reference-cycle-leaks.html: * fast/misc/resources/test-observegc.js: * fast/misc/test-observegc-expected.txt: * platform/mac-wk2/plugins/refcount-leaks-expected.txt: * plugins/refcount-leaks-expected.txt: * plugins/refcount-leaks.html: Canonical link: https://commits.webkit.org/202325@main git-svn-id: https://svn.webkit.org/repository/webkit/trunk@233236 268f45cc-cd09-0410-ab3c-d52691b4dbfc
2018-06-27 01:08:25 +00:00
countOrig = plug.testObjectCount;
let x;
for (let i = 0; i < 50; ++i)
x = plug.testCreateTestObject();
countAfterCreate = plug.testObjectCount;
x = null;
doGC();
JSImmutableButterfly can't be allocated from a subspace with HeapCell::Kind::Auxiliary https://bugs.webkit.org/show_bug.cgi?id=186878 <rdar://problem/40568659> Reviewed by Filip Pizlo. Source/JavaScriptCore: This patch fixes a bug in our JSImmutableButterfly implementation uncovered by our stress GC bots. Before this patch, JSImmutableButterfly was allocated with HeapCell::Kind::Auxiliary. This is wrong. Things that are JSCells can't be allocated from HeapCell::Kind::Auxiliary. This patch adds a new HeapCell::Kind called JSCellWithInteriorPointers. It behaves like JSCell in all ways, except conservative scan knows to treat it like a butterfly in when we we may be pointing into the middle of it. The way we were crashing on the stress GC bots is that our conservative marking won't do cell visiting for things that are Auxiliary. This meant that if the stack were the only thing pointing to a JSImmutableButterfly when a GC took place, that JSImmutableButterfly would not be visited. This is now fixed. * bytecompiler/NodesCodegen.cpp: (JSC::ArrayNode::emitBytecode): * debugger/Debugger.cpp: * heap/ConservativeRoots.cpp: (JSC::ConservativeRoots::genericAddPointer): * heap/Heap.cpp: (JSC::GatherHeapSnapshotData::operator() const): (JSC::RemoveDeadHeapSnapshotNodes::operator() const): (JSC::Heap::globalObjectCount): (JSC::Heap::objectTypeCounts): (JSC::Heap::deleteAllCodeBlocks): * heap/HeapCell.cpp: (WTF::printInternal): * heap/HeapCell.h: (JSC::isJSCellKind): (JSC::hasInteriorPointers): * heap/HeapUtil.h: (JSC::HeapUtil::findGCObjectPointersForMarking): (JSC::HeapUtil::isPointerGCObjectJSCell): * heap/MarkedBlock.cpp: (JSC::MarkedBlock::Handle::didAddToDirectory): * heap/SlotVisitor.cpp: (JSC::SlotVisitor::appendJSCellOrAuxiliary): * runtime/JSGlobalObject.cpp: * runtime/JSImmutableButterfly.h: (JSC::JSImmutableButterfly::subspaceFor): * runtime/VM.cpp: (JSC::VM::VM): * runtime/VM.h: * tools/CellProfile.h: (JSC::CellProfile::CellProfile): (JSC::CellProfile::isJSCell const): * tools/HeapVerifier.cpp: (JSC::HeapVerifier::validateCell): LayoutTests: Make these test not susceptible to conservative scan leaks by ensuring at least one object gets collected when we allocate many of them. Before, these were just testing that a fixed number of objects were collected. * editing/selection/navigation-clears-editor-state-expected.txt: * editing/selection/navigation-clears-editor-state.html: * fast/dom/reference-cycle-leaks.html: * fast/misc/resources/test-observegc.js: * fast/misc/test-observegc-expected.txt: * platform/mac-wk2/plugins/refcount-leaks-expected.txt: * plugins/refcount-leaks-expected.txt: * plugins/refcount-leaks.html: Canonical link: https://commits.webkit.org/202325@main git-svn-id: https://svn.webkit.org/repository/webkit/trunk@233236 268f45cc-cd09-0410-ab3c-d52691b4dbfc
2018-06-27 01:08:25 +00:00
countAfterGC = plug.testObjectCount;
shouldBe('countAfterCreate === countOrig + 50', 'true');
shouldBe('countAfterGC < countAfterCreate', 'true');
// Test that the object refcount returns to normal after JS references
// are released.
