[Webkit-unassigned] [Bug 220641] New: SIGUSR1 crashes binaries that embed JavaScriptCore

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=220641

            Bug ID: 220641
           Summary: SIGUSR1 crashes binaries that embed JavaScriptCore
           Product: WebKit
           Version: WebKit Nightly Build
          Hardware: Unspecified
                OS: Linux
            Status: NEW
          Severity: Normal
          Priority: P2
         Component: JavaScriptCore
          Assignee: webkit-unassigned at lists.webkit.org
          Reporter: gjp at google.com

JSC uses SIGUSR1 to suspend/resume threads on Linux. However, this signal handler can segfault if a process using JSC receives a SIGUSR1 at a very particular time: after JSC initialization (i.e. when the signal handler is installed), but before the first time that JSC actually does a Thread suspend.

I believe (from stack traces) that this is coming from this line: https://trac.webkit.org/browser/webkit/trunk/Source/WTF/wtf/posix/ThreadingPOSIX.cpp?rev=270806#L121

Specifically, the `targetThread` global is still nullptr in this situation. Perhaps a null check will suffice as a fix?

-- 
You are receiving this mail because:
You are the assignee for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.webkit.org/pipermail/webkit-unassigned/attachments/20210115/56d30553/attachment-0001.htm>