Closed Bug 485988 Opened 16 years ago Closed 14 years ago

TM: Abort/bail on objects shared across threads

Categories

(Core :: JavaScript Engine, defect)

Product:
Core
Component:
JavaScript Engine
Version:
Other Branch
Type:
defect
Priority:
Not set
Severity:
normal

Tracking

()

Status:
RESOLVED WORKSFORME

People

(Reporter: jorendorff, Unassigned)

Details

Spun off from bug 419537. We take no locks on trace, so there are races when JITted code accesses objects that may also be accessed in other threads. Brendan suggested this fix: 1. Whenever we emit a shape guard, first check that the object is not MT. If it is, abort recording. (Here an "MT" object is one that has been shared.) 2. When sharing an object for the first time, give it a unique shape.
Pretty sure this bug is subsumed by ST objects, at most MT proxies bug(s). Anyone know best bug numbers? /be
Status: NEW → RESOLVED
Closed: 14 years ago
Resolution: --- → WORKSFORME
You need to log in before you can comment on or make changes to this bug.