1 files changed, 41 insertions, 7 deletions

diff --git a/Source/JavaScriptCore/dfg/DFGDesiredWeakReferences.cpp b/Source/JavaScriptCore/dfg/DFGDesiredWeakReferences.cpp
index a8376ea8a..68ff2a6c2 100644
--- a/Source/JavaScriptCore/dfg/DFGDesiredWeakReferences.cpp
+++ b/Source/JavaScriptCore/dfg/DFGDesiredWeakReferences.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2013 Apple Inc. All rights reserved.
+ * Copyright (C) 2013-2016 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -24,16 +24,21 @@
  */
 
 #include "config.h"
+#include "DFGDesiredWeakReferences.h"
 
 #if ENABLE(DFG_JIT)
 
-#include "DFGDesiredWeakReferences.h"
-
 #include "CodeBlock.h"
 #include "DFGCommonData.h"
+#include "JSCInlines.h"
 
 namespace JSC { namespace DFG {
 
+DesiredWeakReferences::DesiredWeakReferences()
+    : m_codeBlock(nullptr)
+{
+}
+
 DesiredWeakReferences::DesiredWeakReferences(CodeBlock* codeBlock)
     : m_codeBlock(codeBlock)
 {
@@ -45,17 +50,46 @@ DesiredWeakReferences::~DesiredWeakReferences()
 
 void DesiredWeakReferences::addLazily(JSCell* cell)
 {
-    m_references.append(cell);
+    if (cell)
+        m_references.add(cell);
+}
+
+void DesiredWeakReferences::addLazily(JSValue value)
+{
+    if (value.isCell())
+        addLazily(value.asCell());
+}
+
+bool DesiredWeakReferences::contains(JSCell* cell)
+{
+    return m_references.contains(cell);
 }
 
 void DesiredWeakReferences::reallyAdd(VM& vm, CommonData* common)
 {
-    for (unsigned i = 0; i < m_references.size(); i++) {
-        JSCell* target = m_references[i];
-        common->weakReferences.append(WriteBarrier<JSCell>(vm, m_codeBlock->ownerExecutable(), target));
+    for (JSCell* target : m_references) {
+        if (Structure* structure = jsDynamicCast<Structure*>(vm, target)) {
+            common->weakStructureReferences.append(
+                WriteBarrier<Structure>(vm, m_codeBlock, structure));
+        } else {
+            // There are weird relationships in how optimized CodeBlocks
+            // point to other CodeBlocks. We don't want to have them be
+            // part of the weak pointer set. For example, an optimized CodeBlock
+            // having a weak pointer to itself will cause it to get collected.
+            RELEASE_ASSERT(!jsDynamicCast<CodeBlock*>(vm, target));
+
+            common->weakReferences.append(
+                WriteBarrier<JSCell>(vm, m_codeBlock, target));
+        }
     }
 }
 
+void DesiredWeakReferences::visitChildren(SlotVisitor& visitor)
+{
+    for (JSCell* target : m_references)
+        visitor.appendUnbarriered(target);
+}
+
 } } // namespace JSC::DFG
 
 #endif // ENABLE(DFG_JIT)