Changeset 214509 in webkit

Timestamp:

Mar 28, 2017 5:43:09 PM (7 years ago)

Author:

mark.lam@apple.com

Message:

The Mutator should not be able to steal the conn if the Collector hasn't reached the NotRunning phase yet.
​https://bugs.webkit.org/show_bug.cgi?id=170213
<rdar://problem/30755345>

Reviewed by Filip Pizlo.

The current condition for stealing the conn isn't tight enough. Restricting the
stealing to when m_currentPhase == NotRunning ensures that the Collector is
really done running.

No test because this issue only manifests with a race condition that is difficult
to reproduce on demand.

• heap/Heap.cpp:

(JSC::Heap::requestCollection):

Location:

trunk/Source/JavaScriptCore

Files:

• ChangeLog (modified) (1 diff)
• heap/Heap.cpp (modified) (1 diff)

trunk/Source/JavaScriptCore/ChangeLog

@@ +1 @@
+2017-03-28  Mark Lam  <mark.lam@apple.com>
+
+        The Mutator should not be able to steal the conn if the Collector hasn't reached the NotRunning phase yet.
+        https://bugs.webkit.org/show_bug.cgi?id=170213
+        <rdar://problem/30755345>
+
+        Reviewed by Filip Pizlo.
+
+        The current condition for stealing the conn isn't tight enough.  Restricting the
+        stealing to when m_currentPhase == NotRunning ensures that the Collector is
+        really done running.
+
+        No test because this issue only manifests with a race condition that is difficult
+        to reproduce on demand.
+
+        * heap/Heap.cpp:
+        (JSC::Heap::requestCollection):
+
 2017-03-28  Keith Miller  <keith_miller@apple.com>
 

trunk/Source/JavaScriptCore/heap/Heap.cpp

@@ -1962 +1962 @@
     // cases.
     ASSERT(m_lastServedTicket <= m_lastGrantedTicket);
-    if (m_lastServedTicket == m_lastGrantedTicket) {
+    if ((m_lastServedTicket == m_lastGrantedTicket) && (m_currentPhase == CollectorPhase::NotRunning)) {
         if (false)
             dataLog("Taking the conn.\n");