Changeset 116575 in webkit

Timestamp:

May 9, 2012 4:56:05 PM (12 years ago)

Author:

barraclough@apple.com

Message:

GC race condition in OpaqueJSClass::prototype
​https://bugs.webkit.org/show_bug.cgi?id=86034

Reviewed by Filip Pizlo.

The bug here is basically:

if (weakref) weakref->method()

where a GC may occur between the if & the method call.

• API/JSClassRef.cpp:

(OpaqueJSClass::prototype):

Location:

trunk/Source/JavaScriptCore

Files:

• API/JSClassRef.cpp (modified) (1 diff)
• ChangeLog (modified) (1 diff)

trunk/Source/JavaScriptCore/API/JSClassRef.cpp

@@ -210 +210 @@
     OpaqueJSClassContextData& jsClassData = contextData(exec);
 
-    if (!jsClassData.cachedPrototype) {
-        // Recursive, but should be good enough for our purposes
-        jsClassData.cachedPrototype = PassWeak<JSObject>(JSCallbackObject<JSNonFinalObject>::create(exec, exec->lexicalGlobalObject(), exec->lexicalGlobalObject()->callbackObjectStructure(), prototypeClass, &jsClassData), 0); // set jsClassData as the object's private data, so it can clear our reference on destruction
-        if (parentClass) {
-            if (JSObject* prototype = parentClass->prototype(exec))
-                jsClassData.cachedPrototype->setPrototype(exec->globalData(), prototype);
-        }
-    }
-    return jsClassData.cachedPrototype.get();
-}
+    if (JSObject* prototype = jsClassData.cachedPrototype.get())
+        return prototype;
+
+    // Recursive, but should be good enough for our purposes
+    prototype = JSCallbackObject<JSNonFinalObject>::create(exec, exec->lexicalGlobalObject(), exec->lexicalGlobalObject()->callbackObjectStructure(), prototypeClass, &jsClassData); // set jsClassData as the object's private data, so it can clear our reference on destruction
+    if (parentClass) {
+        if (JSObject* parentPrototype = parentClass->prototype(exec))
+            prototype->setPrototype(exec->globalData(), parentPrototype);
+    }
+
+    jsClassData.cachedPrototype = PassWeak<JSObject>(prototype, 0);
+    return prototype;
+}

trunk/Source/JavaScriptCore/ChangeLog

@@ +1 @@
+2012-05-09  Gavin Barraclough  <barraclough@apple.com>
+
+        GC race condition in OpaqueJSClass::prototype
+        https://bugs.webkit.org/show_bug.cgi?id=86034
+
+        Reviewed by Filip Pizlo.
+
+        The bug here is basically:
+            if (weakref) weakref->method()
+        where a GC may occur between the if & the method call.
+
+        * API/JSClassRef.cpp:
+        (OpaqueJSClass::prototype):
+
 2012-05-09  Mark Hahnenberg  <mhahnenberg@apple.com>