JSImmutableButterfly can't be allocated from a subspace with HeapCell::Kind::Auxiliary https://bugs.webkit.org/show_bug.cgi?id=186878 <rdar://problem/40568659> Reviewed by Filip Pizlo. Source/JavaScriptCore: This patch fixes a bug in our JSImmutableButterfly implementation uncovered by our stress GC bots. Before this patch, JSImmutableButterfly was allocated with HeapCell::Kind::Auxiliary. This is wrong. Things that are JSCells can't be allocated from HeapCell::Kind::Auxiliary. This patch adds a new HeapCell::Kind called JSCellWithInteriorPointers. It behaves like JSCell in all ways, except conservative scan knows to treat it like a butterfly in when we we may be pointing into the middle of it. The way we were crashing on the stress GC bots is that our conservative marking won't do cell visiting for things that are Auxiliary. This meant that if the stack were the only thing pointing to a JSImmutableButterfly when a GC took place, that JSImmutableButterfly would not be visited. This is now fixed. * bytecompiler/NodesCodegen.cpp: (JSC::ArrayNode::emitBytecode): * debugger/Debugger.cpp: * heap/ConservativeRoots.cpp: (JSC::ConservativeRoots::genericAddPointer): * heap/Heap.cpp: (JSC::GatherHeapSnapshotData::operator() const): (JSC::RemoveDeadHeapSnapshotNodes::operator() const): (JSC::Heap::globalObjectCount): (JSC::Heap::objectTypeCounts): (JSC::Heap::deleteAllCodeBlocks): * heap/HeapCell.cpp: (WTF::printInternal): * heap/HeapCell.h: (JSC::isJSCellKind): (JSC::hasInteriorPointers): * heap/HeapUtil.h: (JSC::HeapUtil::findGCObjectPointersForMarking): (JSC::HeapUtil::isPointerGCObjectJSCell): * heap/MarkedBlock.cpp: (JSC::MarkedBlock::Handle::didAddToDirectory): * heap/SlotVisitor.cpp: (JSC::SlotVisitor::appendJSCellOrAuxiliary): * runtime/JSGlobalObject.cpp: * runtime/JSImmutableButterfly.h: (JSC::JSImmutableButterfly::subspaceFor): * runtime/VM.cpp: (JSC::VM::VM): * runtime/VM.h: * tools/CellProfile.h: (JSC::CellProfile::CellProfile): (JSC::CellProfile::isJSCell const): * tools/HeapVerifier.cpp: (JSC::HeapVerifier::validateCell): LayoutTests: Make these test not susceptible to conservative scan leaks by ensuring at least one object gets collected when we allocate many of them. Before, these were just testing that a fixed number of objects were collected. * editing/selection/navigation-clears-editor-state-expected.txt: * editing/selection/navigation-clears-editor-state.html: * fast/dom/reference-cycle-leaks.html: * fast/misc/resources/test-observegc.js: * fast/misc/test-observegc-expected.txt: * platform/mac-wk2/plugins/refcount-leaks-expected.txt: * plugins/refcount-leaks-expected.txt: * plugins/refcount-leaks.html: Canonical link: https://commits.webkit.org/202325@main git-svn-id: https://svn.webkit.org/repository/webkit/trunk@233236 268f45cc-cd09-0410-ab3c-d52691b4dbfc
2018-06-27 01:08:25 +00:00
testObj = plug.testObject;
refOrig = testObj.refCount;
for (let i = 0; i < 50; ++i)
plug.testObject;
refAfterGet = testObj.refCount;
doGC();
