[webkit-changes] [WebKit/WebKit] 3985cf: [WTF] ThreadSafeWeakOrStrongPtr should appropriate...

[Yusuke Suzuki]

  Branch: refs/heads/main
  Home:   https://github.com/WebKit/WebKit
  Commit: 3985cfe856ce74f978ce7d1a85408d3a5864a9bf
      https://github.com/WebKit/WebKit/commit/3985cfe856ce74f978ce7d1a85408d3a5864a9bf
  Author: Yusuke Suzuki <ysuzuki at apple.com>
  Date:   2025-01-15 (Wed, 15 Jan 2025)

  Changed paths:
    A JSTests/wasm/stress/thread-safe-weak-or-strong-ptr-validate.js
    M Source/WTF/wtf/ThreadSafeWeakPtr.h

  Log Message:
  -----------
  [WTF] ThreadSafeWeakOrStrongPtr should appropriately reset payload
https://bugs.webkit.org/show_bug.cgi?id=286042
rdar://142973371

Reviewed by Keith Miller.

The code like this is not correct.

    if (isWeak())
        m_weak = nullptr;
    m_strong = ...

The reason is that m_weak does not change the enum. As a result,
m_strong contains Weak enum in the pointer, causing the crash due to
destroying invalid pointer. This patch refactors ThreadSafeWeakOrStrongPtr
so that we can clearly track the underlying payload state.

* JSTests/wasm/stress/thread-safe-weak-or-strong-ptr-validate.js: Added.
(instantiate):
(const.log):
(async let.fn0):
(let.fn1):
(let.fn2):
(let.fn3):
(let.fn4):
(let.fn5):
(async let):
* Source/WTF/wtf/ThreadSafeWeakPtr.h:
(WTF::ThreadSafeWeakOrStrongPtr::operator=):
(WTF::ThreadSafeWeakOrStrongPtr::ThreadSafeWeakOrStrongPtr):
(WTF::ThreadSafeWeakOrStrongPtr::swap):
(WTF::ThreadSafeWeakOrStrongPtr::copyConstructFrom):
(WTF::ThreadSafeWeakOrStrongPtr::moveConstructFrom):

Canonical link: https://commits.webkit.org/288991@main



To unsubscribe from these emails, change your notification settings at https://github.com/WebKit/WebKit/settings/notifications