Changeset 222398 in webkit for trunk/Source/JavaScriptCore

Timestamp:

Sep 22, 2017, 12:18:33 PM (8 years ago)

Author:

[email protected]

Message:

Usage of ErrorInstance::m_stackTrace on the mutator is racy with the collector
​https://bugs.webkit.org/show_bug.cgi?id=177368

Reviewed by Keith Miller.

• runtime/ErrorInstance.cpp:

(JSC::ErrorInstance::finishCreation):
(JSC::ErrorInstance::materializeErrorInfoIfNeeded):
(JSC::ErrorInstance::visitChildren):

Location:

trunk/Source/JavaScriptCore

Files:

• ChangeLog (modified) (1 diff)
• runtime/ErrorInstance.cpp (modified) (3 diffs)

trunk/Source/JavaScriptCore/ChangeLog

@@ +1 @@
+2017-09-22  Saam Barati  <[email protected]>
+
+        Usage of ErrorInstance::m_stackTrace on the mutator is racy with the collector
+        https://bugs.webkit.org/show_bug.cgi?id=177368
+
+        Reviewed by Keith Miller.
+
+        * runtime/ErrorInstance.cpp:
+        (JSC::ErrorInstance::finishCreation):
+        (JSC::ErrorInstance::materializeErrorInfoIfNeeded):
+        (JSC::ErrorInstance::visitChildren):
+
 2017-09-22  Yusuke Suzuki  <[email protected]>
 

trunk/Source/JavaScriptCore/runtime/ErrorInstance.cpp

@@ -116 +116 @@
         putDirect(vm, vm.propertyNames->message, jsString(&vm, message), DontEnum);
 
-    m_stackTrace = getStackTrace(exec, vm, this, useCurrentFrame);
+    std::unique_ptr<Vector<StackFrame>> stackTrace = getStackTrace(exec, vm, this, useCurrentFrame);
+    {
+        auto locker = holdLock(*this);
+        m_stackTrace = WTFMove(stackTrace);
+    }
+    vm.heap.writeBarrier(this);
+
     if (m_stackTrace && !m_stackTrace->isEmpty() && hasSourceAppender()) {
         unsigned bytecodeOffset;
@@ -203 +209 @@
     
     addErrorInfo(vm, m_stackTrace.get(), this);
-    m_stackTrace = nullptr;
+    {
+        auto locker = holdLock(*this);
+        m_stackTrace = nullptr;
+    }
     
     m_errorInfoMaterialized = true;
@@ -223 +232 @@
     Base::visitChildren(thisObject, visitor);
 
-    if (thisObject->m_stackTrace) {
-        for (StackFrame& frame : *thisObject->m_stackTrace)
-            frame.visitChildren(visitor);
+    {
+        auto locker = holdLock(*thisObject);
+        if (thisObject->m_stackTrace) {
+            for (StackFrame& frame : *thisObject->m_stackTrace)
+                frame.visitChildren(visitor);
+        }
     }
 }