Closed
Bug 547274
Opened 14 years ago
Closed 14 years ago
js_InitArrayClass is not thread-safe
Categories
(Core :: JavaScript Engine, defect)
Tracking
()
RESOLVED
FIXED
People
(Reporter: jorendorff, Assigned: jorendorff)
Details
(Whiteboard: fixed-in-tracemonkey)
Attachments
(1 file)
|
3.68 KB,
patch
|
brendan
:
review+
|
Details | Diff | Splinter Review |
Found by helgrind.
JSObject *
js_InitArrayClass(JSContext *cx, JSObject *obj)
{
JSObject *proto;
/* Initialize the ops structure used by slow arrays */
memcpy(&js_SlowArrayObjectOps, &js_ObjectOps, sizeof(JSObjectOps));
js_SlowArrayObjectOps.enumerate = slowarray_enumerate;
js_SlowArrayObjectOps.call = NULL;
But this code runs every time a new context is populated. Oops.
The most obvious thing is just to initialize that statically. Patch coming.
|
Assignee | |
Comment 1•14 years ago
|
||
Assignee: general → jorendorff
Attachment #427803 -
Flags: review?(brendan)
|
||
Comment 2•14 years ago
|
||
Comment on attachment 427803 [details] [diff] [review] v1 Winning. Thanks, /be
Attachment #427803 -
Flags: review?(brendan) → review+
|
|
Assignee | |
Comment 3•14 years ago
|
||
http://hg.mozilla.org/tracemonkey/rev/2572dde9830c
Whiteboard: fixed-in-tracemonkey
|
||
Comment 4•14 years ago
|
||
http://hg.mozilla.org/mozilla-central/rev/2572dde9830c
Status: NEW → RESOLVED
Closed: 14 years ago
Resolution: --- → FIXED
You need to log in
before you can comment on or make changes to this bug.
Description
•