[Webkit-unassigned] [Bug 66845] New: ErrorInstance::create sometimes has two heap object constructions in flight at once

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=66845

           Summary: ErrorInstance::create sometimes has two heap object
                    constructions in flight at once
           Product: WebKit
           Version: 528+ (Nightly build)
          Platform: All
        OS/Version: All
            Status: NEW
          Severity: Normal
          Priority: P2
         Component: JavaScriptCore
        AssignedTo: webkit-unassigned at lists.webkit.org
        ReportedBy: fpizlo at apple.com


Under the newly refactored heap object creation scheme, only one heap object can have its C++ constructor in flight at a time.  This ensures that a GC cannot be fired while some object has yet to have its initial state (i.e. vtable) set.  However, the ErrorInstance::create(ExecState*, Structure*, JSValue) constructor violates this constraint by calling toString() in the argument list to a placement new call.

-- 
Configure bugmail: https://bugs.webkit.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.