Bug 60672 – Protect JSC from WebCore executing JS during JS wrapper finalization

• Status: RESOLVED
• Resolution: FIXED
• Component: New Bugs

[Oliver Hunt]

Protect JSC from WebCore executing JS during JS wrapper finalization

[Oliver Hunt]

Created attachment 93228 [details]
Patch

[Darin Adler]

Comment on attachment 93228 [details]
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=93228&action=review

It’s clean to forbid this at the JavaScriptCore level, but we’d also like to change WebCore so it doesn’t have the kind of dangerous destructors that could lead to this kind of reentrancy.

> Source/JavaScriptCore/heap/Heap.h:83
> -        bool isBusy(); // true if an allocation or collection is in progress
> +        // true if an allocation or collection is in progress
> +        bool isBusy()
> +        {
> +            return m_operationInProgress != NoOperation;
> +        }

You could have put this inline at the end of the file. I often prefer that because I like the class definition to be as clean as possible.

[Oliver Hunt]

Committed r86300: <http://trac.webkit.org/changeset/86300>