The code in JSString::tryHashConstLock() can return true when another thread currently has the lock.
unsigned currentFlags = m_flags;
unsigned newFlags = currentFlags | HashConstLock;
if (!WTF::weakCompareAndSwap(&m_flags, currentFlags, newFlags))
It may be the case that m_flags, and therefore currentFlags has the HashConstLock bit set, but there isn't a check for that in the code after setting currentFLags.
This can be remedied by adding:
if (currentFlags & HashConstLock)
after the assignment to currentFlags.
Created attachment 150994 [details]
Committed r121928: <http://trac.webkit.org/changeset/121928>