Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Cherry-pick b0a755e. https://bugs.webkit.org/show_bug.cgi?id=265067
Race condition between JSObject::getDirectConcurrently users and Structure::flattenDictionaryStructure https://bugs.webkit.org/show_bug.cgi?id=265067 rdar://118548733 Reviewed by Justin Michaud and Mark Lam. Like Array shift/unshift, flattenDictionaryStructure is the other code which can shrink butterfly for named properties (no other code does it). Compiler threads rely on the fact that normally named property storage never shrunk. And we should catch this exceptional case by taking a cellLock in the compiler thread. But flattenDictionaryStructure is not taking cellLock correctly. This patch computes afterOutOfLineCapacity first to detect that whether this flattening will shrink the butterfly. And if it is, then we take a cellLock. We do not need to take it if we do not shrink the butterfly. * Source/JavaScriptCore/runtime/Structure.cpp: (JSC::Structure::flattenDictionaryStructure): Canonical link: https://commits.webkit.org/267815.577@safari-7617-branch Canonical link: https://commits.webkit.org/265870.632@safari-7616.2.9.10-branch
- Loading branch information