1 files changed, 22 insertions, 14 deletions
diff --git a/Source/JavaScriptCore/heap/HandleSet.cpp b/Source/JavaScriptCore/heap/HandleSet.cpp
index a6ccf29eb..fdb554448 100644
--- a/Source/JavaScriptCore/heap/HandleSet.cpp
+++ b/Source/JavaScriptCore/heap/HandleSet.cpp
@@ -26,24 +26,36 @@
 #include "config.h"
 #include "HandleSet.h"
 
+#include "HandleBlock.h"
+#include "HandleBlockInlines.h"
 #include "HeapRootVisitor.h"
 #include "JSObject.h"
+#include "Operations.h"
+#include <wtf/DataLog.h>
 
 namespace JSC {
 
-HandleSet::HandleSet(JSGlobalData* globalData)
-    : m_globalData(globalData)
+HandleSet::HandleSet(VM* vm)
+    : m_vm(vm)
     , m_nextToFinalize(0)
 {
     grow();
 }
 
+HandleSet::~HandleSet()
+{
+    while (!m_blockList.isEmpty())
+        m_vm->heap.blockAllocator().deallocate(HandleBlock::destroy(m_blockList.removeHead()));
+}
+
 void HandleSet::grow()
 {
-    Node* block = m_blockStack.grow();
-    for (int i = m_blockStack.blockLength - 1; i >= 0; --i) {
-        Node* node = &block[i];
-        new (NotNull, node) Node(this);
+    HandleBlock* newBlock = HandleBlock::create(m_vm->heap.blockAllocator().allocate<HandleBlock>(), this);
+    m_blockList.append(newBlock);
+
+    for (int i = newBlock->nodeCapacity() - 1; i >= 0; --i) {
+        Node* node = newBlock->nodeAtIndex(i);
+        new (NotNull, node) Node;
         m_freeList.push(node);
     }
 }
@@ -53,8 +65,7 @@ void HandleSet::visitStrongHandles(HeapRootVisitor& heapRootVisitor)
     Node* end = m_strongList.end();
     for (Node* node = m_strongList.begin(); node != end; node = node->next()) {
 #if ENABLE(GC_VALIDATION)
-        if (!isLiveNode(node))
-            CRASH();
+        RELEASE_ASSERT(isLiveNode(node));
 #endif
         heapRootVisitor.visit(node->slot());
     }
@@ -64,16 +75,14 @@ void HandleSet::writeBarrier(HandleSlot slot, const JSValue& value)
 {
     // Forbid assignment to handles during the finalization phase, since it would violate many GC invariants.
     // File a bug with stack trace if you hit this.
-    if (m_nextToFinalize)
-        CRASH();
+    RELEASE_ASSERT(!m_nextToFinalize);
 
     if (!value == !*slot && slot->isCell() == value.isCell())
         return;
 
     Node* node = toNode(slot);
 #if ENABLE(GC_VALIDATION)
-    if (!isLiveNode(node))
-        CRASH();
+    RELEASE_ASSERT(isLiveNode(node));
 #endif
     SentinelLinkedList<Node>::remove(node);
     if (!value || !value.isCell()) {
@@ -83,8 +92,7 @@ void HandleSet::writeBarrier(HandleSlot slot, const JSValue& value)
 
     m_strongList.push(node);
 #if ENABLE(GC_VALIDATION)
-    if (!isLiveNode(node))
-        CRASH();
+    RELEASE_ASSERT(isLiveNode(node));
 #endif
 }