JSImmutableButterfly can't be allocated from a subspace with HeapCell::Kind::Auxiliary https://bugs.webkit.org/show_bug.cgi?id=186878 <rdar://problem/40568659> Reviewed by Filip Pizlo. Source/JavaScriptCore: This patch fixes a bug in our JSImmutableButterfly implementation uncovered by our stress GC bots. Before this patch, JSImmutableButterfly was allocated with HeapCell::Kind::Auxiliary. This is wrong. Things that are JSCells can't be allocated from HeapCell::Kind::Auxiliary. This patch adds a new HeapCell::Kind called JSCellWithInteriorPointers. It behaves like JSCell in all ways, except conservative scan knows to treat it like a butterfly in when we we may be pointing into the middle of it. The way we were crashing on the stress GC bots is that our conservative marking won't do cell visiting for things that are Auxiliary. This meant that if the stack were the only thing pointing to a JSImmutableButterfly when a GC took place, that JSImmutableButterfly would not be visited. This is now fixed. * bytecompiler/NodesCodegen.cpp: (JSC::ArrayNode::emitBytecode): * debugger/Debugger.cpp: * heap/ConservativeRoots.cpp: (JSC::ConservativeRoots::genericAddPointer): * heap/Heap.cpp: (JSC::GatherHeapSnapshotData::operator() const): (JSC::RemoveDeadHeapSnapshotNodes::operator() const): (JSC::Heap::globalObjectCount): (JSC::Heap::objectTypeCounts): (JSC::Heap::deleteAllCodeBlocks): * heap/HeapCell.cpp: (WTF::printInternal): * heap/HeapCell.h: (JSC::isJSCellKind): (JSC::hasInteriorPointers): * heap/HeapUtil.h: (JSC::HeapUtil::findGCObjectPointersForMarking): (JSC::HeapUtil::isPointerGCObjectJSCell): * heap/MarkedBlock.cpp: (JSC::MarkedBlock::Handle::didAddToDirectory): * heap/SlotVisitor.cpp: (JSC::SlotVisitor::appendJSCellOrAuxiliary): * runtime/JSGlobalObject.cpp: * runtime/JSImmutableButterfly.h: (JSC::JSImmutableButterfly::subspaceFor): * runtime/VM.cpp: (JSC::VM::VM): * runtime/VM.h: * tools/CellProfile.h: (JSC::CellProfile::CellProfile): (JSC::CellProfile::isJSCell const): * tools/HeapVerifier.cpp: (JSC::HeapVerifier::validateCell): LayoutTests: Make these test not susceptible to conservative scan leaks by ensuring at least one object gets collected when we allocate many of them. Before, these were just testing that a fixed number of objects were collected. * editing/selection/navigation-clears-editor-state-expected.txt: * editing/selection/navigation-clears-editor-state.html: * fast/dom/reference-cycle-leaks.html: * fast/misc/resources/test-observegc.js: * fast/misc/test-observegc-expected.txt: * platform/mac-wk2/plugins/refcount-leaks-expected.txt: * plugins/refcount-leaks-expected.txt: * plugins/refcount-leaks.html: Canonical link: https://commits.webkit.org/202325@main git-svn-id: https://svn.webkit.org/repository/webkit/trunk@233236 268f45cc-cd09-0410-ab3c-d52691b4dbfc
2018-06-27 01:08:25 +00:00
refAfterGetGC = testObj.refCount;
shouldBe('refAfterGet === refOrig + 50', 'true');
shouldBe('refAfterGetGC < refAfterGet', 'true');
// Test that calling NPN_Invoke with our object as a parameter returns
// our refcount to normal (may require a GC).
