rdar://118890976 It's rare, but possible for two threads to initialize the ARM64 disassembler in JSC at the same time. If this happens, we run into problems in the following code: if (!opcodeTable[opcodeGroupNumber]) opcodeTable[opcodeGroupNumber] = newOpcodeGroup; else lastGroups[opcodeGroupNumber]->setNext(newOpcodeGroup); lastGroups[opcodeGroupNumber] = newOpcodeGroup; This code builds an array of linked lists of opcode groups. We can get an interleaving where: - Thread 1 hits the if statement, and sees the opcode table entry is null. - Thread 1 sets the opcode table entry to a new, non-null group. - Thread 2 hits the if statement, and sees the opcode table entry is now non-null. - Thread 2 continues to setNext on an element of lastGroups, but it's still null at this point! So we crash. To fix this, we should just protect this initialization function with a lock.
Pull request: https://github.com/WebKit/WebKit/pull/21015
Committed 271350@main (48684d06eb78): <https://commits.webkit.org/271350@main> Reviewed commits have been landed. Closing PR #21015 and removing active labels.