Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: e1048521aef5bf2f660d0d1826450f0588d2eec2
https://github.com/WebKit/WebKit/commit/e1048521aef5bf2f660d0d1826450f0588d2eec2
Author: Yusuke Suzuki <ysuz...@apple.com>
Date: 2023-12-07 (Thu, 07 Dec 2023)
Changed paths:
M Source/JavaScriptCore/runtime/Structure.cpp
Log Message:
-----------
Race condition between JSObject::getDirectConcurrently users and
Structure::flattenDictionaryStructure
https://bugs.webkit.org/show_bug.cgi?id=265067
rdar://118548733
Reviewed by Justin Michaud and Mark Lam.
Like Array shift/unshift, flattenDictionaryStructure is the other code which
can shrink butterfly for named properties (no other code does it).
Compiler threads rely on the fact that normally named property storage never
shrunk. And we should catch this exceptional case by taking a cellLock
in the compiler thread. But flattenDictionaryStructure is not taking cellLock
correctly.
This patch computes afterOutOfLineCapacity first to detect that whether this
flattening will shrink the butterfly.
And if it is, then we take a cellLock. We do not need to take it if we do not
shrink the butterfly.
* Source/JavaScriptCore/runtime/Structure.cpp:
(JSC::Structure::flattenDictionaryStructure):
Originally-landed-as: 267815.577@safari-7617-branch (b0a755e34426).
rdar://119326607
Canonical link: https://commits.webkit.org/271696@main
_______________________________________________
webkit-changes mailing list
webkit-changes@lists.webkit.org
https://lists.webkit.org/mailman/listinfo/webkit-changes
