[JSC] Do not touch VM after notifying Ready in DFG::Worklist
authorutatane.tea@gmail.com <utatane.tea@gmail.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Wed, 28 Jun 2017 00:46:50 +0000 (00:46 +0000)
committerutatane.tea@gmail.com <utatane.tea@gmail.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Wed, 28 Jun 2017 00:46:50 +0000 (00:46 +0000)
commit36f9f3a1b0ae58433e30da9a21c70291e5730c3a
tree1f6c5898790fa69e4b0583ab6439bb573a971f9f
parent9a11b99fd341451f9fbdc7174ad761a05673acce
[JSC] Do not touch VM after notifying Ready in DFG::Worklist
https://bugs.webkit.org/show_bug.cgi?id=173888

Reviewed by Saam Barati.

After notifying Plan::Ready and releasing Worklist lock, VM can be destroyed.
Thus, Plan::vm() can return a destroyed VM. Do not touch it.
This causes occasional SEGV / assertion failures in workers/bomb test.

* dfg/DFGWorklist.cpp:

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@218856 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Source/JavaScriptCore/ChangeLog
Source/JavaScriptCore/dfg/DFGWorklist.cpp