Changeset 116575 in webkit for trunk/Source/JavaScriptCore/API/JSClassRef.cpp

Timestamp:

May 9, 2012, 4:56:05 PM (13 years ago)

Author:

[email protected]

Message:

GC race condition in OpaqueJSClass::prototype
​https://bugs.webkit.org/show_bug.cgi?id=86034

Reviewed by Filip Pizlo.

The bug here is basically:

if (weakref) weakref->method()

where a GC may occur between the if & the method call.

• API/JSClassRef.cpp:

(OpaqueJSClass::prototype):

File:

• trunk/Source/JavaScriptCore/API/JSClassRef.cpp (modified) (1 diff)

trunk/Source/JavaScriptCore/API/JSClassRef.cpp

@@ -210 +210 @@
     OpaqueJSClassContextData& jsClassData = contextData(exec);
 
-    if (!jsClassData.cachedPrototype) {
-        // Recursive, but should be good enough for our purposes
-        jsClassData.cachedPrototype = PassWeak<JSObject>(JSCallbackObject<JSNonFinalObject>::create(exec, exec->lexicalGlobalObject(), exec->lexicalGlobalObject()->callbackObjectStructure(), prototypeClass, &jsClassData), 0); // set jsClassData as the object's private data, so it can clear our reference on destruction
-        if (parentClass) {
-            if (JSObject* prototype = parentClass->prototype(exec))
-                jsClassData.cachedPrototype->setPrototype(exec->globalData(), prototype);
-        }
-    }
-    return jsClassData.cachedPrototype.get();
-}
+    if (JSObject* prototype = jsClassData.cachedPrototype.get())
+        return prototype;
+
+    // Recursive, but should be good enough for our purposes
+    prototype = JSCallbackObject<JSNonFinalObject>::create(exec, exec->lexicalGlobalObject(), exec->lexicalGlobalObject()->callbackObjectStructure(), prototypeClass, &jsClassData); // set jsClassData as the object's private data, so it can clear our reference on destruction
+    if (parentClass) {
+        if (JSObject* parentPrototype = parentClass->prototype(exec))
+            prototype->setPrototype(exec->globalData(), parentPrototype);
+    }
+
+    jsClassData.cachedPrototype = PassWeak<JSObject>(prototype, 0);
+    return prototype;
+}