Last Comment Bug 417501 - threadsafety hazard for parallel lookup on dense arrays
: threadsafety hazard for parallel lookup on dense arrays
Status: RESOLVED FIXED
:
Product: Core
Classification: Components
Component: JavaScript Engine (show other bugs)
: Trunk
: All All
: -- normal (vote)
: ---
Assigned To: general
:
Mentors:
Depends on: 419537 487930
Blocks: native-arrays
  Show dependency treegraph
 
Reported: 2008-02-14 08:01 PST by Mike Shaver (:shaver -- probably not reading bugmail closely)
Modified: 2009-06-12 11:49 PDT (History)
6 users (show)
See Also:
Crash Signature:
(edit)
QA Whiteboard:
Iteration: ---
Points: ---
Has Regression Range: ---
Has STR: ---


Attachments

Description Mike Shaver (:shaver -- probably not reading bugmail closely) 2008-02-14 08:01:08 PST
(This bug doesn't exist on trunk until I land bug 322889, but I need a bug number assigned for a FIXME.)

array_lookupProperty uses a per-object pigeonhole (JSSLOT_ARRAY_LOOKUP_HOLDER) for storing the active property for a lookup.  If two threads race to perform a lookup, one could stomp the other right in the pigeonhole.

If a given context can only have a single lookup "in flight" at a time, then we could move the pigeonhole to the context for even greater memory savings (after we fix bug 408416, if that bug's fix doesn't obviate this entire pattern).
Comment 1 Jason Orendorff [:jorendorff] 2009-02-06 06:22:21 PST
*** Bug 419537 has been marked as a duplicate of this bug. ***
Comment 2 Brendan Eich [:brendan] 2009-06-12 11:49:17 PDT
Fixed by bug 487930.

/be

Note You need to log in before you can comment on or make changes to this bug.