Title: [223116] trunk/Source/_javascript_Core
- Revision
- 223116
- Author
- [email protected]
- Date
- 2017-10-09 19:48:39 -0700 (Mon, 09 Oct 2017)
Log Message
JSCell::didBecomePrototype is racy
https://bugs.webkit.org/show_bug.cgi?id=178110
Reviewed by Saam Barati.
The indexing type can be modified by any thread using CAS. So, we need to use atomics when
modifying it. We don't need to use atomics when reading it though (since it's just one field).
* runtime/JSCellInlines.h:
(JSC::JSCell::didBecomePrototype):
Modified Paths
Diff
Modified: trunk/Source/_javascript_Core/ChangeLog (223115 => 223116)
--- trunk/Source/_javascript_Core/ChangeLog 2017-10-10 02:14:52 UTC (rev 223115)
+++ trunk/Source/_javascript_Core/ChangeLog 2017-10-10 02:48:39 UTC (rev 223116)
@@ -1,3 +1,16 @@
+2017-10-09 Filip Pizlo <[email protected]>
+
+ JSCell::didBecomePrototype is racy
+ https://bugs.webkit.org/show_bug.cgi?id=178110
+
+ Reviewed by Saam Barati.
+
+ The indexing type can be modified by any thread using CAS. So, we need to use atomics when
+ modifying it. We don't need to use atomics when reading it though (since it's just one field).
+
+ * runtime/JSCellInlines.h:
+ (JSC::JSCell::didBecomePrototype):
+
2017-09-29 Filip Pizlo <[email protected]>
Enable gigacage on iOS
Modified: trunk/Source/_javascript_Core/runtime/JSCellInlines.h (223115 => 223116)
--- trunk/Source/_javascript_Core/runtime/JSCellInlines.h 2017-10-10 02:14:52 UTC (rev 223115)
+++ trunk/Source/_javascript_Core/runtime/JSCellInlines.h 2017-10-10 02:48:39 UTC (rev 223116)
@@ -359,7 +359,9 @@
inline void JSCell::didBecomePrototype()
{
- m_indexingTypeAndMisc |= IndexingTypeMayBePrototype;
+ if (mayBePrototype())
+ return;
+ WTF::atomicExchangeOr(&m_indexingTypeAndMisc, IndexingTypeMayBePrototype);
}
inline JSObject* JSCell::toObject(ExecState* exec, JSGlobalObject* globalObject) const
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes
