[webkit-reviews] review granted: [Bug 60672] Protect JSC from WebCore executing JS during JS wrapper finalization : [Attachment 93228] Patch

[bugzilla-daemon at webkit.org]

Darin Adler <darin at apple.com> has granted Oliver Hunt <oliver at apple.com>'s
request for review:
Bug 60672: Protect JSC from WebCore executing JS during JS wrapper finalization
https://bugs.webkit.org/show_bug.cgi?id=60672

Attachment 93228: Patch
https://bugs.webkit.org/attachment.cgi?id=93228&action=review

------- Additional Comments from Darin Adler <darin at apple.com>
View in context: https://bugs.webkit.org/attachment.cgi?id=93228&action=review

It’s clean to forbid this at the JavaScriptCore level, but we’d also like to
change WebCore so it doesn’t have the kind of dangerous destructors that could
lead to this kind of reentrancy.

> Source/JavaScriptCore/heap/Heap.h:83
> -	   bool isBusy(); // true if an allocation or collection is in progress

> +	   // true if an allocation or collection is in progress
> +	   bool isBusy()
> +	   {
> +	       return m_operationInProgress != NoOperation;
> +	   }

You could have put this inline at the end of the file. I often prefer that
because I like the class definition to be as clean as possible.