wine/gecko
0
0
Fork 0
mirror of https://gitlab.winehq.org/wine/wine-gecko.git synced 2024-09-13 09:24:08 -07:00
Code Issues Packages Projects Releases Wiki Activity

Bug 1157382 - Fix possible data race caused by accessing the mark bits of cells in another runtime r=terrence

Browse Source
This commit is contained in:
Jon Coppeard 2015-05-07 10:14:40 +01:00
parent 3a82a98c92
commit 4d733d5aa2
2 changed files with 11 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
js/public/HeapAPI.h
View File

@ -222,6 +222,8 @@ class JS_FRIEND_API(GCCellPtr)
return reinterpret_cast<uintptr_t>(asCell());
}
bool mayBeOwnedByOtherRuntime() const;
private:
uintptr_t checkedCast(void* p, JSGCTraceKind traceKind) {
js::gc::Cell* cell = static_cast<js::gc::Cell*>(p);
@ -365,6 +367,8 @@ GCThingIsMarkedGray(GCCellPtr thing)
{
if (js::gc::IsInsideNursery(thing.asCell()))
return false;
if (thing.mayBeOwnedByOtherRuntime())
return false;
return js::gc::detail::CellIsMarkedGray(thing.asCell());
}

7
js/src/jsgc.cpp
View File

@ -6984,6 +6984,13 @@ JS::GCCellPtr::outOfLineKind() const
return MapAllocToTraceKind(asCell()->asTenured().getAllocKind());
}
bool
JS::GCCellPtr::mayBeOwnedByOtherRuntime() const
{
return (isString() && toString()->isPermanentAtom()) ||
(isSymbol() && toSymbol()->isWellKnownSymbol());
}
#ifdef JSGC_HASH_TABLE_CHECKS
void
js::gc::CheckHashTablesAfterMovingGC(JSRuntime* rt)