Create successful ePaper yourself
Turn your PDF publications into a flip-book with our unique Google optimized e-Paper software.
cell <strong>on</strong> <str<strong>on</strong>g>the</str<strong>on</strong>g> Heap. Because simple types do not point to <str<strong>on</strong>g>the</str<strong>on</strong>g> heap, attempting to acquire <str<strong>on</strong>g>the</str<strong>on</strong>g> Heap<br />
(via a call to Heap::heap()) for <str<strong>on</strong>g>the</str<strong>on</strong>g>se types has no meaning and will <str<strong>on</strong>g>the</str<strong>on</strong>g>refore return NULL.<br />
inline bool JSValue::isCell() c<strong>on</strong>st<br />
{<br />
return !(u.asInt64 & TagMask);<br />
}<br />
As a result, if <str<strong>on</strong>g>the</str<strong>on</strong>g> ninth value added to a MarkedArgumentBuffer is not a heap backed value,<br />
attempting to acquire <str<strong>on</strong>g>the</str<strong>on</strong>g> Heap c<strong>on</strong>text will return NULL and <str<strong>on</strong>g>the</str<strong>on</strong>g> MarkedArgumentBuffer will<br />
never be added to <str<strong>on</strong>g>the</str<strong>on</strong>g> Heap’s markListSet. This means that <str<strong>on</strong>g>the</str<strong>on</strong>g> MarkedArgumentBuffer will no<br />
l<strong>on</strong>ger serve its purpose (to protect <str<strong>on</strong>g>the</str<strong>on</strong>g> items that it c<strong>on</strong>tains from deallocati<strong>on</strong>) for any item after<br />
<str<strong>on</strong>g>the</str<strong>on</strong>g> ninth. Any reference to a heap backed property (after <str<strong>on</strong>g>the</str<strong>on</strong>g> ninth) c<strong>on</strong>tained within <str<strong>on</strong>g>the</str<strong>on</strong>g><br />
descriptors vector has <str<strong>on</strong>g>the</str<strong>on</strong>g> potential to go stale. In reality, at least <strong>on</strong>e o<str<strong>on</strong>g>the</str<strong>on</strong>g>r reference to <str<strong>on</strong>g>the</str<strong>on</strong>g>se<br />
values still exists (<str<strong>on</strong>g>the</str<strong>on</strong>g> JavaScript variable that was passed to defineProperties()). In order for <str<strong>on</strong>g>the</str<strong>on</strong>g><br />
references within <str<strong>on</strong>g>the</str<strong>on</strong>g> descriptors vector to go stale, <str<strong>on</strong>g>the</str<strong>on</strong>g>se remaining references to <str<strong>on</strong>g>the</str<strong>on</strong>g> JSValue<br />
must also be removed before garbage collecti<strong>on</strong> occurs.<br />
The call to defineOwnProperty() (within <str<strong>on</strong>g>the</str<strong>on</strong>g> sec<strong>on</strong>d loop <str<strong>on</strong>g>of</str<strong>on</strong>g> defineProperties()) may result in<br />
calling user-c<strong>on</strong>trolled methods defined <strong>on</strong> property values. As a result, <str<strong>on</strong>g>the</str<strong>on</strong>g> last marked<br />
references to a property value could be removed within this user-defined JavaScript code. If<br />
garbage collecti<strong>on</strong> can be triggered between <str<strong>on</strong>g>the</str<strong>on</strong>g> removal <str<strong>on</strong>g>of</str<strong>on</strong>g> all remaining references to a<br />
property value and <str<strong>on</strong>g>the</str<strong>on</strong>g> (now stale) value from <str<strong>on</strong>g>the</str<strong>on</strong>g> descriptors vector being defined <strong>on</strong> <str<strong>on</strong>g>the</str<strong>on</strong>g> target<br />
object, a reference to free()ed memory will be defined as a property <strong>on</strong> <str<strong>on</strong>g>the</str<strong>on</strong>g> target object.<br />
Page 6