142651 - jsstr.c's dollarStr static is just plain wrong

Status: VERIFIED FIXED

(Core :: JavaScript Engine, defect)

Description

[Brendan Eich [:brendan]]

Two threads racing through interpret_dollar and its caller do_replace could end
up both using the same pointer, but only one use would be valid.  The other use
could even dangle, given unlikely but bad thread scheduling.

This is a fix-for-1.0 candidate.

/be

Comment 1

[Brendan Eich [:brendan]]

Attachment: proposed fix

You cc: listers can r= and sr= fast, I bet.

Phil, can you test and vouch for this patch?  Thanks.

/be

Comment 2

[Mike Shaver (:shaver emeritus)]

Comment on attachment 82556 [details] [diff] [review]
proposed fix

Threadsafety.  It's what's for dinner.

sr=shaver.

Comment 3

[Phil Schwartau]

The patch passes the JS testsuite in the debug JS shell on WinNT, Linux.
Am now testing it in the optimized shell...

Comment 4

[Phil Schwartau]

The patch passes the JS testsuite in the optimized JS shell, as well -

Comment 5

[John Bandhauer]

Comment on attachment 82556 [details] [diff] [review]
proposed fix

r=jband

Comment 6

[Asa Dotzler [:asa]]

Comment on attachment 82556 [details] [diff] [review]
proposed fix

a=asa (on behalf of drivers) for checkin to the 1.0 branch

Comment 7

[Brendan Eich [:brendan]]

Fixed in the 1.0 branch as well as the trunk.

/be

Comment 8

[Phil Schwartau]

Patch verified on 1.0 branch as well as on trunk;
adding fixed1.0.0 and verified1.0.0 keywords -