Bug 90639 – JSString::tryHashConstLock() fails to get exclusive lock

• Component: JavaScriptCore
• Status: RESOLVED FIXED

[Michael Saboff]

The code in JSString::tryHashConstLock() can return true when another thread currently has the lock.

    unsigned currentFlags = m_flags;    
    unsigned newFlags = currentFlags | HashConstLock;

    if (!WTF::weakCompareAndSwap(&m_flags, currentFlags, newFlags))
        return false;

    WTF::memoryBarrierAfterLock();
    return true;

It may be the case that m_flags, and therefore currentFlags has the HashConstLock bit set, but there isn't a check for that in the code after setting currentFLags.

This can be remedied by adding:

    if (currentFlags & HashConstLock)
        return false;

after the assignment to currentFlags.

[Michael Saboff]

Created attachment 150994 [details]
Patch

[Michael Saboff]

Committed r121928: <http://trac.webkit.org/changeset/121928>