[bmalloc] Scavenger's Mutex can be used after release.

• Component: bmalloc
• Status: NEW ---

[Basuke Suzuki]

Scavenger depends on the Mutex which is allocated by StaticPerProcess::s_mutex. While end of the process, Deallocator will call Scavenger::scavenge() if the object logs are full. At the same timing, StaticPreProcess's s_mutex can be also destructed. If the latter comes first, then Scavenger::scavenge() uses deallocated Mutex via Deallocator.

[Basuke Suzuki]

It can be solved if StaticPerProcess is replaced with PerProcess

[Basuke Suzuki]

Yusuke suggested other ideas:
- defining StaticMutex
- add [[clang::no_destroy]]

[Yusuke Suzuki]

PerProcess use probably causes RAMification regression sunce it allocates new 16KB page and libpas using platforms were not allocating that page before (but still using StaticPerProcess).

[Yusuke Suzuki]

So, probably StaticMutex is way to go, and this is correct since the issue relies on Mutex implementation (right now this problem is platform specific since Darwin and Linux are not having this issue since Mutex does not have destructors)

[Radar WebKit Bug Importer]

<rdar://problem/109221272>