Fixed unsafe code where a GC could occour after a Handle had been deferenced.
authorsgjesse@chromium.org <sgjesse@chromium.org@ce2b1a6d-e550-0410-aec6-3dcde31c8c00>
Mon, 6 Oct 2008 13:20:27 +0000 (13:20 +0000)
committersgjesse@chromium.org <sgjesse@chromium.org@ce2b1a6d-e550-0410-aec6-3dcde31c8c00>
Mon, 6 Oct 2008 13:20:27 +0000 (13:20 +0000)
commitc0e04e1e868635ae00f8fb26db0f23b372c06f3b
tree76da6c440af4d1fd7641b006a5518bbc012cb970
parent3840bf2c0821c859c102c98142607f29c2cd7412
Fixed unsafe code where a GC could occour after a Handle had been deferenced.

  instances->set(i, *GetScriptWrapper(script));

GetScriptWrapper can call GC. The failure have only been seen on ARM, where
the g++ compiler pulls out the object from the instances handle to a register
before calling GetScriptWrapper causing set to be called on an object which
may have moved.

Marked a test on ARM as no longer flaky, whereas two other fails consistently
but that is no longer related to the problem fixed above.

BUG=1308895
Review URL: http://codereview.chromium.org/6271

git-svn-id: http://v8.googlecode.com/svn/branches/bleeding_edge@444 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
src/runtime.cc
test/mjsunit/mjsunit.status