Magic-Mirror/gecko-dev
1
0
Fork 0
mirror of https://github.com/mozilla/gecko-dev.git synced 2024-10-21 01:05:45 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Bug 1470732 - Unprotect memory before moving to the list of finished/cancelled compilations. r=tcampbell

Browse Source
This commit is contained in:
Nicolas B. Pierron 2018-06-25 16:06:08 +00:00
parent 66543eb036
commit 00c520aeba
2 changed files with 17 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

12
js/src/jit-test/tests/basic/bug1470732.js Normal file
View File

@ -0,0 +1,12 @@
if (helperThreadCount() === 0)
quit();
var i = 0;
while(i++ < 500) {
evalInWorker(`
setJitCompilerOption("baseline.warmup.trigger", 10);
`);
let m = parseModule("");
m.declarationInstantiation();
}

5
js/src/vm/HelperThreads.cpp
View File

@ -297,6 +297,11 @@ CancelOffThreadIonCompileLocked(const CompilationSelector& selector, bool discar
for (size_t i = 0; i < worklist.length(); i++) {
jit::IonBuilder* builder = worklist[i];
if (IonBuilderMatches(selector, builder)) {
// Once finished, builders are handled by a Linked list which is
// allocated with the IonBuilder class which is contained in the
// LifoAlloc-ated structure. Thus we need it to be mutable.
worklist[i]->alloc().lifoAlloc()->setReadWrite();
FinishOffThreadIonCompile(builder, lock);
HelperThreadState().remove(worklist, &i);
}