Title: [120143] trunk/Source
- Revision
- 120143
- Author
- [email protected]
- Date
- 2012-06-12 17:23:49 -0700 (Tue, 12 Jun 2012)
Log Message
Dynamic hash table in DOMObjectHashTableMap is wrong in multiple threads
https://bugs.webkit.org/show_bug.cgi?id=87334
Reviewed by Geoffrey Garen.
Source/_javascript_Core:
Add a copy member function to JSC::HasTable. This function will copy all data
members except for *table* which contains thread specific data that prevents
up copying it. When you want to copy a JSC::HashTable that was constructed
on another thread you should call JSC::HashTable::copy().
* runtime/Lookup.h:
(JSC::HashTable::copy):
(HashTable):
Source/WebCore:
Adapt to JSC::HashTable::copy to avoid copy dynamic table member of a HashTable.
The dynamic table may be allocated on other thread and contains thread specific
identifiers. For example, a hash table of JSEntryArray was first initialized on a
worker thread, and then the user reloaded the page, another worker thread is
created due to reload, the dynamic allocated table in *staticTable* is specific
to the first worker thread which has died. If the user reload the page again,
the dynamic table will be freed and memory corruption will occur.
No functionalities changed, no new tests.
* bindings/js/DOMObjectHashTableMap.h:
(WebCore::DOMObjectHashTableMap::get):
Modified Paths
Diff
Modified: trunk/Source/_javascript_Core/ChangeLog (120142 => 120143)
--- trunk/Source/_javascript_Core/ChangeLog 2012-06-13 00:10:03 UTC (rev 120142)
+++ trunk/Source/_javascript_Core/ChangeLog 2012-06-13 00:23:49 UTC (rev 120143)
@@ -1,3 +1,19 @@
+2012-06-12 Leo Yang <[email protected]>
+
+ Dynamic hash table in DOMObjectHashTableMap is wrong in multiple threads
+ https://bugs.webkit.org/show_bug.cgi?id=87334
+
+ Reviewed by Geoffrey Garen.
+
+ Add a copy member function to JSC::HasTable. This function will copy all data
+ members except for *table* which contains thread specific data that prevents
+ up copying it. When you want to copy a JSC::HashTable that was constructed
+ on another thread you should call JSC::HashTable::copy().
+
+ * runtime/Lookup.h:
+ (JSC::HashTable::copy):
+ (HashTable):
+
2012-06-12 Filip Pizlo <[email protected]>
DFG should not ASSERT if you have a double use of a variable that is not revealed to be a double
Modified: trunk/Source/_javascript_Core/runtime/Lookup.h (120142 => 120143)
--- trunk/Source/_javascript_Core/runtime/Lookup.h 2012-06-13 00:10:03 UTC (rev 120142)
+++ trunk/Source/_javascript_Core/runtime/Lookup.h 2012-06-13 00:23:49 UTC (rev 120143)
@@ -114,6 +114,13 @@
const HashTableValue* values; // Fixed values generated by script.
mutable const HashEntry* table; // Table allocated at runtime.
+ ALWAYS_INLINE HashTable copy() const
+ {
+ // Don't copy dynamic table since it's thread specific.
+ HashTable result = { compactSize, compactHashSizeMask, values, 0 };
+ return result;
+ }
+
ALWAYS_INLINE void initializeIfNeeded(JSGlobalData* globalData) const
{
if (!table)
Modified: trunk/Source/WebCore/ChangeLog (120142 => 120143)
--- trunk/Source/WebCore/ChangeLog 2012-06-13 00:10:03 UTC (rev 120142)
+++ trunk/Source/WebCore/ChangeLog 2012-06-13 00:23:49 UTC (rev 120143)
@@ -1,3 +1,23 @@
+2012-06-12 Leo Yang <[email protected]>
+
+ Dynamic hash table in DOMObjectHashTableMap is wrong in multiple threads
+ https://bugs.webkit.org/show_bug.cgi?id=87334
+
+ Reviewed by Geoffrey Garen.
+
+ Adapt to JSC::HashTable::copy to avoid copy dynamic table member of a HashTable.
+ The dynamic table may be allocated on other thread and contains thread specific
+ identifiers. For example, a hash table of JSEntryArray was first initialized on a
+ worker thread, and then the user reloaded the page, another worker thread is
+ created due to reload, the dynamic allocated table in *staticTable* is specific
+ to the first worker thread which has died. If the user reload the page again,
+ the dynamic table will be freed and memory corruption will occur.
+
+ No functionalities changed, no new tests.
+
+ * bindings/js/DOMObjectHashTableMap.h:
+ (WebCore::DOMObjectHashTableMap::get):
+
2012-06-12 James Robinson <[email protected]>
[chromium] Port Canvas2DLayerBridge over to WebExternalTextureLayer
Modified: trunk/Source/WebCore/bindings/js/DOMObjectHashTableMap.h (120142 => 120143)
--- trunk/Source/WebCore/bindings/js/DOMObjectHashTableMap.h 2012-06-13 00:10:03 UTC (rev 120142)
+++ trunk/Source/WebCore/bindings/js/DOMObjectHashTableMap.h 2012-06-13 00:23:49 UTC (rev 120143)
@@ -47,7 +47,7 @@
HashMap<const JSC::HashTable*, JSC::HashTable>::iterator iter = m_map.find(staticTable);
if (iter != m_map.end())
return &iter->second;
- return &m_map.set(staticTable, JSC::HashTable(*staticTable)).iterator->second;
+ return &m_map.set(staticTable, staticTable->copy()).iterator->second;
}
private:
_______________________________________________
webkit-changes mailing list
[email protected]
http://lists.webkit.org/mailman/listinfo.cgi/webkit-changes
