Changeset 225352 in webkit

Timestamp:

Nov 30, 2017, 2:51:59 PM (8 years ago)

Author:

mark.lam@apple.com

Message:

jsc shell's flashHeapAccess() should not do JS work after releasing access to the heap.
​https://bugs.webkit.org/show_bug.cgi?id=180219
<rdar://problem/35696536>

Reviewed by Filip Pizlo.

JSTests:

• stress/regress-180219.js: Added.

Source/JavaScriptCore:

• jsc.cpp:

(functionFlashHeapAccess):

Location:

trunk

Files:

• JSTests/ChangeLog (modified) (1 diff)
• JSTests/stress/regress-180219.js (added)
• Source/JavaScriptCore/ChangeLog (modified) (1 diff)
• Source/JavaScriptCore/jsc.cpp (modified) (1 diff)

trunk/JSTests/ChangeLog ¶

@@ +1 @@
+2017-11-30  Mark Lam  <mark.lam@apple.com>
+
+        jsc shell's flashHeapAccess() should not do JS work after releasing access to the heap.
+        https://bugs.webkit.org/show_bug.cgi?id=180219
+        <rdar://problem/35696536>
+
+        Reviewed by Filip Pizlo.
+
+        * stress/regress-180219.js: Added.
+
 2017-11-30  Yusuke Suzuki  <utatane.tea@gmail.com>
 

trunk/Source/JavaScriptCore/ChangeLog ¶

@@ +1 @@
+2017-11-30  Mark Lam  <mark.lam@apple.com>
+
+        jsc shell's flashHeapAccess() should not do JS work after releasing access to the heap.
+        https://bugs.webkit.org/show_bug.cgi?id=180219
+        <rdar://problem/35696536>
+
+        Reviewed by Filip Pizlo.
+
+        * jsc.cpp:
+        (functionFlashHeapAccess):
+
 2017-11-30  Yusuke Suzuki  <utatane.tea@gmail.com>
 

trunk/Source/JavaScriptCore/jsc.cpp ¶

@@ -1721 +1721 @@
     auto scope = DECLARE_THROW_SCOPE(vm);
     
+    double sleepTimeMs = 0;
+    if (exec->argumentCount() >= 1) {
+        sleepTimeMs = exec->argument(0).toNumber(exec);
+        RETURN_IF_EXCEPTION(scope, encodedJSValue());
+    }
+
     vm.heap.releaseAccess();
-    if (exec->argumentCount() >= 1) {
-        double ms = exec->argument(0).toNumber(exec);
-        RETURN_IF_EXCEPTION(scope, encodedJSValue());
-        sleep(Seconds::fromMilliseconds(ms));
-    }
+    if (sleepTimeMs)
+        sleep(Seconds::fromMilliseconds(sleepTimeMs));
     vm.heap.acquireAccess();
     return JSValue::encode(jsUndefined());