Title: [153139] trunk/Source/_javascript_Core
- Revision
- 153139
- Author
- oli...@apple.com
- Date
- 2013-07-24 20:59:20 -0700 (Wed, 24 Jul 2013)
Log Message
fourthTier: Structure::getConcurrently() may be called from for uncacheable dictionaries, and this is safe
https://bugs.webkit.org/show_bug.cgi?id=115464
Reviewed by Oliver Hunt and Geoffrey Garen.
This can happen for example transitively from JSObject::put(). getCurrently() does
work for uncacheable dictionaries; it just has the obvious race that right after it
returns, the result it returned may no longer be right. This isn't an issue if it was
called on the main thread, and may not be an issue in some other situations.
So, we should just remove the assertion, since the only thing it buys us is crashes.
* runtime/Structure.cpp:
(JSC::Structure::getConcurrently):
Modified Paths
Diff
Modified: trunk/Source/_javascript_Core/ChangeLog (153138 => 153139)
--- trunk/Source/_javascript_Core/ChangeLog 2013-07-25 03:59:19 UTC (rev 153138)
+++ trunk/Source/_javascript_Core/ChangeLog 2013-07-25 03:59:20 UTC (rev 153139)
@@ -1,5 +1,22 @@
2013-04-30 Filip Pizlo <fpi...@apple.com>
+ fourthTier: Structure::getConcurrently() may be called from for uncacheable dictionaries, and this is safe
+ https://bugs.webkit.org/show_bug.cgi?id=115464
+
+ Reviewed by Oliver Hunt and Geoffrey Garen.
+
+ This can happen for example transitively from JSObject::put(). getCurrently() does
+ work for uncacheable dictionaries; it just has the obvious race that right after it
+ returns, the result it returned may no longer be right. This isn't an issue if it was
+ called on the main thread, and may not be an issue in some other situations.
+
+ So, we should just remove the assertion, since the only thing it buys us is crashes.
+
+ * runtime/Structure.cpp:
+ (JSC::Structure::getConcurrently):
+
+2013-04-30 Filip Pizlo <fpi...@apple.com>
+
fourthTier: Don't link gtest into _javascript_Core
Rubber stamped by Mark Rowe.
Modified: trunk/Source/_javascript_Core/runtime/Structure.cpp (153138 => 153139)
--- trunk/Source/_javascript_Core/runtime/Structure.cpp 2013-07-25 03:59:19 UTC (rev 153138)
+++ trunk/Source/_javascript_Core/runtime/Structure.cpp 2013-07-25 03:59:20 UTC (rev 153139)
@@ -773,10 +773,6 @@
PropertyOffset Structure::getConcurrently(VM&, PropertyName propertyName, unsigned& attributes, JSCell*& specificValue)
{
- // We can't handle uncacheable dictionaries because we can't handle concurrent remove's
- // from the property maps.
- RELEASE_ASSERT(!isUncacheableDictionary());
-
Vector<Structure*, 8> structures;
Structure* structure;
PropertyTable* table;
_______________________________________________
webkit-changes mailing list
webkit-changes@lists.webkit.org
https://lists.webkit.org/mailman/listinfo/webkit-changes
