Title: [218552] trunk/Source/_javascript_Core
- Revision
- 218552
- Author
- [email protected]
- Date
- 2017-06-20 00:15:19 -0700 (Tue, 20 Jun 2017)
Log Message
repatchIn needs to lock the CodeBlock's lock
https://bugs.webkit.org/show_bug.cgi?id=173573
Reviewed by Yusuke Suzuki.
CodeBlock::propagateTransitions and CodeBlock::visitWeakly grab the CodeBlock's
lock before modifying the StructureStubInfo/PolymorphicAccess. When regenerating
an IC, we must hold the CodeBlock's to prevent the executing thread from racing
with the marking thread. repatchIn was not grabbing the lock. I haven't been
able to get it to crash, but this is needed for the same reasons that get and put IC
regeneration grab the lock.
* jit/Repatch.cpp:
(JSC::repatchIn):
Modified Paths
Diff
Modified: trunk/Source/_javascript_Core/ChangeLog (218551 => 218552)
--- trunk/Source/_javascript_Core/ChangeLog 2017-06-20 07:11:10 UTC (rev 218551)
+++ trunk/Source/_javascript_Core/ChangeLog 2017-06-20 07:15:19 UTC (rev 218552)
@@ -1,3 +1,20 @@
+2017-06-20 Saam Barati <[email protected]>
+
+ repatchIn needs to lock the CodeBlock's lock
+ https://bugs.webkit.org/show_bug.cgi?id=173573
+
+ Reviewed by Yusuke Suzuki.
+
+ CodeBlock::propagateTransitions and CodeBlock::visitWeakly grab the CodeBlock's
+ lock before modifying the StructureStubInfo/PolymorphicAccess. When regenerating
+ an IC, we must hold the CodeBlock's to prevent the executing thread from racing
+ with the marking thread. repatchIn was not grabbing the lock. I haven't been
+ able to get it to crash, but this is needed for the same reasons that get and put IC
+ regeneration grab the lock.
+
+ * jit/Repatch.cpp:
+ (JSC::repatchIn):
+
2017-06-19 Devin Rousso <[email protected]>
Web Inspector: create canvas content view and details sidebar panel
Modified: trunk/Source/_javascript_Core/jit/Repatch.cpp (218551 => 218552)
--- trunk/Source/_javascript_Core/jit/Repatch.cpp 2017-06-20 07:11:10 UTC (rev 218551)
+++ trunk/Source/_javascript_Core/jit/Repatch.cpp 2017-06-20 07:15:19 UTC (rev 218552)
@@ -555,6 +555,7 @@
const PropertySlot& slot, StructureStubInfo& stubInfo)
{
SuperSamplerScope superSamplerScope(false);
+ GCSafeConcurrentJSLocker locker(exec->codeBlock()->m_lock, exec->vm().heap);
if (tryRepatchIn(exec, base, ident, wasFound, slot, stubInfo) == GiveUpOnCache)
ftlThunkAwareRepatchCall(exec->codeBlock(), stubInfo.slowPathCallLocation(), operationIn);
}
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes
