Summary: | Protect JSC from WebCore executing JS during JS wrapper finalization | ||||||
---|---|---|---|---|---|---|---|
Product: | WebKit | Reporter: | Oliver Hunt <oliver> | ||||
Component: | New Bugs | Assignee: | Oliver Hunt <oliver> | ||||
Status: | RESOLVED FIXED | ||||||
Severity: | Normal | ||||||
Priority: | P2 | ||||||
Version: | 528+ (Nightly build) | ||||||
Hardware: | Unspecified | ||||||
OS: | Unspecified | ||||||
Attachments: |
|
Description
Oliver Hunt
2011-05-11 15:52:44 PDT
Created attachment 93228 [details]
Patch
Comment on attachment 93228 [details] Patch View in context: https://bugs.webkit.org/attachment.cgi?id=93228&action=review It’s clean to forbid this at the JavaScriptCore level, but we’d also like to change WebCore so it doesn’t have the kind of dangerous destructors that could lead to this kind of reentrancy. > Source/JavaScriptCore/heap/Heap.h:83 > - bool isBusy(); // true if an allocation or collection is in progress > + // true if an allocation or collection is in progress > + bool isBusy() > + { > + return m_operationInProgress != NoOperation; > + } You could have put this inline at the end of the file. I often prefer that because I like the class definition to be as clean as possible. Committed r86300: <http://trac.webkit.org/changeset/86300> |