v8/test/mjsunit/regress/regress-crbug-504136.js

// Copyright 2015 the V8 project authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.

if (this.Worker) {
  var __v_10 = new Worker('', {type: 'string'});
  __v_10.terminate();
 __v_10.getMessage();
}
Fix cluster-fuzz regression when getting message from Worker The issue is that Worker.prototype.terminate was deleting the C++ Worker object, and then Worker.prototype.getMessage was trying to read messages from the queue. The simplest solution is to keep workers in a zombie state when they have been terminated. They won't be reaped until Shell::CleanupWorkers is called. I've also fixed some threading issues with Workers: * Workers can be created by another Worker, so the Shell::workers_ variable must be protected by a mutex. * An individual Worker can typically only be accessed by the isolate that created it, but the main thread can always terminate it, so the Worker::state_ must be accessed in a thread-safe way. BUG=chromium:504136 R=jochen@chromium.org LOG=n Review URL: https://codereview.chromium.org/1208733002 Cr-Commit-Position: refs/heads/master@{#29306} 2015-06-25 18:01:11 +00:00			`// Copyright 2015 the V8 project authors. All rights reserved.`
			`// Use of this source code is governed by a BSD-style license that can be`
			`// found in the LICENSE file.`

			`if (this.Worker) {`
[d8] Update `new Worker` API to match the Web API Previously we only supported strings and not filenames. This changes the default to filename and adds a new `type: string` which can be passed `options` to allow for strings to be passed in test code. See: https://developer.mozilla.org/en-US/docs/Web/API/Worker/Worker Bug: v8:8020 Cq-Include-Trybots: luci.v8.try:v8_linux_noi18n_rel_ng Change-Id: Ie8818885c5c5c071b6614852322cb45aeb01a647 Reviewed-on: https://chromium-review.googlesource.com/1185980 Commit-Queue: Sam Clegg <sbc@chromium.org> Reviewed-by: Ben Smith <binji@chromium.org> Cr-Commit-Position: refs/heads/master@{#56056} 2018-09-19 23:30:04 +00:00			`var __v_10 = new Worker('', {type: 'string'});`
Fix cluster-fuzz regression when getting message from Worker The issue is that Worker.prototype.terminate was deleting the C++ Worker object, and then Worker.prototype.getMessage was trying to read messages from the queue. The simplest solution is to keep workers in a zombie state when they have been terminated. They won't be reaped until Shell::CleanupWorkers is called. I've also fixed some threading issues with Workers: * Workers can be created by another Worker, so the Shell::workers_ variable must be protected by a mutex. * An individual Worker can typically only be accessed by the isolate that created it, but the main thread can always terminate it, so the Worker::state_ must be accessed in a thread-safe way. BUG=chromium:504136 R=jochen@chromium.org LOG=n Review URL: https://codereview.chromium.org/1208733002 Cr-Commit-Position: refs/heads/master@{#29306} 2015-06-25 18:01:11 +00:00			`__v_10.terminate();`
			`__v_10.getMessage();`
			`}`