Changeset 219114 in webkit
- Timestamp:
- Jul 3, 2017 10:18:15 PM (7 years ago)
- Location:
- trunk
- Files:
-
- 7 edited
Legend:
- Unmodified
- Added
- Removed
-
trunk/LayoutTests/ChangeLog
r219107 r219114 1 2017-07-03 Saam Barati <sbarati@apple.com> 2 3 LayoutTest workers/bomb.html is a Crash 4 https://bugs.webkit.org/show_bug.cgi?id=167757 5 <rdar://problem/33086462> 6 7 Reviewed by Keith Miller. 8 9 * platform/mac-wk2/TestExpectations: 10 1 11 2017-07-03 Matt Lewis <jlewis3@apple.com> 2 12 -
trunk/LayoutTests/platform/mac-wk2/TestExpectations
r219107 r219114 707 707 webkit.org/b/173608 webrtc/video-replace-muted-track.html [ Pass Failure ] 708 708 709 webkit.org/b/167757 workers/bomb.html [ Skip]710 709 webkit.org/b/167757 workers/bomb.html [ Pass Timeout ] 710 -
trunk/Source/JavaScriptCore/ChangeLog
r219111 r219114 1 2017-07-03 Saam Barati <sbarati@apple.com> 2 3 LayoutTest workers/bomb.html is a Crash 4 https://bugs.webkit.org/show_bug.cgi?id=167757 5 <rdar://problem/33086462> 6 7 Reviewed by Keith Miller. 8 9 VMTraps::SignalSender was accessing VM fields even after 10 the VM was destroyed. This happened when the SignalSender 11 thread was in the middle of its work() function while VMTraps 12 was notified that the VM was shutting down. The VM would proceed 13 to run its destructor even after the SignalSender thread finished 14 doing its work. This means that the SignalSender thread was accessing 15 VM field eve after VM was destructed (including itself, since it is 16 transitively owned by the VM). The VM must wait for the SignalSender 17 thread to shutdown before it can continue to destruct itself. 18 19 * runtime/VMTraps.cpp: 20 (JSC::VMTraps::willDestroyVM): 21 1 22 2017-07-03 Saam Barati <sbarati@apple.com> 2 23 -
trunk/Source/JavaScriptCore/runtime/VMTraps.cpp
r219105 r219114 255 255 WorkResult work() override 256 256 { 257 258 // We need a nested scope so that we'll release the lock before we sleep below.259 257 VM& vm = m_vm; 260 258 … … 292 290 } 293 291 294 sleepMS(1); 292 { 293 auto locker = holdLock(*traps().m_lock); 294 if (traps().m_isShuttingDown) 295 return WorkResult::Stop; 296 traps().m_trapSet->waitFor(*traps().m_lock, 1_ms); 297 } 295 298 return WorkResult::Continue; 296 299 } … … 306 309 { 307 310 m_isShuttingDown = true; 308 WTF::storeStoreFence();309 311 #if ENABLE(SIGNAL_BASED_VM_TRAPS) 310 312 if (m_signalSender) { … … 314 316 m_trapSet->notifyAll(locker); 315 317 } 316 if (!ASSERT_DISABLED) 317 m_signalSender->join(); 318 m_signalSender->join(); 318 319 m_signalSender = nullptr; 319 320 } -
trunk/Source/WTF/ChangeLog
r219105 r219114 1 2017-07-03 Saam Barati <sbarati@apple.com> 2 3 LayoutTest workers/bomb.html is a Crash 4 https://bugs.webkit.org/show_bug.cgi?id=167757 5 <rdar://problem/33086462> 6 7 Reviewed by Keith Miller. 8 9 * wtf/AutomaticThread.cpp: 10 (WTF::AutomaticThreadCondition::waitFor): 11 * wtf/AutomaticThread.h: 12 1 13 2017-07-03 Commit Queue <commit-queue@webkit.org> 2 14 -
trunk/Source/WTF/wtf/AutomaticThread.cpp
r217055 r219114 80 80 { 81 81 m_condition.wait(lock); 82 } 83 84 bool AutomaticThreadCondition::waitFor(Lock& lock, Seconds time) 85 { 86 return m_condition.waitFor(lock, time); 82 87 } 83 88 -
trunk/Source/WTF/wtf/AutomaticThread.h
r218872 r219114 83 83 // its partner. 84 84 WTF_EXPORT_PRIVATE void wait(Lock&); 85 WTF_EXPORT_PRIVATE bool waitFor(Lock&, Seconds); 85 86 86 87 private:
Note: See TracChangeset
for help on using the changeset viewer.