JSImmutableButterfly can't be allocated from a subspace with HeapCell::Kind::Auxiliary https://bugs.webkit.org/show_bug.cgi?id=186878 <rdar://problem/40568659> Reviewed by Filip Pizlo. Source/JavaScriptCore: This patch fixes a bug in our JSImmutableButterfly implementation uncovered by our stress GC bots. Before this patch, JSImmutableButterfly was allocated with HeapCell::Kind::Auxiliary. This is wrong. Things that are JSCells can't be allocated from HeapCell::Kind::Auxiliary. This patch adds a new HeapCell::Kind called JSCellWithInteriorPointers. It behaves like JSCell in all ways, except conservative scan knows to treat it like a butterfly in when we we may be pointing into the middle of it. The way we were crashing on the stress GC bots is that our conservative marking won't do cell visiting for things that are Auxiliary. This meant that if the stack were the only thing pointing to a JSImmutableButterfly when a GC took place, that JSImmutableButterfly would not be visited. This is now fixed. * bytecompiler/NodesCodegen.cpp: (JSC::ArrayNode::emitBytecode): * debugger/Debugger.cpp: * heap/ConservativeRoots.cpp: (JSC::ConservativeRoots::genericAddPointer): * heap/Heap.cpp: (JSC::GatherHeapSnapshotData::operator() const): (JSC::RemoveDeadHeapSnapshotNodes::operator() const): (JSC::Heap::globalObjectCount): (JSC::Heap::objectTypeCounts): (JSC::Heap::deleteAllCodeBlocks): * heap/HeapCell.cpp: (WTF::printInternal): * heap/HeapCell.h: (JSC::isJSCellKind): (JSC::hasInteriorPointers): * heap/HeapUtil.h: (JSC::HeapUtil::findGCObjectPointersForMarking): (JSC::HeapUtil::isPointerGCObjectJSCell): * heap/MarkedBlock.cpp: (JSC::MarkedBlock::Handle::didAddToDirectory): * heap/SlotVisitor.cpp: (JSC::SlotVisitor::appendJSCellOrAuxiliary): * runtime/JSGlobalObject.cpp: * runtime/JSImmutableButterfly.h: (JSC::JSImmutableButterfly::subspaceFor): * runtime/VM.cpp: (JSC::VM::VM): * runtime/VM.h: * tools/CellProfile.h: (JSC::CellProfile::CellProfile): (JSC::CellProfile::isJSCell const): * tools/HeapVerifier.cpp: (JSC::HeapVerifier::validateCell): LayoutTests: Make these test not susceptible to conservative scan leaks by ensuring at least one object gets collected when we allocate many of them. Before, these were just testing that a fixed number of objects were collected. * editing/selection/navigation-clears-editor-state-expected.txt: * editing/selection/navigation-clears-editor-state.html: * fast/dom/reference-cycle-leaks.html: * fast/misc/resources/test-observegc.js: * fast/misc/test-observegc-expected.txt: * platform/mac-wk2/plugins/refcount-leaks-expected.txt: * plugins/refcount-leaks-expected.txt: * plugins/refcount-leaks.html: Canonical link: https://commits.webkit.org/202325@main git-svn-id: https://svn.webkit.org/repository/webkit/trunk@233236 268f45cc-cd09-0410-ab3c-d52691b4dbfc
2018-06-27 01:08:25 +00:00
refBeforePass = testObj.refCount;
for (let i = 0; i < 50; ++i)
plug.testPassTestObject("noop", testObj);
refAfterPass = testObj.refCount;
doGC();
JSImmutableButterfly can't be allocated from a subspace with HeapCell::Kind::Auxiliary https://bugs.webkit.org/show_bug.cgi?id=186878 <rdar://problem/40568659> Reviewed by Filip Pizlo. Source/JavaScriptCore: This patch fixes a bug in our JSImmutableButterfly implementation uncovered by our stress GC bots. Before this patch, JSImmutableButterfly was allocated with HeapCell::Kind::Auxiliary. This is wrong. Things that are JSCells can't be allocated from HeapCell::Kind::Auxiliary. This patch adds a new HeapCell::Kind called JSCellWithInteriorPointers. It behaves like JSCell in all ways, except conservative scan knows to treat it like a butterfly in when we we may be pointing into the middle of it. The way we were crashing on the stress GC bots is that our conservative marking won't do cell visiting for things that are Auxiliary. This meant that if the stack were the only thing pointing to a JSImmutableButterfly when a GC took place, that JSImmutableButterfly