Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: f6b9f5b24d8fe547cd5141b79ccdaa9bbf28821f
https://github.com/WebKit/WebKit/commit/f6b9f5b24d8fe547cd5141b79ccdaa9bbf28821f
Author: Yusuke Suzuki <[email protected]>
Date: 2026-09-10 (Thu, 10 Sep 2026)
Changed paths:
M Source/JavaScriptCore/runtime/JSObject.cpp
M Source/JavaScriptCore/runtime/JSObject.h
M Source/JavaScriptCore/runtime/Structure.cpp
Log Message:
-----------
[JSC] Fix dead-lock in Structure::flattenDictionaryStructure
https://bugs.webkit.org/show_bug.cgi?id=323913
rdar://187149098
Reviewed by Keith Miller.
It is extremely rare, but
1. Locker<JSCellLock> cellLocker is holding a cellLock()
2. GCSafeConcurrentJSLocker takes m_lock
3. GCSafeConcurrentJSLocker gets destroyed first
4. Deferred GC happens while we are taking a cellLock() here.
Then GC will take a cellLock and getting a dead-lock. This patch places
DeferGC to confirm that we do not do GC.
* Source/JavaScriptCore/runtime/JSObject.cpp:
(JSC::JSObject::shiftButterflyAfterFlattening):
* Source/JavaScriptCore/runtime/JSObject.h:
* Source/JavaScriptCore/runtime/Structure.cpp:
(JSC::Structure::flattenDictionaryStructure):
Canonical link: https://commits.webkit.org/320892@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
