Title: [211066] trunk/Source/_javascript_Core
- Revision
- 211066
- Author
- [email protected]
- Date
- 2017-01-23 15:22:27 -0800 (Mon, 23 Jan 2017)
Log Message
Added a comment to clarify an assertion.
Rubber-stamped by Filip Pizlo.
* runtime/JSCellInlines.h:
(JSC::JSCell::classInfo):
Modified Paths
Diff
Modified: trunk/Source/_javascript_Core/ChangeLog (211065 => 211066)
--- trunk/Source/_javascript_Core/ChangeLog 2017-01-23 23:13:41 UTC (rev 211065)
+++ trunk/Source/_javascript_Core/ChangeLog 2017-01-23 23:22:27 UTC (rev 211066)
@@ -1,3 +1,12 @@
+2017-01-23 Mark Lam <[email protected]>
+
+ Added a comment to clarify an assertion.
+
+ Rubber-stamped by Filip Pizlo.
+
+ * runtime/JSCellInlines.h:
+ (JSC::JSCell::classInfo):
+
2017-01-23 Filip Pizlo <[email protected]>
SharedArrayBuffer plus WebGL should not equal CRASH
Modified: trunk/Source/_javascript_Core/runtime/JSCellInlines.h (211065 => 211066)
--- trunk/Source/_javascript_Core/runtime/JSCellInlines.h 2017-01-23 23:13:41 UTC (rev 211065)
+++ trunk/Source/_javascript_Core/runtime/JSCellInlines.h 2017-01-23 23:22:27 UTC (rev 211066)
@@ -284,6 +284,12 @@
vm = largeAllocation().vm();
else
vm = markedBlock().vm();
+
+ // What we really want to assert here is that we're not currently destructing this object (which makes its classInfo
+ // invalid). If mutatorState() == MutatorState::Running, then we're not currently sweeping, and therefore cannot be
+ // destructing the object. The GC thread or JIT threads, unlike the mutator thread, are able to access classInfo
+ // independent of whether the mutator thread is sweeping or not. Hence, we also check for ownerThread() !=
+ // std::this_thread::get_id() to allow the GC thread or JIT threads to pass this assertion.
ASSERT(vm->heap.mutatorState() == MutatorState::Running || vm->apiLock().ownerThread() != std::this_thread::get_id());
return structure(*vm)->classInfo();
}
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes