Changeset 228488 in webkit for trunk/Source/JavaScriptCore/jsc.cpp

Timestamp:

Feb 14, 2018, 3:25:52 PM (7 years ago)

Author:

[email protected]

Message:

Setting a VMTrap shouldn't look at topCallFrame since that may imply we're in C code and holding the malloc lock
​https://bugs.webkit.org/show_bug.cgi?id=182801

Reviewed by Keith Miller.

JSTests:

• stress/watchdog-dont-malloc-when-in-c-code.js: Added.

Source/JavaScriptCore:

VMTraps would sometimes install traps when it paused the JS thread when it
was in C code. This is wrong, as installing traps mallocs, and the JS thread
may have been holding the malloc lock while in C code. This could lead to a
deadlock when C code was holding the malloc lock.

This patch makes it so that we only install traps when we've proven the PC
is in JIT or LLInt code. If we're in JIT/LLInt code, we are guaranteed that
we're not holding the malloc lock.

• jsc.cpp:

(GlobalObject::finishCreation):
(functionMallocInALoop):

• runtime/VMTraps.cpp:

(JSC::VMTraps::tryInstallTrapBreakpoints):

File:

• trunk/Source/JavaScriptCore/jsc.cpp (modified) (3 diffs)

trunk/Source/JavaScriptCore/jsc.cpp

@@ -343 +343 @@
 static EncodedJSValue JSC_HOST_CALL functionFlashHeapAccess(ExecState*);
 static EncodedJSValue JSC_HOST_CALL functionDisableRichSourceInfo(ExecState*);
+static EncodedJSValue JSC_HOST_CALL functionMallocInALoop(ExecState*);
 
 struct Script {
@@ -600 +601 @@
 
         addFunction(vm, "disableRichSourceInfo", functionDisableRichSourceInfo, 0);
+        addFunction(vm, "mallocInALoop", functionMallocInALoop, 0);
     }
     
@@ -1749 +1751 @@
 }
 
+EncodedJSValue JSC_HOST_CALL functionMallocInALoop(ExecState*)
+{
+    Vector<void*> ptrs;
+    for (unsigned i = 0; i < 5000; ++i)
+        ptrs.append(fastMalloc(1024 * 2));
+    for (void* ptr : ptrs)
+        fastFree(ptr);
+    return JSValue::encode(jsUndefined());
+}
+
 template<typename ValueType>
 typename std::enable_if<!std::is_fundamental<ValueType>::value>::type addOption(VM&, JSObject*, Identifier, ValueType) { }