Re: Proposal for fixing race conditions

On Jul 18, 2013, at 11:41 AM, Ehsan Akhgari <ehsan.akhgari@gmail.com> wrote:

> The problem Jer described is a bug in JavascriptCore.  There is no reason why it should be an issue in other JS engines, and I know that it is not an issue in SpiderMonkey (not sure about v8).  I think this is a bug that JSC needs to fix anyway, since neutering is already a concept used in other parts of the web platform.

There is no "fix".  JSC can assume that the length of ArrayBuffers is immutable, and those assumptions are invalidated by neutering.  Once /any/ neutering happens, this invalidates the assumptions for every ArrayBuffer in existence, forcing JSC to do a neuter-check or a length-check for every ArrayBuffer upon access.

It may be the case that SpiderMonkey and V8 check to see if an ArrayBuffer has been neutered before each and every access into that ArrayBuffer, but that just means those engines already suffer from this neutering performance penalty.

-Jer

Received on Thursday, 18 July 2013 18:48:45 UTC