Changeset 223116 in webkit for trunk/Source/JavaScriptCore/ChangeLog

Timestamp:

Oct 9, 2017, 7:48:39 PM (8 years ago)

Author:

[email protected]

Message:

JSCell::didBecomePrototype is racy
​https://bugs.webkit.org/show_bug.cgi?id=178110

Reviewed by Saam Barati.

The indexing type can be modified by any thread using CAS. So, we need to use atomics when
modifying it. We don't need to use atomics when reading it though (since it's just one field).

• runtime/JSCellInlines.h:

(JSC::JSCell::didBecomePrototype):

File:

• trunk/Source/JavaScriptCore/ChangeLog (modified) (1 diff)

trunk/Source/JavaScriptCore/ChangeLog

@@ +1 @@
+2017-10-09  Filip Pizlo  <[email protected]>
+
+        JSCell::didBecomePrototype is racy
+        https://bugs.webkit.org/show_bug.cgi?id=178110
+
+        Reviewed by Saam Barati.
+        
+        The indexing type can be modified by any thread using CAS. So, we need to use atomics when
+        modifying it. We don't need to use atomics when reading it though (since it's just one field).
+
+        * runtime/JSCellInlines.h:
+        (JSC::JSCell::didBecomePrototype):
+
 2017-09-29  Filip Pizlo  <[email protected]>