CodeCache::m_capacity can becoming negative, producing undefined resu…

…lts in pruneSlowCase

https://bugs.webkit.org/show_bug.cgi?id=113453

Reviewed by Geoffrey Garen.

* runtime/CodeCache.cpp:
(JSC::CodeCacheMap::pruneSlowCase): We make sure that m_minCapacity doesn't drop below zero now.
This prevents m_capacity from doing the same.


Canonical link: https://commits.webkit.org/131758@main
git-svn-id: https://svn.webkit.org/repository/webkit/trunk@147017 268f45cc-cd09-0410-ab3c-d52691b4dbfc

Source/JavaScriptCore/ChangeLog

@@ -1,3 +1,14 @@
+2013-03-27  Mark Hahnenberg  <mhahnenberg@apple.com>
+
+        CodeCache::m_capacity can becoming negative, producing undefined results in pruneSlowCase
+        https://bugs.webkit.org/show_bug.cgi?id=113453
+
+        Reviewed by Geoffrey Garen.
+
+        * runtime/CodeCache.cpp:
+        (JSC::CodeCacheMap::pruneSlowCase): We make sure that m_minCapacity doesn't drop below zero now.
+        This prevents m_capacity from doing the same.
+
 2013-03-27  Filip Pizlo  <fpizlo@apple.com>
 
         DFG should use CheckStructure for typed array checks whenever possible

Source/JavaScriptCore/runtime/CodeCache.cpp

@@ -40,7 +40,7 @@ const double CodeCacheMap::workingSetTime = 10.0;
 
 void CodeCacheMap::pruneSlowCase()
 {
-    m_minCapacity = m_size - m_sizeAtLastPrune;
+    m_minCapacity = std::max(m_size - m_sizeAtLastPrune, 0LL);
     m_sizeAtLastPrune = m_size;
     m_timeAtLastPrune = monotonicallyIncreasingTime();