265469 2023-11-28 11:30:04 -0800 Race condition in ARM64 disassembler initialization 2023-11-30 10:51:59 -0800 1 1 1 Unclassified WebKit JavaScriptCore WebKit Nightly Build Unspecified Unspecified RESOLVED FIXED InRadar P2 Normal --- 1 d_degazio d_degazio webkit-bug-importer oldest_to_newest 1995365 0 d_degazio 2023-11-28 11:30:04 -0800 rdar://118890976 It's rare, but possible for two threads to initialize the ARM64 disassembler in JSC at the same time. If this happens, we run into problems in the following code: if (!opcodeTable[opcodeGroupNumber]) opcodeTable[opcodeGroupNumber] = newOpcodeGroup; else lastGroups[opcodeGroupNumber]->setNext(newOpcodeGroup); lastGroups[opcodeGroupNumber] = newOpcodeGroup; This code builds an array of linked lists of opcode groups. We can get an interleaving where: - Thread 1 hits the if statement, and sees the opcode table entry is null. - Thread 1 sets the opcode table entry to a new, non-null group. - Thread 2 hits the if statement, and sees the opcode table entry is now non-null. - Thread 2 continues to setNext on an element of lastGroups, but it's still null at this point! So we crash. To fix this, we should just protect this initialization function with a lock. 1995387 1 d_degazio 2023-11-28 13:56:33 -0800 Pull request: https://github.com/WebKit/WebKit/pull/21015 1995935 2 ews-feeder 2023-11-30 10:51:57 -0800 Committed 271350@main (48684d06eb78): <https://commits.webkit.org/271350@main> Reviewed commits have been landed. Closing PR #21015 and removing active labels.