would not be visited. This is now fixed. * bytecompiler/NodesCodegen.cpp: (JSC::ArrayNode::emitBytecode): * debugger/Debugger.cpp: * heap/ConservativeRoots.cpp: (JSC::ConservativeRoots::genericAddPointer): * heap/Heap.cpp: (JSC::GatherHeapSnapshotData::operator() const): (JSC::RemoveDeadHeapSnapshotNodes::operator() const): (JSC::Heap::globalObjectCount): (JSC::Heap::objectTypeCounts): (JSC::Heap::deleteAllCodeBlocks): * heap/HeapCell.cpp: (WTF::printInternal): * heap/HeapCell.h: (JSC::isJSCellKind): (JSC::hasInteriorPointers): * heap/HeapUtil.h: (JSC::HeapUtil::findGCObjectPointersForMarking): (JSC::HeapUtil::isPointerGCObjectJSCell): * heap/MarkedBlock.cpp: (JSC::MarkedBlock::Handle::didAddToDirectory): * heap/SlotVisitor.cpp: (JSC::SlotVisitor::appendJSCellOrAuxiliary): * runtime/JSGlobalObject.cpp: * runtime/JSImmutableButterfly.h: (JSC::JSImmutableButterfly::subspaceFor): * runtime/VM.cpp: (JSC::VM::VM): * runtime/VM.h: * tools/CellProfile.h: (JSC::CellProfile::CellProfile): (JSC::CellProfile::isJSCell const): * tools/HeapVerifier.cpp: (JSC::HeapVerifier::validateCell): LayoutTests: Make these test not susceptible to conservative scan leaks by ensuring at least one object gets collected when we allocate many of them. Before, these were just testing that a fixed number of objects were collected. * editing/selection/navigation-clears-editor-state-expected.txt: * editing/selection/navigation-clears-editor-state.html: * fast/dom/reference-cycle-leaks.html: * fast/misc/resources/test-observegc.js: * fast/misc/test-observegc-expected.txt: * platform/mac-wk2/plugins/refcount-leaks-expected.txt: * plugins/refcount-leaks-expected.txt: * plugins/refcount-leaks.html: Canonical link: https://commits.webkit.org/202325@main git-svn-id: https://svn.webkit.org/repository/webkit/trunk@233236 268f45cc-cd09-0410-ab3c-d52691b4dbfc
2018-06-27 01:08:25 +00:00
refAfterPassAndGC = testObj.refCount;
shouldBe('refAfterPass === refBeforePass + 50', 'true');
shouldBe('refAfterPassAndGC < refAfterPass', 'true');
}
</script>
<body onload="runtest()">
JSImmutableButterfly can't be allocated from a subspace with HeapCell::Kind::Auxiliary https://bugs.webkit.org/show_bug.cgi?id=186878 <rdar://problem/40568659> Reviewed by Filip Pizlo. Source/JavaScriptCore: This patch fixes a bug in our JSImmutableButterfly implementation uncovered by our stress GC bots. Before this patch, JSImmutableButterfly was allocated with HeapCell::Kind::Auxiliary. This is wrong. Things that are JSCells can't be allocated from HeapCell::Kind::Auxiliary. This patch adds a new HeapCell::Kind called JSCellWithInteriorPointers. It behaves like JSCell in all ways, except conservative scan knows to treat it like a butterfly in when we we may be pointing into the middle of it. The way we were crashing on the stress GC bots is that our conservative marking won't do cell visiting for things that are Auxiliary. This meant that if the stack were the only thing pointing to a JSImmutableButterfly when a GC took place, that JSImmutableButterfly would not be visited. This is now fixed. * bytecompiler/NodesCodegen.cpp: (JSC::ArrayNode::emitBytecode): * debugger/Debugger.cpp: * heap/ConservativeRoots.cpp: (JSC::ConservativeRoots::genericAddPointer): * heap/Heap.cpp: (JSC::GatherHeapSnapshotData::operator() const): (JSC::RemoveDeadHeapSnapshotNodes::operator() const): (JSC::Heap::globalObjectCount): (JSC::Heap::objectTypeCounts): (JSC::Heap::deleteAllCodeBlocks): * heap/HeapCell.cpp: (WTF::printInternal): * heap/HeapCell.h: (JSC::isJSCellKind): (JSC::hasInteriorPointers): * heap/HeapUtil.h: (JSC::HeapUtil::findGCObjectPointersForMarking): (JSC::HeapUtil::isPointerGCObjectJSCell): * heap/MarkedBlock.cpp: (JSC::MarkedBlock::Handle::didAddToDirectory): * heap/SlotVisitor.cpp: (JSC::SlotVisitor::appendJSCellOrAuxiliary): * runtime/JSGlobalObject.cpp: * runtime/JSImmutableButterfly.h: (JSC::JSImmutableButterfly::subspaceFor): * runtime/VM.cpp: (JSC::VM::VM): * runtime/VM.h: * tools/CellProfile.h: (JSC::CellProfile::CellProfile): (JSC::CellProfile::isJSCell const): * tools/HeapVerifier.cpp: (JSC::HeapVerifier::validateCell): LayoutTests: Make these test not susceptible to conservative scan leaks by ensuring at least one object gets collected when we allocate many of them. Before, these were just testing that a fixed number of objects were collected. * editing/selection/navigation-clears-editor-state-expected.txt: * editing/selection/navigation-clears-editor-state.html: * fast/dom/reference-cycle-leaks.html: * fast/misc/resources/test-observegc.js: * fast/misc/test-observegc-expected.txt: * platform/mac-wk2/plugins/refcount-leaks-expected.txt: * plugins/refcount-leaks-expected.txt: * plugins/refcount-leaks.html: Canonical link: https://commits.webkit.org/202325@main git-svn-id: https://svn.webkit.org/repository/webkit/trunk@233236 268f45cc-cd09-0410-ab3c-d52691b4dbfc
2018-06-27 01:08:25 +00:00
Test that we can get an NPObject returned through a method on
an NPAPI Object.<P>
JSImmutableButterfly can't be allocated from a subspace with HeapCell::Kind::Auxiliary https://bugs.webkit.org/show_bug.cgi?id=186878 <rdar://problem/40568659> Reviewed by Filip Pizlo. Source/JavaScriptCore: This patch fixes a bug in our JSImmutableButterfly implementation uncovered by our stress GC bots. Before this patch, JSImmutableButterfly was allocated with HeapCell::Kind::Auxiliary. This is wrong. Things that are JSCells can't be allocated from HeapCell::Kind::Auxiliary. This patch adds a new HeapCell::Kind called JSCellWithInteriorPointers. It behaves like JSCell in all ways, except conservative scan knows to treat it like a butterfly in when we we may be pointing into the middle of it. The way we were crashing on the stress GC bots is that our conservative marking won't do cell visiting for things that are Auxiliary. This meant that if the stack were the only thing pointing to a JSImmutableButterfly when a GC took place, that JSImmutableButterfly would not be visited. This is now fixed. * bytecompiler/NodesCodegen.cpp: (JSC::ArrayNode::emitBytecode): * debugger/Debugger.cpp: * heap/ConservativeRoots.cpp: (JSC::ConservativeRoots::genericAddPointer): * heap/Heap.cpp: (JSC::GatherHeapSnapshotData::operator() const): (JSC::RemoveDeadHeapSnapshotNodes::operator() const): (JSC::Heap::globalObjectCount): (JSC::Heap::objectTypeCounts): (JSC::Heap::deleteAllCodeBlocks): * heap/HeapCell.cpp: (WTF::printInternal): * heap/HeapCell.h: (JSC::isJSCellKind): (JSC::hasInteriorPointers): * heap/HeapUtil.h: (JSC::HeapUtil::findGCObjectPointersForMarking): (JSC::HeapUtil::isPointerGCObjectJSCell): * heap/MarkedBlock.cpp: (JSC::MarkedBlock::Handle::didAddToDirectory): * heap/SlotVisitor.cpp: (JSC::SlotVisitor::appendJSCellOrAuxiliary): * runtime/JSGlobalObject.cpp: * runtime/JSImmutableButterfly.h: (JSC::JSImmutableButterfly::subspaceFor): * runtime/VM.cpp: (JSC::VM::VM): * runtime/VM.h: * tools/CellProfile.h: (JSC::CellProfile::CellProfile): (JSC::CellProfile::isJSCell const): * tools/HeapVerifier.cpp: (JSC::HeapVerifier::validateCell): LayoutTests: Make these test not susceptible to conservative scan leaks by ensuring at least one object gets collected when we allocate many of them. Before, these were just testing that a fixed number of objects were collected. * editing/selection/navigation-clears-editor-state-expected.txt: * editing/selection/navigation-clears-editor-state.html: * fast/dom/reference-cycle-leaks.html: * fast/misc/resources/test-observegc.js: * fast/misc/test-observegc-expected.txt: * platform/mac-wk2/plugins/refcount-leaks-expected.txt: * plugins/refcount-leaks-expected.txt: * plugins/refcount-leaks.html: Canonical link: https://commits.webkit.org/202325@main git-svn-id: https://svn.webkit.org/repository/webkit/trunk@233236 268f45cc-cd09-0410-ab3c-d52691b4dbfc
2018-06-27 01:08:25 +00:00
<embed name="plug" type="application/x-webkit-test-netscape">
</body>