tree 170ebf396dc000baef4ba8f5b1f639541b21f0ef
parent 34e69ba801347f69820fdb856b37823d4f5b151a
author ysuzuki@apple.com <ysuzuki@apple.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc> 1571466687 +0000
committer ysuzuki@apple.com <ysuzuki@apple.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc> 1571466687 +0000

[JSC] DFG::CommonData modification by DFG reallyAdd should be guarded by CodeBlock's lock
https://bugs.webkit.org/show_bug.cgi?id=203177

Reviewed by Mark Lam.

JSTests:

* stress/dfg-really-add-locking.js: Added.

Source/JavaScriptCore:

When doing DFG reallyAdd, DFG::JITCode is already set in CodeBlock and DFG::CommonData can be
reachable from CodeBlock. So concurrent collector can trace entries of DFG::CommonData while DFG reallyAdd
is modifying it. It would be possible that we install DFG::JITCode after performing DFG reallyAdd, but for now,
we just protect DFG reallyAdd's DFG::CommonData modification by CodeBlock's lock so that concurrent collector
does not trace them in a racy manner.

* dfg/DFGDesiredGlobalProperties.cpp:
(JSC::DFG::DesiredGlobalProperties::reallyAdd):
* dfg/DFGDesiredIdentifiers.cpp:
(JSC::DFG::DesiredIdentifiers::reallyAdd):
* dfg/DFGDesiredTransitions.cpp:
(JSC::DFG::DesiredTransition::reallyAdd):
* dfg/DFGDesiredWatchpoints.cpp:
(JSC::DFG::ArrayBufferViewWatchpointAdaptor::add):
(JSC::DFG::SymbolTableAdaptor::add):
(JSC::DFG::FunctionExecutableAdaptor::add):
(JSC::DFG::AdaptiveStructureWatchpointAdaptor::add):
* dfg/DFGDesiredWatchpoints.h:
(JSC::DFG::SetPointerAdaptor::add):
* dfg/DFGDesiredWeakReferences.cpp:
(JSC::DFG::DesiredWeakReferences::reallyAdd):

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@251321 268f45cc-cd09-0410-ab3c-d52691b4dbfc